ubus/tests/fuzz, branch master

tests/fuzz: use size of blob_attr, not of a pointer, in length guard

2026-09-25T07:46:40Z

_ubus_parse_msg() guarded against short input with sizeof(struct blob_attr *), the size of a pointer, instead of sizeof(struct blob_attr), the header it is about to dereference. The two happen to differ (8 vs 4 bytes on LP64), so the harness skipped valid 4- to 7-byte messages that the real parser accepts. Compare against the size of the structure itself. Signed-off-by: Felix Fietkau

tests/fuzz: fix out-of-bounds read in header validation harness

2026-09-25T07:46:40Z

_ubus_validate_hdr() passed the input straight to ubus_validate_hdr() whenever size was not greater than sizeof(struct ubus_msghdr). That condition is backwards and too small: ubus_validate_hdr() dereferences the struct blob_attr located immediately after the header, so the harness needs at least sizeof(ubus_msghdr) + sizeof(blob_attr) bytes. An 8-byte input (exactly the header size) reached the validator and read blob_raw_len() one blob_attr past the end of the buffer. Require the full header plus the trailing blob_attr before validating. Signed-off-by: Felix Fietkau

fix blob parsing vulnerability by using blob_parse_untrusted

2019-12-19T18:53:25Z

blob_parse expects blobs from trusted inputs, but it can be supplied with possibly malicious blobs from untrusted inputs as well, which might lead to undefined behaviour and/or crash of ubus daemon. In order to prevent such conditions, switch to blob_parse_untrusted which should hopefully handle such untrusted inputs appropriately. Signed-off-by: Petr Štetiar

add fuzzer and cram based unit tests

2019-12-16T22:39:16Z

For improved QA etc. Signed-off-by: Petr Štetiar