Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The buffer passed to fuzz_packet in a fuzz_tx fuzzer is always blank #525

Closed
hexdefined opened this issue Aug 25, 2021 · 0 comments
Closed
Labels

Comments

@hexdefined
Copy link

If a simple fuzzer is created:

struct TestFuzzer();
impl Fuzzer for TestFuzzer {
    fn fuzz_packet(&self, frame_data: &mut [u8]) {
        println!("{:02x?}", frame_data);
    }
}

...and used with a FuzzInjector:

let device = FuzzInjector::new(device, TestFuzzer(), TestFuzzer());

...then the bytes of the received packets are printed, but the buffer for transmitted data is always blank at the time that fuzz_packet gets called.

[00, 00, 00, 00, 00, 00, 00, 00, ...

This seems to be because fuzz_packet() is called before f() in the TxToken implementation.

If the order is reversed, then the buffer contains data as expected.

--- a/src/phy/fuzz_injector.rs
+++ b/src/phy/fuzz_injector.rs
@@ -123,8 +123,9 @@ impl<'a, Tx: phy::TxToken, FTx: Fuzzer> phy::TxToken for TxToken<'a, Tx, FTx> {
     {
         let Self { fuzzer, token } = self;
         token.consume(timestamp, len, |mut buf| {
+            let result = f(buf);
             fuzzer.fuzz_packet(&mut buf);
-            f(buf)
+            result
         })
     }
 }

Disclaimer: I'm quite new to Rust, and haven't properly tested this patch. It works for my project, but it's possible I'm misunderstanding something.

@bors bors bot closed this as completed in 41667f8 Oct 4, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Development

No branches or pull requests

2 participants