OpenSSL 1.1.1-pre2

fuzz/bndiv.c

@@ -15,32 +15,45 @@
 
 #include <stdio.h>
 #include <openssl/bn.h>
+#include <openssl/err.h>
 #include "fuzzer.h"
 
-int FuzzerInitialize(int *argc, char ***argv) {
+/* 256 kB */
+#define MAX_LEN (256 * 1000)
+
+static BN_CTX *ctx;
+static BIGNUM *b1;
+static BIGNUM *b2;
+static BIGNUM *b3;
+static BIGNUM *b4;
+static BIGNUM *b5;
+
+int FuzzerInitialize(int *argc, char ***argv)
+{
+    b1 = BN_new();
+    b2 = BN_new();
+    b3 = BN_new();
+    b4 = BN_new();
+    b5 = BN_new();
+    ctx = BN_CTX_new();
+
+    OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
+    ERR_get_state();
+
     return 1;
 }
 
-int FuzzerTestOneInput(const uint8_t *buf, size_t len) {
-    static BN_CTX *ctx;
-    static BIGNUM *b1;
-    static BIGNUM *b2;
-    static BIGNUM *b3;
-    static BIGNUM *b4;
-    static BIGNUM *b5;
+int FuzzerTestOneInput(const uint8_t *buf, size_t len)
+{
     int success = 0;
     size_t l1 = 0, l2 = 0;
     /* s1 and s2 will be the signs for b1 and b2. */
     int s1 = 0, s2 = 0;
 
-    if (ctx == NULL) {
-        b1 = BN_new();
-        b2 = BN_new();
-        b3 = BN_new();
-        b4 = BN_new();
-        b5 = BN_new();
-        ctx = BN_CTX_new();
-    }
+    /* limit the size of the input to avoid timeout */
+    if (len > MAX_LEN)
+        len = MAX_LEN;
+
     /* We are going to split the buffer in two, sizes l1 and l2, giving b1 and
      * b2.
      */
@@ -102,6 +115,17 @@ int FuzzerTestOneInput(const uint8_t *buf, size_t len) {
 
  done:
     OPENSSL_assert(success);
+    ERR_clear_error();
 
     return 0;
 }
+
+void FuzzerCleanup(void)
+{
+    BN_free(b1);
+    BN_free(b2);
+    BN_free(b3);
+    BN_free(b4);
+    BN_free(b5);
+    BN_CTX_free(ctx);
+}