frank/ruvnet--RuView
1
0
Fork 0
mirror of https://github.com/ruvnet/RuView synced 2026-07-31 18:51:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(fuzz): extend csi_serialize fuzz harness for ADR-110 byte 18-19

Browse Source 
The libFuzzer harness was compiled without CONFIG_CSI_FRAME_HE_TAGGING,
so the new byte 18/19 path in csi_collector.c was zero-filled at compile
time and never fuzzed. Three changes to fix that:

1. test/stubs/esp_stubs.h: wifi_pkt_rx_ctrl_t gains both branch families
   - HE branch (CONFIG_SOC_WIFI_HE_SUPPORT path): cur_bb_format, second
   - Legacy branch (S3 / pre-HE chips): sig_mode, cwb, stbc
   A single stub compiles for either branch; the Makefile picks which
   one is active via -D flags. Both sets are declared so a build for
   the unselected branch still compiles cleanly.

2. test/Makefile: CFLAGS now defines CONFIG_CSI_FRAME_HE_TAGGING=1 so
   the new code path is reachable. CONFIG_SOC_WIFI_HE_SUPPORT stays
   UNSET (default — exercises the legacy S3 branch). Add it to CFLAGS
   for a parallel HE-stub run if you want coverage of the C6 branch.

3. test/fuzz_csi_serialize.c: parses 3 more control bytes from fuzz
   input (he_inputs[2] + legacy_inputs) and writes them through
   info.rx_ctrl.{cur_bb_format,second,sig_mode,cwb,stbc} so the
   serializer's PpduType switch and Adr018Flags computation are
   reached on every iteration.

Result: the existing libFuzzer corpus + ASAN/UBSAN now covers the
ADR-110 wire encoding paths on every run. No more zero-fill silent skip.

Co-Authored-By: claude-flow <ruv@ruv.net>
This commit is contained in:
ruv
2026-05-22 23:00:09 -04:00
parent 89972c0917
commit fc75a8a5c8
3 changed files with 42 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
firmware/esp32-csi-node/test/Makefile
+6
View File
@@ -20,6 +20,11 @@
# FUZZ_JOBS=4 # Parallel fuzzing jobs
CC = clang
# ADR-110: -DCONFIG_CSI_FRAME_HE_TAGGING=1 enables the byte-18/19 HE path
# in csi_collector.c so the fuzzer exercises that code as well as the
# legacy zero-fill path. CONFIG_SOC_WIFI_HE_SUPPORT is left UNSET to
# exercise the legacy S3 branch (sig_mode/cwb/stbc). Add it to CFLAGS for
# a parallel HE-stub build if you want fuzz coverage of the C6 branch.
CFLAGS = -fsanitize=fuzzer,address,undefined -g -O1 \
-Istubs -I../main \
-DCONFIG_CSI_NODE_ID=1 \
@@ -28,6 +33,7 @@ CFLAGS = -fsanitize=fuzzer,address,undefined -g -O1 \
-DCONFIG_CSI_TARGET_IP=\"192.168.1.1\" \
-DCONFIG_CSI_TARGET_PORT=5500 \
-DCONFIG_ESP_WIFI_CSI_ENABLED=1 \
-DCONFIG_CSI_FRAME_HE_TAGGING=1 \
-Wno-unused-function
STUBS_SRC = stubs/esp_stubs.c