frank/ruvnet--RuView
1
0
Fork 0
mirror of https://github.com/ruvnet/RuView synced 2026-08-02 19:11:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(fuzz): extend csi_serialize fuzz harness for ADR-110 byte 18-19

Browse Source 
The libFuzzer harness was compiled without CONFIG_CSI_FRAME_HE_TAGGING,
so the new byte 18/19 path in csi_collector.c was zero-filled at compile
time and never fuzzed. Three changes to fix that:

1. test/stubs/esp_stubs.h: wifi_pkt_rx_ctrl_t gains both branch families
   - HE branch (CONFIG_SOC_WIFI_HE_SUPPORT path): cur_bb_format, second
   - Legacy branch (S3 / pre-HE chips): sig_mode, cwb, stbc
   A single stub compiles for either branch; the Makefile picks which
   one is active via -D flags. Both sets are declared so a build for
   the unselected branch still compiles cleanly.

2. test/Makefile: CFLAGS now defines CONFIG_CSI_FRAME_HE_TAGGING=1 so
   the new code path is reachable. CONFIG_SOC_WIFI_HE_SUPPORT stays
   UNSET (default — exercises the legacy S3 branch). Add it to CFLAGS
   for a parallel HE-stub run if you want coverage of the C6 branch.

3. test/fuzz_csi_serialize.c: parses 3 more control bytes from fuzz
   input (he_inputs[2] + legacy_inputs) and writes them through
   info.rx_ctrl.{cur_bb_format,second,sig_mode,cwb,stbc} so the
   serializer's PpduType switch and Adr018Flags computation are
   reached on every iteration.

Result: the existing libFuzzer corpus + ASAN/UBSAN now covers the
ADR-110 wire encoding paths on every run. No more zero-fill silent skip.

Co-Authored-By: claude-flow <ruv@ruv.net>
This commit is contained in:
ruv
2026-05-22 23:00:09 -04:00
parent 89972c0917
commit fc75a8a5c8
3 changed files with 42 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
firmware/esp32-csi-node/test/stubs/esp_stubs.h
+21 -7
View File
@@ -62,14 +62,28 @@ static inline esp_err_t esp_timer_delete(esp_timer_handle_t h) { (void)h; return
/* ---- esp_wifi_types.h ---- */
/** Minimal rx_ctrl fields needed by csi_serialize_frame. */
/** Minimal rx_ctrl fields needed by csi_serialize_frame.
*
* ADR-110: the HE-tagging path in csi_collector.c references either
* (CONFIG_SOC_WIFI_HE_SUPPORT branch) cur_bb_format, second
* (legacy / S3 branch) sig_mode, cwb, stbc
*
* Both sets are unconditionally declared here so a single stub builds
* for either branch — the Makefile picks which side via -D flags. */
typedef struct {
signed rssi : 8;
unsigned channel : 4;
unsigned noise_floor : 8;
unsigned rx_ant : 2;
/* Padding to fill out the struct so it compiles. */
unsigned _pad : 10;
signed rssi : 8;
unsigned channel : 4;
unsigned noise_floor : 8;
unsigned rx_ant : 2;
/* ADR-110 HE-branch fields (CONFIG_SOC_WIFI_HE_SUPPORT path) */
unsigned cur_bb_format : 4; /**< 0=11b 1=11g/a 2=HT 3=VHT 4=HE-SU 5=HE-MU 6=HE-ER-SU 7=HE-TB */
unsigned second : 4; /**< secondary 40 MHz channel offset */
/* ADR-110 legacy-branch fields (pre-HE chips) */
unsigned sig_mode : 2; /**< 0=non-HT 1=HT 3=VHT */
unsigned cwb : 1; /**< 0=20 MHz 1=40 MHz */
unsigned stbc : 1; /**< STBC flag */
/* Padding to keep alignment predictable. */
unsigned _pad : 18;
} wifi_pkt_rx_ctrl_t;
/** Minimal wifi_csi_info_t needed by csi_serialize_frame. */