[fuzz] Fix crashes when parsing GENERATE (#1016)

* [fuzz] Fix crashes when parsing GENERATE

Running the fuzzer on NewRR, some crashes came up that could be
prevented by checking that the token after the range is a Blank.
This diff checks that and return an error when the blank is not found.

* * s/Expect blank /garbage /
* get rid of if/else
This commit is contained in:
chantra 2019-10-02 23:37:56 -07:00 committed by Miek Gieben
parent 93f749db12
commit 8ebfd8abbb
2 changed files with 30 additions and 1 deletions

View File

@ -53,7 +53,11 @@ func (zp *ZoneParser) generate(l lex) (RR, bool) {
return zp.setParseError("bad range in $GENERATE range", l)
}
zp.c.Next() // _BLANK
// _BLANK
l, ok := zp.c.Next()
if !ok || l.value != zBlank {
return zp.setParseError("garbage after $GENERATE range", l)
}
// Create a complete new string, which we then parse again.
var s string

View File

@ -204,3 +204,28 @@ $GENERATE 32-158 dhcp-${-32,4,d} A 10.0.0.$
}
}
}
func TestCrasherString(t *testing.T) {
tests := []struct{
in string
err string
}{
{"$GENERATE 0-300103\"$$GENERATE 2-2", "dns: garbage after $GENERATE range: \"\\\"\" at line: 1:19"},
{"$GENERATE 0-5414137360", "dns: garbage after $GENERATE range: \"\\n\" at line: 1:22"},
{"$GENERATE 11522-3668518066406258", "dns: garbage after $GENERATE range: \"\\n\" at line: 1:38"},
{"$GENERATE 0-200\"(;00000000000000\n$$GENERATE 0-0", "dns: garbage after $GENERATE range: \"\\\"\" at line: 1:16"},
}
for _, tc := range tests {
t.Run(tc.in, func(t *testing.T) {
_, err := NewRR(tc.in)
if err == nil {
t.Errorf("Expecting error for crasher line %s", tc.in)
}
if tc.err != err.Error() {
t.Errorf("Expecting error %s, got %s", tc.err, err.Error())
}
})
}
}