Page MenuHomePhabricator

tests: Avoid fuzzer-specific nullptr dereference in libevent when handling PROXY requests
ClosedPublic

Authored by Fabien on Jan 21 2021, 10:34.

Details

Summary
The dereference (req->evcon->http_server) takes place in
evhttp_parse_request_line and is a consequence of our hacky but
necessary use of the internal function evhttp_parse_firstline_ in the
http_request fuzzing harness.

The suggested workaround is not aesthetically pleasing, but it
successfully avoids the troublesome code path.

" http:// HTTP/1.1\n" was a crashing input prior to this workaround.

Backport of core PR19140.

Depends on D9001.

Test Plan
ninja bitcoin-fuzzers
echo " http:// HTTP/1.1" > input
./src/test/fuzz/http_request input