test: set to zero when start_time exceeds limit (envoyproxy#4328)

When the RequestInfo start_time exceeds max limit, set to zero to avoid undefined behavior. Before this patch, utility's fromRequestInfo experienced similar error below: /usr/include/c++/5/chrono:176:67: runtime error: signed integer overflow: 9799832698963886 * 1000 cannot be represented in type 'long int' Fixes oss-fuzz issues: * https://oss-fuzz.com/v2/testcase-detail/5647641023610880 (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10124) * https://oss-fuzz.com/v2/testcase-detail/5701824317751296 (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10128) Risk Level: Low Testing: ASAN/UBSAN tests, corpus entries added. Signed-off-by: Dhi Aurrahman <dio@tetrate.io>
rshriram · Sep 4, 2018 · d243cd6 · d243cd6
1 parent 0a1e92a
commit d243cd6
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 2 deletions.
diff --git a/...ter_corpus/clusterfuzz-testcase-minimized-access_log_formatter_fuzz_test-5701824317751296 b/...ter_corpus/clusterfuzz-testcase-minimized-access_log_formatter_fuzz_test-5701824317751296
@@ -0,0 +1 @@
+format: "%START_TIME(%f)%" request_info {   start_time: 18446744073709551615 } 
diff --git a/...der_parser_corpus/clusterfuzz-testcase-minimized-header_parser_fuzz_test-5647641023610880 b/...der_parser_corpus/clusterfuzz-testcase-minimized-header_parser_fuzz_test-5647641023610880
@@ -0,0 +1 @@
+headers_to_add {   header {     key: " "     value: "%START_TIME(�)%"   } } request_info {   start_time: 9799832698963886077 } 
diff --git a/test/fuzz/utility.h b/test/fuzz/utility.h
@@ -37,8 +37,11 @@ inline TestRequestInfo fromRequestInfo(const test::fuzz::RequestInfo& request_in
   TestRequestInfo test_request_info;
   test_request_info.metadata_ = request_info.dynamic_metadata();
   // libc++ clocks don't track at nanosecond on OS X.
-  test_request_info.start_time_ =
-      SystemTime(std::chrono::microseconds(request_info.start_time() / 1000));
+  const auto start_time =
+      std::numeric_limits<std::chrono::nanoseconds::rep>::max() < request_info.start_time()
+          ? 0
+          : request_info.start_time() / 1000;
+  test_request_info.start_time_ = SystemTime(std::chrono::microseconds(start_time));
   if (request_info.has_response_code()) {
     test_request_info.response_code_ = request_info.response_code().value();
   }