From 5e63365572ba282f6db7eb03887583842c2eb9fe Mon Sep 17 00:00:00 2001
From: David Cermak <cermak@espressif.com>
Date: Fri, 18 Feb 2022 17:55:37 +0100
Subject: [PATCH 1/2] PPP: Add test exhibiting empty packet null-deref

---
 test/unit/Filelists.cmake  |  1 +
 test/unit/Filelists.mk     |  3 +-
 test/unit/lwip_unittests.c |  6 +++-
 test/unit/lwipopts.h       |  4 +++
 test/unit/ppp/test_pppos.c | 64 ++++++++++++++++++++++++++++++++++++++
 test/unit/ppp/test_pppos.h | 13 ++++++++
 6 files changed, 89 insertions(+), 2 deletions(-)
 create mode 100644 test/unit/ppp/test_pppos.c
 create mode 100644 test/unit/ppp/test_pppos.h

diff --git a/test/unit/Filelists.cmake b/test/unit/Filelists.cmake
index e1f40bc9..54e83ad8 100644
--- a/test/unit/Filelists.cmake
+++ b/test/unit/Filelists.cmake
@@ -28,4 +28,5 @@ set(LWIP_TESTFILES
 	${LWIP_TESTDIR}/tcp/test_tcp_oos.c
 	${LWIP_TESTDIR}/tcp/test_tcp.c
 	${LWIP_TESTDIR}/udp/test_udp.c
+	${LWIP_TESTDIR}/ppp/test_pppos.c
 )
diff --git a/test/unit/Filelists.mk b/test/unit/Filelists.mk
index 4b770782..59b3edb2 100644
--- a/test/unit/Filelists.mk
+++ b/test/unit/Filelists.mk
@@ -47,5 +47,6 @@ TESTFILES=$(TESTDIR)/lwip_unittests.c \
 	$(TESTDIR)/tcp/tcp_helper.c \
 	$(TESTDIR)/tcp/test_tcp_oos.c \
 	$(TESTDIR)/tcp/test_tcp.c \
-	$(TESTDIR)/udp/test_udp.c
+	$(TESTDIR)/udp/test_udp.c \
+	$(TESTDIR)/ppp/test_pppos.c
 
diff --git a/test/unit/lwip_unittests.c b/test/unit/lwip_unittests.c
index 497a44b2..c6931b08 100644
--- a/test/unit/lwip_unittests.c
+++ b/test/unit/lwip_unittests.c
@@ -15,6 +15,7 @@
 #include "mdns/test_mdns.h"
 #include "mqtt/test_mqtt.h"
 #include "api/test_sockets.h"
+#include "ppp/test_pppos.h"
 
 #include "lwip/init.h"
 #if !NO_SYS
@@ -76,7 +77,10 @@ int main(void)
     dhcp_suite,
     mdns_suite,
     mqtt_suite,
-    sockets_suite
+    sockets_suite,
+#if PPP_SUPPORT && PPPOS_SUPPORT    
+    pppos_suite,
+#endif /* PPP_SUPPORT && PPPOS_SUPPORT */
   };
   size_t num = sizeof(suites)/sizeof(void*);
   LWIP_ASSERT("No suites defined", num > 0);
diff --git a/test/unit/lwipopts.h b/test/unit/lwipopts.h
index e4523fc1..45a71fb1 100644
--- a/test/unit/lwipopts.h
+++ b/test/unit/lwipopts.h
@@ -69,6 +69,10 @@
 #define LWIP_MDNS_RESPONDER             1
 #define LWIP_NUM_NETIF_CLIENT_DATA      (LWIP_MDNS_RESPONDER)
 
+/* Enable PPP and PPPOS support for PPPOS test suites */
+#define PPP_SUPPORT                     1
+#define PPPOS_SUPPORT                   1
+
 /* Minimal changes to opt.h required for etharp unit tests: */
 #define ETHARP_SUPPORT_STATIC_ENTRIES   1
 
diff --git a/test/unit/ppp/test_pppos.c b/test/unit/ppp/test_pppos.c
new file mode 100644
index 00000000..a6fbb934
--- /dev/null
+++ b/test/unit/ppp/test_pppos.c
@@ -0,0 +1,64 @@
+#include "test_pppos.h"
+
+#include "lwip/netif.h"
+#include "netif/ppp/pppos.h"
+#include "netif/ppp/ppp.h"
+
+#if PPP_SUPPORT && PPPOS_SUPPORT
+static struct netif pppos_netif;
+static ppp_pcb *ppp;
+
+static u32_t ppp_output_cb(struct ppp_pcb_s *pcb, u8_t *data, u32_t len, void *ctx)
+{
+  LWIP_UNUSED_ARG(pcb);
+  LWIP_UNUSED_ARG(data);
+  LWIP_UNUSED_ARG(len);
+  LWIP_UNUSED_ARG(ctx);
+
+  return  0;
+}
+
+static void ppp_link_status_cb(ppp_pcb *pcb, int err_code, void *ctx)
+{
+  LWIP_UNUSED_ARG(pcb);
+  LWIP_UNUSED_ARG(err_code);
+  LWIP_UNUSED_ARG(ctx);
+}
+
+static void pppos_setup(void)
+{
+  ppp = pppos_create(&pppos_netif, ppp_output_cb, ppp_link_status_cb, NULL);
+  fail_if(ppp == NULL);
+  ppp_connect(ppp, 0);
+}
+
+static void pppos_teardown(void)
+{
+}
+
+START_TEST(test_pppos_empty_packet_with_valid_fcs)
+{
+  u8_t two_breaks[] = { 0x7e, 0, 0, 0x7e };
+  u8_t other_packet[] = { 0x7e, 0x7d, 0x20, 0x00, 0x7e };
+  /* Set internal states of the underlying pcb */
+  pppos_pcb *pppos = (pppos_pcb *)ppp->link_ctx_cb;
+  pppos->open = 1;  /* Pretend the connection is open already */
+  pppos->in_accm[0] = 0xf0;  /* Make sure 0x0's are not escaped chars */
+
+  pppos_input(ppp, two_breaks, sizeof(two_breaks));
+  pppos_input(ppp, other_packet, sizeof(other_packet));
+
+}
+END_TEST
+
+/** Create the suite including all tests for this module */
+Suite *
+pppos_suite(void)
+{
+  testfunc tests[] = {
+    TESTFUNC(test_pppos_empty_packet_with_valid_fcs)
+  };
+  return create_suite("PPPOS", tests, sizeof(tests)/sizeof(testfunc), pppos_setup, pppos_teardown);
+}
+
+#endif /* PPP_SUPPORT && PPPOS_SUPPORT */
diff --git a/test/unit/ppp/test_pppos.h b/test/unit/ppp/test_pppos.h
new file mode 100644
index 00000000..56b3b0cb
--- /dev/null
+++ b/test/unit/ppp/test_pppos.h
@@ -0,0 +1,13 @@
+#ifndef LWIP_HDR_TEST_PPPOS_H
+#define LWIP_HDR_TEST_PPPOS_H
+
+#include "../lwip_check.h"
+#include "netif/ppp/ppp.h"
+
+#if PPP_SUPPORT && PPPOS_SUPPORT
+
+Suite* pppos_suite(void);
+
+#endif /* PPP_SUPPORT && PPPOS_SUPPORT */
+
+#endif /* LWIP_HDR_TEST_PPPOS_H */
-- 
2.25.1

