Summary
fuzz/fuzz_targets/fuzz_sip_parse.rs does not fuzz asterisk_sip::parser. It contains its own SipMessage/parse_message reimplementation ("Minimal SIP message representation for fuzzing"). It never exercises the production parser, so it gives false confidence.
Evidence
- The fuzz
Cargo.toml deps are only thiserror, bytes — it does not depend on asterisk-sip.
- The standalone
parse_message in the target does no Content-Length body truncation and never calls extract_uri.
- As a result it structurally cannot reach the two panics just found in the real parser:
The same likely applies to fuzz_sdp_parse / fuzz_rtp_parse — worth auditing that they import the real crate.
Recommendation
Point the fuzz targets at the real code: add asterisk-sip = { path = "../crates/asterisk-sip" } to fuzz/Cargo.toml and call asterisk_sip::parser::SipMessage::parse(data) (and for coverage, drive extract_uri / extract_tag / parse_via on the parsed header values). A boundary-splitting Content-Length and a ">" before "<" From value should be added to the corpus.
Axis
Process/coverage hardening for SIP parsing robustness.
Summary
fuzz/fuzz_targets/fuzz_sip_parse.rsdoes not fuzzasterisk_sip::parser. It contains its ownSipMessage/parse_messagereimplementation ("Minimal SIP message representation for fuzzing"). It never exercises the production parser, so it gives false confidence.Evidence
Cargo.tomldeps are onlythiserror,bytes— it does not depend onasterisk-sip.parse_messagein the target does no Content-Length body truncation and never callsextract_uri.body[..cl]Content-Length char-boundary panic (DoS: SIP parser panics on Content-Length that splits a UTF-8 character (single UDP packet kills the stack) #112)extract_urireversed-range panic (DoS: extract_uri panics on a From/To/Contact header with '>' before '<' (reversed byte range) #114)The same likely applies to
fuzz_sdp_parse/fuzz_rtp_parse— worth auditing that they import the real crate.Recommendation
Point the fuzz targets at the real code: add
asterisk-sip = { path = "../crates/asterisk-sip" }tofuzz/Cargo.tomland callasterisk_sip::parser::SipMessage::parse(data)(and for coverage, driveextract_uri/extract_tag/parse_viaon the parsed header values). A boundary-splitting Content-Length and a">" before "<"From value should be added to the corpus.Axis
Process/coverage hardening for SIP parsing robustness.