Fuzzer for traceroute's decode_reply(), a static function

fuzz/fuzz_traceroute_decode_reply.cc

@@ -0,0 +1,17 @@
+#include "common.h"
+#include "../traceroute.h"
+
+#include <stddef.h>
+#include <stdint.h>
+
+extern "C"
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+  fuzz_init();
+
+  static volatile bool ret;
+  ret = fuzz_decode_reply(data, size);
+  (void) ret;
+
+  return 0;
+}

traceroute.cc

@@ -99,6 +99,9 @@ router X. The only way to be sure is to do a complete trace for each target
 individually.
 */
 
+#ifdef HAVE_CONFIG_H
+#include "nmap_config.h"
+#endif
 #include "nmap_dns.h"
 #include "nmap_error.h"
 #include "nmap_tty.h"
@@ -1208,6 +1211,13 @@ static bool decode_reply(const u8 *ip, unsigned int len, Reply *reply) {
 
   return true;
 }
+#ifdef ENABLE_FUZZING
+bool fuzz_decode_reply(const u8 *ip, unsigned int len) {
+  global_id = 0;
+  Reply reply;
+  return decode_reply(ip, len, &reply);
+}
+#endif
 
 static bool read_reply(Reply *reply, pcap_t *pd, long timeout) {
   const u8 *ip;

traceroute.h

@@ -71,4 +71,5 @@ int traceroute(std::vector<Target *> &Targets);
 
 void traceroute_hop_cache_clear();
 
+bool fuzz_decode_reply(const uint8_t *ip, unsigned int len);
 #endif