Discovered some bugs in an HTTP library used in upnp software found in Zyxel and some other brands routers. Unfortunately no code execution but did get reliable crashes!

All it took was honggfuzz and ~30 lines of code:

    #include <string.h>
    #include <unistd.h>
    #include <mupnp/http/http.h>

    #define MUPNP_TESTCASE_HTTP_PORT 8080
    #define MUPNP_TESTCASE_HTTP_PAGE "<HTML><BODY>Hello World</BODY></HTML>"
    #define MUPNP_TESTCASE_HTTP_URL "/index.html"

    void ClinkTestcaseHttpRequestRecieved(mUpnpHttpRequest* httpReq) {
      mUpnpHttpResponse* httpRes;

      httpRes = mupnp_http_response_new();
      mupnp_http_response_setstatuscode(httpRes, MUPNP_HTTP_STATUS_OK);
      mupnp_http_response_setcontent(httpRes, MUPNP_TESTCASE_HTTP_PAGE);
      mupnp_http_response_setcontenttype(httpRes, "text/html");
      mupnp_http_response_setcontentlength(httpRes, strlen(MUPNP_TESTCASE_HTTP_PAGE));
      mupnp_http_request_postresponse(httpReq, httpRes);
      mupnp_http_response_delete(httpRes);
    }

    HFND_FUZZING_ENTRY_FUNCTION(int argc, const char *const argv[]) {
        mUpnpHttpServer* httpServer = mupnp_http_server_new();
        mupnp_http_server_open(httpServer, MUPNP_TESTCASE_HTTP_PORT, NULL);
        mupnp_http_server_setlistener(httpServer, ClinkTestcaseHttpRequestRecieved);
        mupnp_http_server_start(httpServer);

        while (1) {
          sleep(1);
        };

        mupnp_http_server_stop(httpServer);
        return EXIT_SUCCESS;
    }