From 7b6a601e4d10df598bc9e00f4af8c98f753df689 Mon Sep 17 00:00:00 2001
From: stong <stong@users.noreply.github.com>
Date: Tue, 4 May 2021 03:48:04 -0400
Subject: [PATCH] Improve toy example

- In release mode, fuzz_me was being inlined
- Make the buggy library more interesting in terms of control flow paths
---
 samples/toy_example/example.cc          |  6 +++---
 samples/toy_example/example_library.cpp | 26 +++++++++++++++----------
 2 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/samples/toy_example/example.cc b/samples/toy_example/example.cc
index 35eef06..7cc7b05 100644
--- a/samples/toy_example/example.cc
+++ b/samples/toy_example/example.cc
@@ -21,15 +21,15 @@ void check_fwrite()
     counter++;
 }
 
-void __stdcall fuzz_me(char* filename)
+__declspec(noinline) void __stdcall fuzz_me(char* filename)
 {
     char buf[201];
     ZeroMemory(&buf, 201);
     FILE *fp = fopen(filename, "rb");
     fread(buf, 1, 200, fp);
 
-    test_func_t Math_test_func = (test_func_t) GetProcAddress(hMathlib, "test"); // index
-    int result = Math_test_func(buf);      
+    test_func_t test_func = (test_func_t) GetProcAddress(hMathlib, "test"); // index
+    int result = test_func(buf);
     printf("Result: %d\n", result);    
     fclose(fp);  
 
diff --git a/samples/toy_example/example_library.cpp b/samples/toy_example/example_library.cpp
index 63fa7d1..c015083 100644
--- a/samples/toy_example/example_library.cpp
+++ b/samples/toy_example/example_library.cpp
@@ -15,28 +15,34 @@ extern "C" __declspec(dllexport) int test(char *input)
   int v9;
 
   printf("msg:%s\n", input);
-  if ( *input == 't' )
+  if ( input[0] != 't' )
   {
     printf("Error 1\n");
     return 0;
   }
-  if ( input[1] == 'e' )
+  if ( input[1] != 'e' )
   {
     printf("Error 2\n");
     return 0;
   }
-  if ( input[2] == 's' )
+  if ( input[2] != 's' )
   {
+    printf("Error 3\n");
+    return 0;
+  }
+  if (input[3] == '*' )
+  {
+    // simple nullptr deref
+    *(volatile char*)0 = 1;
+    return 0;
+  }
+  else if (input[3] == '!')
+  {
+    // trigger a timeout
     Sleep(5000);
     return 0;
   }
-  v2 = input[3];
-  if ( v2 == 't' )
-  {
-    *(char*)0 = 1;
-    return 0;
-  }
-  if ( v2 != 101 )
+  else if (input[3] != 't' )
   {
     printf("Error 4\n");
     return 0;