fuzz: check tcp splitting evasions in protocol detection

src/tests/fuzz/fuzz_applayerprotodetectgetproto.c

@@ -24,6 +24,8 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
     Flow *f;
     TcpSession ssn;
     bool reverse;
+    AppProto alproto;
+    AppProto alproto2;
 
     if (size < HEADER_LEN) {
         return 0;
@@ -50,7 +52,21 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
     f->protoctx = &ssn;
     f->protomap = FlowGetProtoMapping(f->proto);
 
-    AppLayerProtoDetectGetProto(alpd_tctx, f, data+HEADER_LEN, size-HEADER_LEN, f->proto, data[0], &reverse);
+    alproto = AppLayerProtoDetectGetProto(alpd_tctx, f, data+HEADER_LEN, size-HEADER_LEN, f->proto, data[0], &reverse);
+    if (alproto != ALPROTO_UNKNOWN && alproto != ALPROTO_FAILED && f->proto == IPPROTO_TCP) {
+        /* If we find a valid protocol :
+         * check that with smaller input
+         * we find the same protocol or ALPROTO_UNKNOWN.
+         * Otherwise, we have evasion with TCP splitting
+         */
+        for (size_t i = 0; i < size-HEADER_LEN; i++) {
+            alproto2 = AppLayerProtoDetectGetProto(alpd_tctx, f, data+HEADER_LEN, i, f->proto, data[0], &reverse);
+            if (alproto2 != ALPROTO_UNKNOWN && alproto2 != alproto) {
+                printf("Assertion failure : With input length %"PRIuMAX", found %s instead of %s\n", (uintmax_t) i, AppProtoToString(alproto2), AppProtoToString(alproto));
+                abort();
+            }
+        }
+    }
     UTHFreeFlow(f);
 
     return 0;