From 66a98482ed2404c37eca23a0a845a83d22d0cfb7 Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@nestlabs.com>
Date: Wed, 30 Aug 2017 22:01:16 -0700
Subject: [PATCH] [fuzz] clean up state at the end of each iteration (#2151)

---
 tests/fuzz/ip6_send.cpp           | 30 +++++++++++++++++++++---------
 tests/fuzz/radio_receive_done.cpp | 29 +++++++++++++++++++----------
 2 files changed, 40 insertions(+), 19 deletions(-)

diff --git a/tests/fuzz/ip6_send.cpp b/tests/fuzz/ip6_send.cpp
index 5c78b8236..ec639a5d7 100644
--- a/tests/fuzz/ip6_send.cpp
+++ b/tests/fuzz/ip6_send.cpp
@@ -44,7 +44,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 {
     const otPanId panId = 0xdead;
 
-    otInstance *sInstance;
+    otInstance *instance = NULL;
     otMessage *message = NULL;
     otError error = OT_ERROR_NONE;
     bool isSecure;
@@ -53,23 +53,35 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 
     FuzzerPlatformInit();
 
-    sInstance = otInstanceInitSingle();
-    otLinkSetPanId(sInstance, panId);
-    otIp6SetEnabled(sInstance, true);
-    otThreadSetEnabled(sInstance, true);
-    otThreadBecomeLeader(sInstance);
+    instance = otInstanceInitSingle();
+    otLinkSetPanId(instance, panId);
+    otIp6SetEnabled(instance, true);
+    otThreadSetEnabled(instance, true);
+    otThreadBecomeLeader(instance);
 
     isSecure = (data[0] & 0x1) != 0;
 
-    message = otIp6NewMessage(sInstance, isSecure);
+    message = otIp6NewMessage(instance, isSecure);
     VerifyOrExit(message != NULL, error = OT_ERROR_NO_BUFS);
 
     error = otMessageAppend(message, data + 1, static_cast<uint16_t>(size - 1));
     SuccessOrExit(error);
 
-    error = otIp6Send(sInstance, message);
-    SuccessOrExit(error);
+    error = otIp6Send(instance, message);
+
+    message = NULL;
 
 exit:
+
+    if (message != NULL)
+    {
+        otMessageFree(message);
+    }
+
+    if (instance != NULL)
+    {
+        otInstanceFinalize(instance);
+    }
+
     return 0;
 }
diff --git a/tests/fuzz/radio_receive_done.cpp b/tests/fuzz/radio_receive_done.cpp
index 6a9cf8e4a..2e20e2859 100644
--- a/tests/fuzz/radio_receive_done.cpp
+++ b/tests/fuzz/radio_receive_done.cpp
@@ -45,19 +45,19 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 {
     const otPanId panId = 0xdead;
 
-    otInstance *sInstance;
+    otInstance *instance = NULL;
     otRadioFrame frame;
-    uint8_t *buf;
+    uint8_t *buf = NULL;
 
     VerifyOrExit(size <= OT_RADIO_FRAME_MAX_SIZE);
 
     FuzzerPlatformInit();
 
-    sInstance = otInstanceInitSingle();
-    otLinkSetPanId(sInstance, panId);
-    otIp6SetEnabled(sInstance, true);
-    otThreadSetEnabled(sInstance, true);
-    otThreadBecomeLeader(sInstance);
+    instance = otInstanceInitSingle();
+    otLinkSetPanId(instance, panId);
+    otIp6SetEnabled(instance, true);
+    otThreadSetEnabled(instance, true);
+    otThreadBecomeLeader(instance);
 
     buf = static_cast<uint8_t *>(malloc(size));
 
@@ -68,10 +68,19 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 
     memcpy(buf, data, frame.mLength);
 
-    otPlatRadioReceiveDone(sInstance, &frame, OT_ERROR_NONE);
-
-    free(buf);
+    otPlatRadioReceiveDone(instance, &frame, OT_ERROR_NONE);
 
 exit:
+
+    if (buf != NULL)
+    {
+        free(buf);
+    }
+
+    if (instance != NULL)
+    {
+        otInstanceFinalize(instance);
+    }
+
     return 0;
 }