/* Fuzz testing for the nanopb core. * Attempts to verify all the properties defined in the security model document. */ #include <pb_decode.h> #include <pb_encode.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <assert.h> #include <time.h> #include <malloc_wrappers.h> #include "alltypes_static.pb.h" #include "alltypes_pointer.pb.h" static uint64_t random_seed; /* Uses xorshift64 here instead of rand() for both speed and * reproducibility across platforms. */ static uint32_t rand_word() { random_seed ^= random_seed >> 12; random_seed ^= random_seed << 25; random_seed ^= random_seed >> 27; return random_seed * 2685821657736338717ULL; } /* Get a random integer in range, with approximately flat distribution. */ static int rand_int(int min, int max) { return rand_word() % (max + 1 - min) + min; } static bool rand_bool() { return rand_word() & 1; } /* Get a random byte, with skewed distribution. * Important corner cases like 0xFF, 0x00 and 0xFE occur more * often than other values. */ static uint8_t rand_byte() { uint32_t w = rand_word(); uint8_t b = w & 0xFF; if (w & 0x100000) b >>= (w >> 8) & 7; if (w & 0x200000) b <<= (w >> 12) & 7; if (w & 0x400000) b ^= 0xFF; return b; } /* Get a random length, with skewed distribution. * Favors the shorter lengths, but always atleast 1. */ static size_t rand_len(size_t max) { uint32_t w = rand_word(); size_t s; if (w & 0x800000) w &= 3; else if (w & 0x400000) w &= 15; else if (w & 0x200000) w &= 255; s = (w % max); if (s == 0) s = 1; return s; } /* Fills a buffer with random data with skewed distribution. */ static void rand_fill(uint8_t *buf, size_t count) { while (count--) *buf++ = rand_byte(); } /* Fill with random protobuf-like data */ static size_t rand_fill_protobuf(uint8_t *buf, size_t min_bytes, size_t max_bytes, int min_tag) { pb_ostream_t stream = pb_ostream_from_buffer(buf, max_bytes); while(stream.bytes_written < min_bytes) { pb_wire_type_t wt = rand_int(0, 3); if (wt == 3) wt = 5; /* Gap in values */ if (!pb_encode_tag(&stream, wt, rand_int(min_tag, min_tag + 512))) break; if (wt == PB_WT_VARINT) { uint64_t value; rand_fill((uint8_t*)&value, sizeof(value)); pb_encode_varint(&stream, value); } else if (wt == PB_WT_64BIT) { uint64_t value; rand_fill((uint8_t*)&value, sizeof(value)); pb_encode_fixed64(&stream, &value); } else if (wt == PB_WT_32BIT) { uint32_t value; rand_fill((uint8_t*)&value, sizeof(value)); pb_encode_fixed32(&stream, &value); } else if (wt == PB_WT_STRING) { size_t len; uint8_t *buf; if (min_bytes > stream.bytes_written) len = rand_len(min_bytes - stream.bytes_written); else len = 0; buf = malloc(len); pb_encode_varint(&stream, len); rand_fill(buf, len); pb_write(&stream, buf, len); free(buf); } } return stream.bytes_written; } /* Given a buffer of data, mess it up a bit */ static void rand_mess(uint8_t *buf, size_t count) { int m = rand_int(0, 3); if (m == 0) { /* Replace random substring */ int s = rand_int(0, count - 1); int l = rand_len(count - s); rand_fill(buf + s, l); } else if (m == 1) { /* Swap random bytes */ int a = rand_int(0, count - 1); int b = rand_int(0, count - 1); int x = buf[a]; buf[a] = buf[b]; buf[b] = x; } else if (m == 2) { /* Duplicate substring */ int s = rand_int(0, count - 2); int l = rand_len((count - s) / 2); memcpy(buf + s + l, buf + s, l); } else if (m == 3) { /* Add random protobuf noise */ int s = rand_int(0, count - 1); int l = rand_len(count - s); rand_fill_protobuf(buf + s, l, count - s, 1); } } /* Some default data to put in the message */ static const alltypes_static_AllTypes initval = alltypes_static_AllTypes_init_default; #define BUFSIZE 4096 static bool do_static_encode(uint8_t *buffer, size_t *msglen) { pb_ostream_t stream; bool status; /* Allocate a message and fill it with defaults */ alltypes_static_AllTypes *msg = malloc_with_check(sizeof(alltypes_static_AllTypes)); memcpy(msg, &initval, sizeof(initval)); /* Apply randomness to the data before encoding */ while (rand_int(0, 7)) rand_mess((uint8_t*)msg, sizeof(alltypes_static_AllTypes)); stream = pb_ostream_from_buffer(buffer, BUFSIZE); status = pb_encode(&stream, alltypes_static_AllTypes_fields, msg); assert(stream.bytes_written <= BUFSIZE); assert(stream.bytes_written <= alltypes_static_AllTypes_size); *msglen = stream.bytes_written; pb_release(alltypes_static_AllTypes_fields, msg); free_with_check(msg); return status; } /* Append or prepend protobuf noise */ static void do_protobuf_noise(uint8_t *buffer, size_t *msglen) { int m = rand_int(0, 2); size_t max_size = BUFSIZE - 32 - *msglen; if (m == 1) { /* Prepend */ uint8_t *tmp = malloc_with_check(BUFSIZE); size_t s = rand_fill_protobuf(tmp, rand_len(max_size), BUFSIZE - *msglen, 512); memmove(buffer + s, buffer, *msglen); memcpy(buffer, tmp, s); free_with_check(tmp); *msglen += s; } else if (m == 2) { /* Append */ size_t s = rand_fill_protobuf(buffer + *msglen, rand_len(max_size), BUFSIZE - *msglen, 512); *msglen += s; } } static bool do_static_decode(uint8_t *buffer, size_t msglen, bool assert_success) { pb_istream_t stream; bool status; alltypes_static_AllTypes *msg = malloc_with_check(sizeof(alltypes_static_AllTypes)); rand_fill((uint8_t*)msg, sizeof(alltypes_static_AllTypes)); stream = pb_istream_from_buffer(buffer, msglen); status = pb_decode(&stream, alltypes_static_AllTypes_fields, msg); if (!status && assert_success) { /* Anything that was successfully encoded, should be decodeable. * One exception: strings without null terminator are encoded up * to end of buffer, but refused on decode because the terminator * would not fit. */ if (strcmp(stream.errmsg, "string overflow") != 0) assert(status); } free_with_check(msg); return status; } static bool do_pointer_decode(uint8_t *buffer, size_t msglen, bool assert_success) { pb_istream_t stream; bool status; alltypes_pointer_AllTypes *msg; msg = malloc_with_check(sizeof(alltypes_pointer_AllTypes)); memset(msg, 0, sizeof(alltypes_pointer_AllTypes)); stream = pb_istream_from_buffer(buffer, msglen); assert(get_alloc_count() == 0); status = pb_decode(&stream, alltypes_pointer_AllTypes_fields, msg); if (assert_success) assert(status); pb_release(alltypes_pointer_AllTypes_fields, msg); assert(get_alloc_count() == 0); free_with_check(msg); return status; } /* Do a decode -> encode -> decode -> encode roundtrip */ static void do_static_roundtrip(uint8_t *buffer, size_t msglen) { bool status; uint8_t *buf2 = malloc_with_check(BUFSIZE); uint8_t *buf3 = malloc_with_check(BUFSIZE); size_t msglen2, msglen3; alltypes_static_AllTypes *msg1 = malloc_with_check(sizeof(alltypes_static_AllTypes)); alltypes_static_AllTypes *msg2 = malloc_with_check(sizeof(alltypes_static_AllTypes)); memset(msg1, 0, sizeof(alltypes_static_AllTypes)); memset(msg2, 0, sizeof(alltypes_static_AllTypes)); { pb_istream_t stream = pb_istream_from_buffer(buffer, msglen); status = pb_decode(&stream, alltypes_static_AllTypes_fields, msg1); assert(status); } { pb_ostream_t stream = pb_ostream_from_buffer(buf2, BUFSIZE); status = pb_encode(&stream, alltypes_static_AllTypes_fields, msg1); assert(status); msglen2 = stream.bytes_written; } { pb_istream_t stream = pb_istream_from_buffer(buf2, msglen2); status = pb_decode(&stream, alltypes_static_AllTypes_fields, msg2); assert(status); } { pb_ostream_t stream = pb_ostream_from_buffer(buf3, BUFSIZE); status = pb_encode(&stream, alltypes_static_AllTypes_fields, msg2); assert(status); msglen3 = stream.bytes_written; } assert(msglen2 == msglen3); assert(memcmp(buf2, buf3, msglen2) == 0); free_with_check(msg1); free_with_check(msg2); free_with_check(buf2); free_with_check(buf3); } /* Do decode -> encode -> decode -> encode roundtrip */ static void do_pointer_roundtrip(uint8_t *buffer, size_t msglen) { bool status; uint8_t *buf2 = malloc_with_check(BUFSIZE); uint8_t *buf3 = malloc_with_check(BUFSIZE); size_t msglen2, msglen3; alltypes_pointer_AllTypes *msg1 = malloc_with_check(sizeof(alltypes_pointer_AllTypes)); alltypes_pointer_AllTypes *msg2 = malloc_with_check(sizeof(alltypes_pointer_AllTypes)); memset(msg1, 0, sizeof(alltypes_pointer_AllTypes)); memset(msg2, 0, sizeof(alltypes_pointer_AllTypes)); { pb_istream_t stream = pb_istream_from_buffer(buffer, msglen); status = pb_decode(&stream, alltypes_pointer_AllTypes_fields, msg1); assert(status); } { pb_ostream_t stream = pb_ostream_from_buffer(buf2, BUFSIZE); status = pb_encode(&stream, alltypes_pointer_AllTypes_fields, msg1); assert(status); msglen2 = stream.bytes_written; } { pb_istream_t stream = pb_istream_from_buffer(buf2, msglen2); status = pb_decode(&stream, alltypes_pointer_AllTypes_fields, msg2); assert(status); } { pb_ostream_t stream = pb_ostream_from_buffer(buf3, BUFSIZE); status = pb_encode(&stream, alltypes_pointer_AllTypes_fields, msg2); assert(status); msglen3 = stream.bytes_written; } assert(msglen2 == msglen3); assert(memcmp(buf2, buf3, msglen2) == 0); pb_release(alltypes_pointer_AllTypes_fields, msg1); pb_release(alltypes_pointer_AllTypes_fields, msg2); free_with_check(msg1); free_with_check(msg2); free_with_check(buf2); free_with_check(buf3); } static void run_iteration() { uint8_t *buffer = malloc_with_check(BUFSIZE); size_t msglen; bool status; rand_fill(buffer, BUFSIZE); if (do_static_encode(buffer, &msglen)) { do_protobuf_noise(buffer, &msglen); status = do_static_decode(buffer, msglen, true); if (status) do_static_roundtrip(buffer, msglen); status = do_pointer_decode(buffer, msglen, true); if (status) do_pointer_roundtrip(buffer, msglen); /* Apply randomness to the encoded data */ while (rand_bool()) rand_mess(buffer, BUFSIZE); /* Apply randomness to encoded data length */ if (rand_bool()) msglen = rand_int(0, BUFSIZE); status = do_static_decode(buffer, msglen, false); do_pointer_decode(buffer, msglen, status); if (status) { do_static_roundtrip(buffer, msglen); do_pointer_roundtrip(buffer, msglen); } } free_with_check(buffer); } int main(int argc, char **argv) { int i; if (argc > 1) { random_seed = atol(argv[1]); } else { random_seed = time(NULL); } fprintf(stderr, "Random seed: %llu\n", (long long unsigned)random_seed); for (i = 0; i < 10000; i++) { run_iteration(); } return 0; }