mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-01-18 13:44:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add PEM fuzzer

Browse Source 
This fuzzer can find CVE-2022-4450

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20242)
This commit is contained in:
Kurt Roeckx 2022-12-13 22:10:47 +01:00 committed by Pauli
parent 3410a72dce
commit bc07d37186
3 changed files with 91 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
fuzz/build.info
View File

@ -10,7 +10,7 @@
IF[{- !$disabled{"fuzz-afl"} || !$disabled{"fuzz-libfuzzer"} -}]
PROGRAMS{noinst}=asn1 asn1parse bignum bndiv client conf crl server smime x509
PROGRAMS{noinst}=punycode
PROGRAMS{noinst}=punycode pem
PROGRAMS{noinst}=v3name
IF[{- !$disabled{"cmp"} -}]
@ -65,6 +65,10 @@ IF[{- !$disabled{"fuzz-afl"} || !$disabled{"fuzz-libfuzzer"} -}]
INCLUDE[ct]=../include {- $ex_inc -}
DEPEND[ct]=../libcrypto {- $ex_lib -}
SOURCE[pem]=pem.c driver.c
INCLUDE[pem]=../include {- $ex_inc -}
DEPEND[pem]=../libcrypto.a {- $ex_lib -}
SOURCE[punycode]=punycode.c driver.c
INCLUDE[punycode]=../include {- $ex_inc -}
DEPEND[punycode]=../libcrypto.a {- $ex_lib -}
@ -88,7 +92,7 @@ ENDIF
IF[{- !$disabled{tests} -}]
PROGRAMS{noinst}=asn1-test asn1parse-test bignum-test bndiv-test client-test conf-test crl-test server-test smime-test x509-test
PROGRAMS{noinst}=punycode-test
PROGRAMS{noinst}=punycode-test pem-test
PROGRAMS{noinst}=v3name-test
IF[{- !$disabled{"cmp"} -}]
@ -144,6 +148,10 @@ IF[{- !$disabled{tests} -}]
INCLUDE[ct-test]=../include
DEPEND[ct-test]=../libcrypto
SOURCE[pem-test]=pem.c test-corpus.c
INCLUDE[pem-test]=../include
DEPEND[pem-test]=../libcrypto.a
SOURCE[punycode-test]=punycode.c test-corpus.c
INCLUDE[punycode-test]=../include
DEPEND[punycode-test]=../libcrypto.a

59
fuzz/pem.c Normal file
View File

@ -0,0 +1,59 @@
/*
* Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
* https://www.openssl.org/source/license.html
* or in the file LICENSE in the source distribution.
*/
#include <openssl/pem.h>
#include <openssl/err.h>
#include "fuzzer.h"
int FuzzerInitialize(int *argc, char ***argv)
{
OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
ERR_clear_error();
CRYPTO_free_ex_index(0, -1);
return 1;
}
int FuzzerTestOneInput(const uint8_t *buf, size_t len)
{
BIO *in;
char *name = NULL, *header = NULL;
unsigned char *data = NULL;
long outlen;
if (len <= 1)
return 0;
in = BIO_new(BIO_s_mem());
OPENSSL_assert((size_t)BIO_write(in, buf + 1, len - 1) == len - 1);
if (PEM_read_bio_ex(in, &name, &header, &data, &outlen, buf[0]) == 1) {
/* Try to read all the data we get to see if allocated properly. */
BIO_write(in, name, strlen(name));
BIO_write(in, header, strlen(header));
BIO_write(in, data, outlen);
}
if (buf[0] & PEM_FLAG_SECURE) {
OPENSSL_secure_free(name);
OPENSSL_secure_free(header);
OPENSSL_secure_free(data);
} else {
OPENSSL_free(name);
OPENSSL_free(header);
OPENSSL_free(data);
}
BIO_free(in);
ERR_clear_error();
return 0;
}
void FuzzerCleanup(void)
{
}

22
test/recipes/99-test_fuzz_pem.t Normal file
View File

@ -0,0 +1,22 @@
#!/usr/bin/env perl
# Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
#
# Licensed under the Apache License 2.0 (the "License"). You may not use
# this file except in compliance with the License. You can obtain a copy
# in the file LICENSE in the source distribution or at
# https://www.openssl.org/source/license.html
use strict;
use warnings;
use OpenSSL::Test qw/:DEFAULT srctop_file/;
use OpenSSL::Test::Utils;
my $fuzzer = "pem";
setup("test_fuzz_${fuzzer}");
plan tests => 2; # one more due to below require_ok(...)
require_ok(srctop_file('test','recipes','fuzz.pl'));
fuzz_ok($fuzzer);