Add standalone PKCS#8 and SPKI fuzzers. We already had coverage for our new EVP_PKEY parsers, but it's good to have some that cover them directly. The initial corpus was generated manually with der-ascii and should cover most of the insanity around EC key serialization. BUG=15 Change-Id: I7aaf56876680bfd5a89f5e365c5052eee03ba862 Reviewed-on: https://boringssl-review.googlesource.com/7728 Reviewed-by: Adam Langley <agl@google.com>
diff --git a/FUZZING.md b/FUZZING.md index df45af5..86d0930 100644 --- a/FUZZING.md +++ b/FUZZING.md
@@ -32,10 +32,12 @@ | Test | `max_len` value | |-----------|-----------------| -| `privkey` | 2048 | | `cert` | 3072 | -| `server` | 4096 | | `client` | 20000 | +| `pkcs8` | 2048 | +| `privkey` | 2048 | +| `server` | 4096 | +| `spki` | 1024 | These were determined by rounding up the length of the largest case in the corpus.
diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt index 8395c4f..7a6b591 100644 --- a/crypto/CMakeLists.txt +++ b/crypto/CMakeLists.txt
@@ -166,7 +166,7 @@ $<TARGET_OBJECTS:pem> $<TARGET_OBJECTS:x509> $<TARGET_OBJECTS:x509v3> - $<TARGET_OBJECTS:pkcs8> + $<TARGET_OBJECTS:pkcs8_lib> ) if(NOT MSVC AND NOT ANDROID)
diff --git a/crypto/pkcs8/CMakeLists.txt b/crypto/pkcs8/CMakeLists.txt index 9550109..ffb3821 100644 --- a/crypto/pkcs8/CMakeLists.txt +++ b/crypto/pkcs8/CMakeLists.txt
@@ -1,7 +1,7 @@ include_directories(../../include) add_library( - pkcs8 + pkcs8_lib OBJECT
diff --git a/fuzz/CMakeLists.txt b/fuzz/CMakeLists.txt index 0453e7c..f315347 100644 --- a/fuzz/CMakeLists.txt +++ b/fuzz/CMakeLists.txt
@@ -19,6 +19,24 @@ target_link_libraries(cert crypto) add_executable( + spki + + spki.cc +) + +target_link_libraries(spki Fuzzer) +target_link_libraries(spki crypto) + +add_executable( + pkcs8 + + pkcs8.cc +) + +target_link_libraries(pkcs8 Fuzzer) +target_link_libraries(pkcs8 crypto) + +add_executable( server server.cc
diff --git a/fuzz/pkcs8.cc b/fuzz/pkcs8.cc new file mode 100644 index 0000000..55d3893 --- /dev/null +++ b/fuzz/pkcs8.cc
@@ -0,0 +1,38 @@ +/* Copyright (c) 2016, Google Inc. + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY + * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION + * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN + * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ + +#include <openssl/bytestring.h> +#include <openssl/evp.h> +#include <openssl/mem.h> + +extern "C" int LLVMFuzzerTestOneInput(uint8_t *buf, size_t len) { + CBS cbs; + CBS_init(&cbs, buf, len); + EVP_PKEY *pkey = EVP_parse_private_key(&cbs); + if (pkey == NULL) { + return 0; + } + + uint8_t *der; + size_t der_len; + CBB cbb; + if (CBB_init(&cbb, 0) && + EVP_marshal_private_key(&cbb, pkey) && + CBB_finish(&cbb, &der, &der_len)) { + OPENSSL_free(der); + } + CBB_cleanup(&cbb); + EVP_PKEY_free(pkey); + return 0; +}
diff --git a/fuzz/pkcs8_corpus/129ebe4bf8b167a37741c9c470fd7c4a0359ad63 b/fuzz/pkcs8_corpus/129ebe4bf8b167a37741c9c470fd7c4a0359ad63 new file mode 100644 index 0000000..3221600 --- /dev/null +++ b/fuzz/pkcs8_corpus/129ebe4bf8b167a37741c9c470fd7c4a0359ad63 Binary files differ
diff --git a/fuzz/pkcs8_corpus/1bf03b5d9f129cd80513b820a55c9568eb1d350b b/fuzz/pkcs8_corpus/1bf03b5d9f129cd80513b820a55c9568eb1d350b new file mode 100644 index 0000000..05800ee --- /dev/null +++ b/fuzz/pkcs8_corpus/1bf03b5d9f129cd80513b820a55c9568eb1d350b Binary files differ
diff --git a/fuzz/pkcs8_corpus/225df81ad5fc9783575b57e20207645e55a8fa3f b/fuzz/pkcs8_corpus/225df81ad5fc9783575b57e20207645e55a8fa3f new file mode 100644 index 0000000..df3b06b --- /dev/null +++ b/fuzz/pkcs8_corpus/225df81ad5fc9783575b57e20207645e55a8fa3f Binary files differ
diff --git a/fuzz/pkcs8_corpus/3033b336d833baef80981f40394c281c20677f53 b/fuzz/pkcs8_corpus/3033b336d833baef80981f40394c281c20677f53 new file mode 100644 index 0000000..a13699c --- /dev/null +++ b/fuzz/pkcs8_corpus/3033b336d833baef80981f40394c281c20677f53 Binary files differ
diff --git a/fuzz/pkcs8_corpus/31aa87887801ac3f6eaab0bade714e56fcb5fab7 b/fuzz/pkcs8_corpus/31aa87887801ac3f6eaab0bade714e56fcb5fab7 new file mode 100644 index 0000000..96f304e --- /dev/null +++ b/fuzz/pkcs8_corpus/31aa87887801ac3f6eaab0bade714e56fcb5fab7 Binary files differ
diff --git a/fuzz/pkcs8_corpus/3f7e0b4378403f44de34874789bce582790a1348 b/fuzz/pkcs8_corpus/3f7e0b4378403f44de34874789bce582790a1348 new file mode 100644 index 0000000..ab5dc9e --- /dev/null +++ b/fuzz/pkcs8_corpus/3f7e0b4378403f44de34874789bce582790a1348 Binary files differ
diff --git a/fuzz/pkcs8_corpus/40d5a9f71cacb2389b58a8a24cfa52d6b51bf046 b/fuzz/pkcs8_corpus/40d5a9f71cacb2389b58a8a24cfa52d6b51bf046 new file mode 100644 index 0000000..05020c9 --- /dev/null +++ b/fuzz/pkcs8_corpus/40d5a9f71cacb2389b58a8a24cfa52d6b51bf046 Binary files differ
diff --git a/fuzz/pkcs8_corpus/57e8e625f2f2313f2ec174a3209972e9bc5125ab b/fuzz/pkcs8_corpus/57e8e625f2f2313f2ec174a3209972e9bc5125ab new file mode 100644 index 0000000..4d4de1c --- /dev/null +++ b/fuzz/pkcs8_corpus/57e8e625f2f2313f2ec174a3209972e9bc5125ab Binary files differ
diff --git a/fuzz/pkcs8_corpus/89db3807a0d30e36007b74c8ee4aac912fe3fd75 b/fuzz/pkcs8_corpus/89db3807a0d30e36007b74c8ee4aac912fe3fd75 new file mode 100644 index 0000000..7e8322c --- /dev/null +++ b/fuzz/pkcs8_corpus/89db3807a0d30e36007b74c8ee4aac912fe3fd75 Binary files differ
diff --git a/fuzz/pkcs8_corpus/d38e79992de4ffaf585a6450ba2e6f21188fdd08 b/fuzz/pkcs8_corpus/d38e79992de4ffaf585a6450ba2e6f21188fdd08 new file mode 100644 index 0000000..fe36039 --- /dev/null +++ b/fuzz/pkcs8_corpus/d38e79992de4ffaf585a6450ba2e6f21188fdd08 Binary files differ
diff --git a/fuzz/pkcs8_corpus/d9206dbdd26c06ee8de4e587553e72b3bb22d36b b/fuzz/pkcs8_corpus/d9206dbdd26c06ee8de4e587553e72b3bb22d36b new file mode 100644 index 0000000..f45bac5 --- /dev/null +++ b/fuzz/pkcs8_corpus/d9206dbdd26c06ee8de4e587553e72b3bb22d36b Binary files differ
diff --git a/fuzz/pkcs8_corpus/e0a0b34deb64510a36919a13258bd2c8725e41fe b/fuzz/pkcs8_corpus/e0a0b34deb64510a36919a13258bd2c8725e41fe new file mode 100644 index 0000000..4047d7e --- /dev/null +++ b/fuzz/pkcs8_corpus/e0a0b34deb64510a36919a13258bd2c8725e41fe Binary files differ
diff --git a/fuzz/pkcs8_corpus/e5cfb9f3e23eda47731b1cf3414df1bd408179b7 b/fuzz/pkcs8_corpus/e5cfb9f3e23eda47731b1cf3414df1bd408179b7 new file mode 100644 index 0000000..477a3da --- /dev/null +++ b/fuzz/pkcs8_corpus/e5cfb9f3e23eda47731b1cf3414df1bd408179b7 Binary files differ
diff --git a/fuzz/pkcs8_corpus/efb2c016e9375355e04a5d99e2a17415c9d4f648 b/fuzz/pkcs8_corpus/efb2c016e9375355e04a5d99e2a17415c9d4f648 new file mode 100644 index 0000000..d9a28d4 --- /dev/null +++ b/fuzz/pkcs8_corpus/efb2c016e9375355e04a5d99e2a17415c9d4f648 Binary files differ
diff --git a/fuzz/pkcs8_corpus/fc0fad9f9fb142dee99a03a50a64d10767f9f18e b/fuzz/pkcs8_corpus/fc0fad9f9fb142dee99a03a50a64d10767f9f18e new file mode 100644 index 0000000..cac230a --- /dev/null +++ b/fuzz/pkcs8_corpus/fc0fad9f9fb142dee99a03a50a64d10767f9f18e Binary files differ
diff --git a/fuzz/spki.cc b/fuzz/spki.cc new file mode 100644 index 0000000..939d719 --- /dev/null +++ b/fuzz/spki.cc
@@ -0,0 +1,38 @@ +/* Copyright (c) 2016, Google Inc. + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY + * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION + * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN + * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ + +#include <openssl/bytestring.h> +#include <openssl/evp.h> +#include <openssl/mem.h> + +extern "C" int LLVMFuzzerTestOneInput(uint8_t *buf, size_t len) { + CBS cbs; + CBS_init(&cbs, buf, len); + EVP_PKEY *pkey = EVP_parse_public_key(&cbs); + if (pkey == NULL) { + return 0; + } + + uint8_t *der; + size_t der_len; + CBB cbb; + if (CBB_init(&cbb, 0) && + EVP_marshal_public_key(&cbb, pkey) && + CBB_finish(&cbb, &der, &der_len)) { + OPENSSL_free(der); + } + CBB_cleanup(&cbb); + EVP_PKEY_free(pkey); + return 0; +}
diff --git a/fuzz/spki_corpus/04f58baf6e4bba0bb3094e2e26d3a531a7c263ee b/fuzz/spki_corpus/04f58baf6e4bba0bb3094e2e26d3a531a7c263ee new file mode 100644 index 0000000..d1eac6d --- /dev/null +++ b/fuzz/spki_corpus/04f58baf6e4bba0bb3094e2e26d3a531a7c263ee Binary files differ
diff --git a/fuzz/spki_corpus/079bdf85c086ad0a92bd01f1f70c645d81053f3a b/fuzz/spki_corpus/079bdf85c086ad0a92bd01f1f70c645d81053f3a new file mode 100644 index 0000000..a6eb9d4 --- /dev/null +++ b/fuzz/spki_corpus/079bdf85c086ad0a92bd01f1f70c645d81053f3a Binary files differ
diff --git a/fuzz/spki_corpus/0f5bd094b20a4632f14903bf62db8d467d2c548f b/fuzz/spki_corpus/0f5bd094b20a4632f14903bf62db8d467d2c548f new file mode 100644 index 0000000..2bd95c3 --- /dev/null +++ b/fuzz/spki_corpus/0f5bd094b20a4632f14903bf62db8d467d2c548f Binary files differ
diff --git a/fuzz/spki_corpus/183c579d75863c1e10100f76e3ffb757b44a9587 b/fuzz/spki_corpus/183c579d75863c1e10100f76e3ffb757b44a9587 new file mode 100644 index 0000000..e3a1ed7 --- /dev/null +++ b/fuzz/spki_corpus/183c579d75863c1e10100f76e3ffb757b44a9587 Binary files differ
diff --git a/fuzz/spki_corpus/4ee178363e1d8411f30e540cb97d550d4ce62f0c b/fuzz/spki_corpus/4ee178363e1d8411f30e540cb97d550d4ce62f0c new file mode 100644 index 0000000..471dddf --- /dev/null +++ b/fuzz/spki_corpus/4ee178363e1d8411f30e540cb97d550d4ce62f0c Binary files differ
diff --git a/fuzz/spki_corpus/70da87d1d374ade329433dde31805abc8d80d915 b/fuzz/spki_corpus/70da87d1d374ade329433dde31805abc8d80d915 new file mode 100644 index 0000000..e6deda1 --- /dev/null +++ b/fuzz/spki_corpus/70da87d1d374ade329433dde31805abc8d80d915 Binary files differ
diff --git a/fuzz/spki_corpus/de0338b0c809548dc79d5a34e28b0010852a8f00 b/fuzz/spki_corpus/de0338b0c809548dc79d5a34e28b0010852a8f00 new file mode 100644 index 0000000..81cbe26 --- /dev/null +++ b/fuzz/spki_corpus/de0338b0c809548dc79d5a34e28b0010852a8f00 Binary files differ
diff --git a/fuzz/spki_corpus/fc941f77c710354d3c3c1426432a5ee935d51dd6 b/fuzz/spki_corpus/fc941f77c710354d3c3c1426432a5ee935d51dd6 new file mode 100644 index 0000000..10e1674 --- /dev/null +++ b/fuzz/spki_corpus/fc941f77c710354d3c3c1426432a5ee935d51dd6 Binary files differ