diff options
author | Kurt Roeckx <kurt@roeckx.be> | 2022-12-13 22:10:47 +0100 |
---|---|---|
committer | Pauli <pauli@openssl.org> | 2023-06-01 10:04:32 +1000 |
commit | bc07d371865095643ec4f7190f26b174830a2f02 (patch) | |
tree | 000a6da7de690df3c02698fec6ef9dc1e1e6fde0 /fuzz | |
parent | 3410a72dce57651e08d5d2143409cde0205a8f3b (diff) |
Add PEM fuzzer
This fuzzer can find CVE-2022-4450
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20242)
Diffstat (limited to 'fuzz')
-rw-r--r-- | fuzz/build.info | 12 | ||||
-rw-r--r-- | fuzz/pem.c | 59 |
2 files changed, 69 insertions, 2 deletions
diff --git a/fuzz/build.info b/fuzz/build.info index bdeb075fdd..af5f550f00 100644 --- a/fuzz/build.info +++ b/fuzz/build.info @@ -10,7 +10,7 @@ IF[{- !$disabled{"fuzz-afl"} || !$disabled{"fuzz-libfuzzer"} -}] PROGRAMS{noinst}=asn1 asn1parse bignum bndiv client conf crl server smime x509 - PROGRAMS{noinst}=punycode + PROGRAMS{noinst}=punycode pem PROGRAMS{noinst}=v3name IF[{- !$disabled{"cmp"} -}] @@ -65,6 +65,10 @@ IF[{- !$disabled{"fuzz-afl"} || !$disabled{"fuzz-libfuzzer"} -}] INCLUDE[ct]=../include {- $ex_inc -} DEPEND[ct]=../libcrypto {- $ex_lib -} + SOURCE[pem]=pem.c driver.c + INCLUDE[pem]=../include {- $ex_inc -} + DEPEND[pem]=../libcrypto.a {- $ex_lib -} + SOURCE[punycode]=punycode.c driver.c INCLUDE[punycode]=../include {- $ex_inc -} DEPEND[punycode]=../libcrypto.a {- $ex_lib -} @@ -88,7 +92,7 @@ ENDIF IF[{- !$disabled{tests} -}] PROGRAMS{noinst}=asn1-test asn1parse-test bignum-test bndiv-test client-test conf-test crl-test server-test smime-test x509-test - PROGRAMS{noinst}=punycode-test + PROGRAMS{noinst}=punycode-test pem-test PROGRAMS{noinst}=v3name-test IF[{- !$disabled{"cmp"} -}] @@ -144,6 +148,10 @@ IF[{- !$disabled{tests} -}] INCLUDE[ct-test]=../include DEPEND[ct-test]=../libcrypto + SOURCE[pem-test]=pem.c test-corpus.c + INCLUDE[pem-test]=../include + DEPEND[pem-test]=../libcrypto.a + SOURCE[punycode-test]=punycode.c test-corpus.c INCLUDE[punycode-test]=../include DEPEND[punycode-test]=../libcrypto.a diff --git a/fuzz/pem.c b/fuzz/pem.c new file mode 100644 index 0000000000..4b2cf701e7 --- /dev/null +++ b/fuzz/pem.c @@ -0,0 +1,59 @@ +/* + * Copyright 2022 The OpenSSL Project Authors. All Rights Reserved. + * + * Licensed under the Apache License 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * https://www.openssl.org/source/license.html + * or in the file LICENSE in the source distribution. + */ + +#include <openssl/pem.h> +#include <openssl/err.h> +#include "fuzzer.h" + +int FuzzerInitialize(int *argc, char ***argv) +{ + OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL); + ERR_clear_error(); + CRYPTO_free_ex_index(0, -1); + return 1; +} + +int FuzzerTestOneInput(const uint8_t *buf, size_t len) +{ + BIO *in; + char *name = NULL, *header = NULL; + unsigned char *data = NULL; + long outlen; + + if (len <= 1) + return 0; + + in = BIO_new(BIO_s_mem()); + OPENSSL_assert((size_t)BIO_write(in, buf + 1, len - 1) == len - 1); + if (PEM_read_bio_ex(in, &name, &header, &data, &outlen, buf[0]) == 1) { + /* Try to read all the data we get to see if allocated properly. */ + BIO_write(in, name, strlen(name)); + BIO_write(in, header, strlen(header)); + BIO_write(in, data, outlen); + } + if (buf[0] & PEM_FLAG_SECURE) { + OPENSSL_secure_free(name); + OPENSSL_secure_free(header); + OPENSSL_secure_free(data); + } else { + OPENSSL_free(name); + OPENSSL_free(header); + OPENSSL_free(data); + } + + BIO_free(in); + ERR_clear_error(); + + return 0; +} + +void FuzzerCleanup(void) +{ +} |