Fuzzing of encoding/decoding functions #2520
Conversation
xhanulik
force-pushed
the
fuzzer
branch
4 times, most recently
from
76464ed to
ad9cec5
Compare
|
@frankmorgner can you check this PR if there is something you would like to do differently before I will merge it (after resolving the conflict indeed)? |
`sc_pkcs15_decode_pubkey()` uses `key->algorithm` to decide next steps.
Binding with p15card can lead to new paths in code during fuzzing (decode functions use p15card->app). Each decoding function gets its own data buffer - data generation adapts to each function.
frankmorgner
left a comment
frankmorgner
left a comment
There was a problem hiding this comment.
I like the ideas for integrating the encoding/decoding functions with the fuzzing input, good job!
Some minor things could be improved, though - please see the inline comments.
Initialize the card and iterate over objects stored on p15card - try to encode into buffer.
Fuzz target uses the first two bytes of fuzzing input as the length for a buffer that is supplied to the tested function. The rest is set as data for the reader.
|
With the change mentioned in #2520 (comment), the structure of fuzzing input has changed. I will create and add some suitable corpus for |
@frankmorgner can you check this PR if there is something to fix from your point of view or are we ready to merge this? |
3 participants
This PR adds fuzzers for encoding functions for PKCS#15 objects and generic
sc_*()functions.fuzz_pkcs15_encodeiterates over objects onp15cardand calls correspondingsc_pkcs15_encode_*_entry().fuzz_cardcalls some functions fromlibopensc/sec.candlibopensc/card.cthat are not covered according to OSS-Fuzz coverage reports.Also, there are some changes in the
fuzz_pkcs15_decode. The setting of algorithms for thesc_pkcs15_decode_pubkey()in a cycle extends testing to other algorithms besides RSA. Some of thesc_pkcs15_decode_*_entry()internally usep15card->app- these paths were not covered, sincep15cardwas not initialized viasc_pkcs15_bind(). That is fixed with the usage of the reader fromfuzz_pkcs15_reader.After local run,
fuzz_cardencounter asserts inmuscle.c- these are exchanged for explicit checking the arguments.Checklist