libextractor

fuzz_convert.c (7108B)

---

 /*
      This file is part of libextractor.
      Copyright (C) 2026 Christian Grothoff
 
      libextractor is free software; you can redistribute it and/or modify
      it under the terms of the GNU General Public License as published
      by the Free Software Foundation; either version 3, or (at your
      option) any later version.
 
      libextractor is distributed in the hope that it will be useful, but
      WITHOUT ANY WARRANTY; without even the implied warranty of
      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
      General Public License for more details.
 
      You should have received a copy of the GNU General Public License
      along with libextractor; see the file COPYING.  If not, write to the
      Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
      Boston, MA 02110-1301, USA.
  */
 /**
  * @file fuzz/fuzz_convert.c
  * @brief fuzzer for the shared charset conversion helper and the
  *        metatype tables
  * @author Christian Grothoff
  *
  * `EXTRACTOR_common_convert_to_utf8()` is called by nsfe, rtf, msoffice
  * and png with a length and a charset name that all come out of the
  * file being parsed.  Its input is therefore attacker-controlled in
  * three independent ways at once: the bytes, the length, and the name of
  * the source encoding.
  *
  * The input buffer handed to it is `malloc()`ed at exactly the declared
  * length and is deliberately *not* 0-terminated, because that is how the
  * callers pass it: a helper that reaches for a terminator instead of
  * honouring @a len reads past the end.
  *
  * Input format:
  *
  *   byte 0    charset selector
  *   byte 1    behaviour bits:
  *               0x01  also convert the result a second time
  *               0x02  declare a length one byte longer than the
  *                     allocation is -- OFF unless LE_FUZZ_MODEL_OVERLONG
  *                     is set, since it models a *caller* bug, not one
  *                     in the helper
  *   byte 2..  the bytes to convert
  */
 
 #define FUZZ_HARNESS_NAME "fuzz_convert"
 
 #include "fuzz_common.h"
 #include "platform.h"
 #include "extractor.h"
 #include "convert.h"
 
 /**
  * Charset names that plugins really pass, plus the shapes that a
  * malformed file can produce.
  */
 static const char *const cv_charsets[] = {
   "UTF-8", "UTF-16BE", "UTF-16LE", "UTF-32", "ISO-8859-1", "ISO-8859-15",
   "CP1252", "CP437", "CP850", "MACINTOSH", "KOI8-R", "SHIFT_JIS",
   "EUC-JP", "GB18030", "BIG5", "ASCII", "ANSI_X3.4-1968",
   "", "?", "//TRANSLIT", "UTF-8//IGNORE", "NOSUCHCHARSET",
   "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
 };
 
 
 int
 LLVMFuzzerTestOneInput (const uint8_t *data,
                         size_t size)
 {
   const char *charset;
   unsigned int flags;
   size_t len;
   char *in;
   char *out;
 
   fuzz_ignore_sigpipe ();
   if (size < 2)
     return 0;
   charset = cv_charsets[data[0]
                         % (sizeof (cv_charsets) / sizeof (char *))];
   flags = data[1];
   len = size - 2;
   /* exact size, no terminator: exactly how the callers pass it */
   in = (char *) malloc ((0 == len) ? 1 : len);
   if (NULL == in)
     abort ();
   if (0 != len)
     memcpy (in, data + 2, len);
   out = EXTRACTOR_common_convert_to_utf8 (in, len, charset);
   if (NULL != out)
   {
     /* The result is documented as 0-terminated; strlen() proves it and
        lands in the redzone if it is not. */
     volatile size_t l = strlen (out);
 
     (void) l;
     if (0 != (flags & 0x01))
     {
       char *out2 = EXTRACTOR_common_convert_to_utf8 (out,
                                                      strlen (out),
                                                      "UTF-8");
 
       free (out2);
     }
     free (out);
   }
   free (in);
 
   /* The metatype tables are indexed by values that come from a plugin
      (out of process: from an untrusted child), so walk them too. */
   {
     enum EXTRACTOR_MetaType max = EXTRACTOR_metatype_get_max ();
     int probe = (int) ((size_t) data[0] * 7 + data[1]);
 
     (void) EXTRACTOR_metatype_to_string ((enum EXTRACTOR_MetaType) probe);
     (void) EXTRACTOR_metatype_to_description ((enum EXTRACTOR_MetaType) probe);
     (void) EXTRACTOR_metatype_to_string (max);
     (void) EXTRACTOR_metatype_to_description (max);
     (void) EXTRACTOR_metatype_to_string ((enum EXTRACTOR_MetaType) -1);
     (void) EXTRACTOR_metatype_to_description ((enum EXTRACTOR_MetaType) -1);
   }
   return 0;
 }
 
 
 /* ------------------------------------------------------------------ */
 /* Generator                                                           */
 /* ------------------------------------------------------------------ */
 
 /**
  * Byte sequences that are interesting to a charset converter: truncated
  * multi-byte sequences, overlong encodings, surrogates and BOMs.
  */
 static const char *const cv_atoms[] = {
   "\xc3\xa4", "\xc3", "\xe2\x82\xac", "\xe2\x82", "\xe2",
   "\xf0\x9f\x98\x80", "\xf0\x9f\x98", "\xf0",
   "\xc0\x80", "\xe0\x80\x80", "\xf0\x80\x80\x80",
   "\xed\xa0\x80", "\xed\xbf\xbf", "\xef\xbb\xbf",
   "\xff\xfe", "\xfe\xff", "\x00\x00\xfe\xff",
   "\x80", "\xff", "\xfe", "\x7f", "\x00",
   "ABC", "abc", "\r\n", "\t", " "
 };
 
 
 static size_t
 fuzz_generate (struct fuzz_rng *rng,
                uint8_t *buf,
                size_t cap)
 {
   size_t len = 0;
   unsigned int n;
   unsigned int i;
 
   if (cap < 16)
     return 0;
   buf[len++] = fuzz_byte (rng);
   buf[len++] = fuzz_byte (rng);
   n = 1 + fuzz_below (rng, 64);
   for (i = 0; i < n; i++)
   {
     if (fuzz_chance (rng, 6))
     {
       if (len < cap)
         buf[len++] = fuzz_byte (rng);
     }
     else
     {
       const char *a =
         cv_atoms[fuzz_below (rng,
                              (uint32_t) (sizeof (cv_atoms) / sizeof (char *)))];
       /* the atoms include embedded NULs, so use the recorded sizes
          rather than strlen() where it matters */
       size_t al = strlen (a);
 
       if (0 == al)
         al = 1;
       if (len + al > cap)
         break;
       memcpy (buf + len, a, al);
       len += al;
     }
   }
   return len;
 }
 
 
 /* ------------------------------------------------------------------ */
 /* Seed corpus                                                         */
 /* ------------------------------------------------------------------ */
 
 struct cv_seed
 {
   const char *txt;
   size_t len;
 };
 
 #define CSEED(t) { t, sizeof (t) - 1 }
 
 static const struct cv_seed cv_seeds[] = {
   CSEED ("\x00\x00" "hello"),
   CSEED ("\x00\x00" "\xc3\xa4\xc3\xb6\xc3\xbc"),
   CSEED ("\x00\x00" "\xc3"),
   CSEED ("\x00\x00" "\xed\xa0\x80"),
   CSEED ("\x01\x00" "\x00h\x00i"),
   CSEED ("\x02\x00" "h\x00i\x00"),
   CSEED ("\x04\x00" "\xe4\xf6\xfc"),
   CSEED ("\x06\x00" "\x80\x99\x9a"),
   CSEED ("\x0b\x00" "\x82\xa0\x82\xa2"),
   CSEED ("\x11\x00" "abc"),
   CSEED ("\x15\x00" "abc"),
   CSEED ("\x16\x00" "abc"),
   CSEED ("\x00\x00"),
   CSEED ("\x00\x01" "\xef\xbb\xbf" "abc")
 };
 
 
 static size_t
 fuzz_seed_count (void)
 {
   return sizeof (cv_seeds) / sizeof (cv_seeds[0]);
 }
 
 
 static const uint8_t *
 fuzz_seed_get (size_t idx,
                size_t *len)
 {
   *len = cv_seeds[idx].len;
   return (const uint8_t *) cv_seeds[idx].txt;
 }