libextractor

fuzz_datasource.c (12468B)

---

 /*
      This file is part of libextractor.
      Copyright (C) 2026 Christian Grothoff
 
      libextractor is free software; you can redistribute it and/or modify
      it under the terms of the GNU General Public License as published
      by the Free Software Foundation; either version 3, or (at your
      option) any later version.
 
      libextractor is distributed in the hope that it will be useful, but
      WITHOUT ANY WARRANTY; without even the implied warranty of
      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
      General Public License for more details.
 
      You should have received a copy of the GNU General Public License
      along with libextractor; see the file COPYING.  If not, write to the
      Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
      Boston, MA 02110-1301, USA.
  */
 /**
  * @file fuzz/fuzz_datasource.c
  * @brief fuzzer for the core datasource and its transparent decompression
  * @author Christian Grothoff
  *
  * `src/main/extractor_datasource.c` is the first code in the library
  * that touches attacker-controlled bytes, and it does so *before* any
  * plugin is consulted: it sniffs for gzip and bzip2 wrappers and
  * transparently decompresses them, maintaining its own seekable view
  * over a stream that is not seekable underneath.  The gzip header
  * walker (FEXTRA / FNAME / FCOMMENT / FHCRC) and the "seek backwards in
  * a decompressed stream" path are the interesting parts.
  *
  * Input format:
  *
  *   byte 0    read chunk size selector
  *   byte 1    behaviour bits:
  *               0x01  create from a file on disk instead of a buffer
  *                     (exercises the mmap/read path in the datasource)
  *               0x02  call get_size_() with force=1 up front, which is
  *                     what makes the datasource decompress eagerly
  *               0x04  perform the seek script backwards
  *               0x08  stop at the first read error instead of continuing
  *   byte 2    number of operations in the seek/read script
  *   byte 3    seed selecting the individual operations
  *   byte 4..  the file image
  */
 
 #define FUZZ_HARNESS_NAME "fuzz_datasource"
 
 #include "fuzz_common.h"
 #include "platform.h"
 #include "extractor.h"
 #include "extractor_datasource.h"
 
 #define DS_FROM_FILE   0x01
 #define DS_FORCE_SIZE  0x02
 #define DS_REVERSE     0x04
 #define DS_STOP_ERR    0x08
 
 /**
  * Same window sizes as the plugin harness; see fuzz_ec.h.
  */
 static const size_t ds_chunks[] = {
   16 * 1024, 1, 2, 3, 7, 16, 64, 255, 256, 1024, 4096, 8192, 16383,
   32768, 65536
 };
 
 /**
  * Upper bound on the number of script operations, so that a
  * pathological input cannot turn one execution into a fuzzing session.
  */
 #define MAX_OPS 96
 
 
 /**
  * Metadata callback; the datasource reports the compression type it
  * detected through it.
  */
 static int
 ds_proc (void *cls,
          const char *plugin_name,
          enum EXTRACTOR_MetaType type,
          enum EXTRACTOR_MetaFormat format,
          const char *data_mime_type,
          const char *data,
          size_t data_len)
 {
   volatile unsigned int sink = 0;
   size_t i;
 
   (void) cls;
   (void) type;
   (void) format;
   if (NULL == plugin_name)
     fuzz_report_finding ("datasource reported a NULL plugin name");
   sink += (unsigned int) strlen (plugin_name);
   if (NULL != data_mime_type)
     sink += (unsigned int) strlen (data_mime_type);
   for (i = 0; (NULL != data) && (i < data_len); i++)
     sink += (unsigned char) data[i];
   (void) sink;
   return 0;
 }
 
 
 int
 LLVMFuzzerTestOneInput (const uint8_t *data,
                         size_t size)
 {
   struct EXTRACTOR_Datasource *ds;
   struct fuzz_rng rng;
   const uint8_t *img;
   size_t img_len;
   size_t chunk;
   unsigned int flags;
   unsigned int ops;
   unsigned int i;
   int64_t fsize;
   char tmpl[] = "/tmp/le-fuzz-ds-XXXXXX";
   int fd = -1;
 
   fuzz_ignore_sigpipe ();
   if (size < 4)
     return 0;
   chunk = ds_chunks[data[0] % (sizeof (ds_chunks) / sizeof (ds_chunks[0]))];
   flags = data[1];
   ops = data[2] % MAX_OPS;
   fuzz_rng_seed (&rng, data[3]);
   img = data + 4;
   img_len = size - 4;
 
   if (0 != (flags & DS_FROM_FILE))
   {
     fd = mkstemp (tmpl);
     if (-1 == fd)
       return 0;
     if ( (0 != img_len) &&
          (img_len != (size_t) write (fd, img, img_len)) )
     {
       (void) close (fd);
       (void) unlink (tmpl);
       return 0;
     }
     (void) close (fd);
     ds = EXTRACTOR_datasource_create_from_file_ (tmpl,
                                                  &ds_proc,
                                                  NULL);
   }
   else
   {
     ds = EXTRACTOR_datasource_create_from_buffer_ ((const char *) img,
                                                    img_len,
                                                    &ds_proc,
                                                    NULL);
   }
   if (NULL == ds)
   {
     if (0 != (flags & DS_FROM_FILE))
       (void) unlink (tmpl);
     return 0;
   }
   fsize = EXTRACTOR_datasource_get_size_ (ds,
                                           (0 != (flags & DS_FORCE_SIZE)));
   for (i = 0; i < ops; i++)
   {
     uint32_t op = fuzz_below (&rng, 10);
 
     if (op < 5)
     {
       /* Exact-size destination: the datasource is told how many bytes
          it may write, so writing more is an overflow in the caller's
          buffer -- which in production is InProcessContext::buf. */
       size_t want = (op < 4) ? chunk : (1 + fuzz_below (&rng, 4096));
       unsigned char *buf = (unsigned char *) malloc ((0 == want) ? 1 : want);
       ssize_t got;
 
       if (NULL == buf)
         abort ();
       got = EXTRACTOR_datasource_read_ (ds, buf, want);
       if (got > (ssize_t) want)
       {
         free (buf);
         fuzz_report_finding ("EXTRACTOR_datasource_read_() reported more "
                              "bytes than the buffer size it was given");
       }
       free (buf);
       if ( (0 > got) &&
            (0 != (flags & DS_STOP_ERR)) )
         break;
     }
     else if (op < 9)
     {
       static const int whences[] = { SEEK_SET, SEEK_CUR, SEEK_END };
       int whence = whences[fuzz_below (&rng, 3)];
       int64_t pos;
 
       switch (fuzz_below (&rng, 6))
       {
       case 0:
         pos = 0;
         break;
       case 1:
         pos = (int64_t) fuzz_below (&rng, 4096);
         break;
       case 2:
         pos = -(int64_t) fuzz_below (&rng, 4096);
         break;
       case 3:
         pos = (0 > fsize) ? 0 : fsize;
         break;
       case 4:
         pos = INT64_MAX;
         break;
       default:
         pos = INT64_MIN;
         break;
       }
       if ( (0 != (flags & DS_REVERSE)) &&
            (INT64_MIN != pos) )
         pos = -pos;
       (void) EXTRACTOR_datasource_seek_ (ds, pos, whence);
     }
     else
     {
       (void) EXTRACTOR_datasource_get_size_ (ds, (int) fuzz_below (&rng, 2));
     }
   }
   EXTRACTOR_datasource_destroy_ (ds);
   if (0 != (flags & DS_FROM_FILE))
     (void) unlink (tmpl);
   return 0;
 }
 
 
 /* ------------------------------------------------------------------ */
 /* Generator                                                           */
 /* ------------------------------------------------------------------ */
 
 /**
  * Build a gzip member by hand.  The point is the *header*: the optional
  * FEXTRA / FNAME / FCOMMENT / FHCRC fields are variable length and are
  * skipped by a hand-written walker in extractor_datasource.c, which is
  * where a length that runs off the end of the buffer bites.
  */
 static size_t
 gen_gzip (struct fuzz_rng *rng,
           uint8_t *buf,
           size_t len,
           size_t cap)
 {
   uint8_t flg = 0;
   unsigned int k;
 
   if (fuzz_chance (rng, 2))
     flg |= 0x04;                /* FEXTRA */
   if (fuzz_chance (rng, 2))
     flg |= 0x08;                /* FNAME */
   if (fuzz_chance (rng, 2))
     flg |= 0x10;                /* FCOMMENT */
   if (fuzz_chance (rng, 3))
     flg |= 0x02;                /* FHCRC */
   fuzz_put_mem (buf, &len, cap, "\x1f\x8b\x08", 3);
   fuzz_put_le (buf, &len, cap, flg, 1);
   fuzz_put_le (buf, &len, cap, 0, 4);                   /* mtime */
   fuzz_put_le (buf, &len, cap, 0, 1);                   /* xfl */
   fuzz_put_le (buf, &len, cap, 3, 1);                   /* os */
   if (0 != (flg & 0x04))
   {
     /* the declared extra length is what matters; usually make it lie */
     uint16_t xlen = fuzz_chance (rng, 2)
                     ? (uint16_t) fuzz_below (rng, 0x10000)
                     : (uint16_t) fuzz_below (rng, 32);
 
     fuzz_put_le (buf, &len, cap, xlen, 2);
     if (! fuzz_chance (rng, 3))
       for (k = 0; (k < xlen) && (len < cap); k++)
         buf[len++] = fuzz_byte (rng);
   }
   if (0 != (flg & 0x08))
   {
     unsigned int n = fuzz_below (rng, 64);
 
     for (k = 0; (k < n) && (len < cap); k++)
       buf[len++] = (uint8_t) (1 + fuzz_below (rng, 254));
     /* half the time forget the terminator */
     if ( (! fuzz_chance (rng, 2)) && (len < cap) )
       buf[len++] = 0;
   }
   if (0 != (flg & 0x10))
   {
     unsigned int n = fuzz_below (rng, 64);
 
     for (k = 0; (k < n) && (len < cap); k++)
       buf[len++] = (uint8_t) (1 + fuzz_below (rng, 254));
     if ( (! fuzz_chance (rng, 2)) && (len < cap) )
       buf[len++] = 0;
   }
   if (0 != (flg & 0x02))
     fuzz_put_le (buf, &len, cap, fuzz_next (rng), 2);
   /* deflate payload: mostly garbage, occasionally a valid stored block */
   if (fuzz_chance (rng, 3))
   {
     uint16_t n = (uint16_t) fuzz_below (rng, 64);
 
     fuzz_put_le (buf, &len, cap, 0x01, 1);              /* final, stored */
     fuzz_put_le (buf, &len, cap, n, 2);
     fuzz_put_le (buf, &len, cap, (uint16_t) ~n, 2);
     for (k = 0; (k < n) && (len < cap); k++)
       buf[len++] = fuzz_byte (rng);
   }
   else
   {
     unsigned int n = fuzz_below (rng, 256);
 
     for (k = 0; (k < n) && (len < cap); k++)
       buf[len++] = fuzz_byte (rng);
   }
   fuzz_put_le (buf, &len, cap, fuzz_next (rng), 4);     /* crc32 */
   fuzz_put_le (buf, &len, cap,
                fuzz_chance (rng, 2) ? fuzz_next (rng) : 0, 4); /* isize */
   return len;
 }
 
 
 static size_t
 fuzz_generate (struct fuzz_rng *rng,
                uint8_t *buf,
                size_t cap)
 {
   size_t len = 0;
   uint32_t kind;
 
   if (cap < 128)
     return 0;
   buf[len++] = fuzz_byte (rng);
   buf[len++] = (uint8_t) fuzz_below (rng, 16);
   buf[len++] = fuzz_byte (rng);
   buf[len++] = fuzz_byte (rng);
 
   kind = fuzz_below (rng, 10);
   if (kind < 5)
   {
     len = gen_gzip (rng, buf, len, cap);
   }
   else if (kind < 8)
   {
     /* bzip2: the library rejects almost everything, so the value here is
        in the header-sniffing code rather than in libbz2 */
     unsigned int n = fuzz_below (rng, 512);
     unsigned int k;
 
     fuzz_put_mem (buf, &len, cap, "BZh", 3);
     fuzz_put_le (buf, &len, cap,
                  (uint8_t) ('0' + 1 + fuzz_below (rng, 9)), 1);
     fuzz_put_mem (buf, &len, cap, "\x31\x41\x59\x26\x53\x59", 6);
     for (k = 0; (k < n) && (len < cap); k++)
       buf[len++] = fuzz_byte (rng);
   }
   else
   {
     /* plain data, sometimes with a truncated compression magic so that
        the sniffing code has to decide on very few bytes */
     unsigned int n = fuzz_below (rng, 1024);
     unsigned int k;
 
     if (fuzz_chance (rng, 2))
       fuzz_put_mem (buf, &len, cap,
                     fuzz_chance (rng, 2) ? "\x1f\x8b" : "BZ", 2);
     for (k = 0; (k < n) && (len < cap); k++)
       buf[len++] = fuzz_byte (rng);
   }
   return len;
 }
 
 
 /* ------------------------------------------------------------------ */
 /* Seed corpus                                                         */
 /* ------------------------------------------------------------------ */
 
 #define DS_NSEEDS 10
 
 static uint8_t ds_seed_buf[DS_NSEEDS][1024];
 static size_t ds_seed_len[DS_NSEEDS];
 static int ds_seeds_ready;
 
 
 static void
 ds_build_seeds (void)
 {
   struct fuzz_rng rng;
   unsigned int i;
 
   if (ds_seeds_ready)
     return;
   ds_seeds_ready = 1;
   for (i = 0; i < DS_NSEEDS; i++)
   {
     fuzz_rng_seed (&rng, 0xD5000u + i);
     ds_seed_len[i] = fuzz_generate (&rng,
                                     ds_seed_buf[i],
                                     sizeof (ds_seed_buf[i]));
     if (ds_seed_len[i] >= 4)
     {
       ds_seed_buf[i][0] = (uint8_t) i;
       ds_seed_buf[i][1] = (uint8_t) (i % 16u);
       ds_seed_buf[i][2] = 32;
     }
   }
 }
 
 
 static size_t
 fuzz_seed_count (void)
 {
   ds_build_seeds ();
   return DS_NSEEDS;
 }
 
 
 static const uint8_t *
 fuzz_seed_get (size_t idx,
                size_t *len)
 {
   ds_build_seeds ();
   *len = ds_seed_len[idx];
   return ds_seed_buf[idx];
 }