largeblob: add a harness to fuzz largeblob.c

2026-03-13 11:12:49 -07:00 · 2021-02-19 13:36:35 +01:00
parent 6db91bdaf1
commit ce82016da7
5 changed files with 354 additions and 1 deletions
--- a/fuzz/CMakeLists.txt
+++ b/fuzz/CMakeLists.txt
@@ -55,3 +55,9 @@ add_executable(fuzz_netlink fuzz_netlink.c ${COMMON_SOURCES} ${COMPAT_SOURCES})
 target_compile_options(fuzz_netlink PRIVATE ${FUZZ_LDFLAGS})
 set_target_properties(fuzz_netlink PROPERTIES LINK_FLAGS ${FUZZ_LDFLAGS})
 target_link_libraries(fuzz_netlink fido2_shared)
+
+# fuzz_largeblob
+add_executable(fuzz_largeblob fuzz_largeblob.c ${COMMON_SOURCES} ${COMPAT_SOURCES})
+target_compile_options(fuzz_largeblob PRIVATE ${FUZZ_LDFLAGS})
+set_target_properties(fuzz_largeblob PROPERTIES LINK_FLAGS ${FUZZ_LDFLAGS})
+target_link_libraries(fuzz_largeblob fido2_shared)
--- a/fuzz/Makefile
+++ b/fuzz/Makefile
@@ -7,7 +7,7 @@ RUNNER		:= libfido2-runner
 PROFDATA	:= llvm-profdata-10
 COV		:= llvm-cov-10
 TARGETS		:= fuzz_assert fuzz_bio fuzz_cred fuzz_credman fuzz_hid \
-		   fuzz_netlink fuzz_mgmt
+		   fuzz_largeblob fuzz_netlink fuzz_mgmt
 CORPORA		:= $(foreach f,${TARGETS},${f}/corpus)
 MINIFY		:= $(foreach f,${TARGETS},/minify/${f}/corpus)
 REMOTE		:= gs://libfido2-corpus.clusterfuzz-external.appspot.com
--- a/fuzz/export.gnu
+++ b/fuzz/export.gnu
@@ -202,8 +202,10 @@
 		fido_dev_supports_uv;
 		fido_dev_toggle_always_uv;
 		fido_dev_largeblob_get;
+		fido_dev_largeblob_get_array;
 		fido_dev_largeblob_remove;
 		fido_dev_largeblob_set;
+		fido_dev_largeblob_set_array;
 		fido_hid_get_report_len;
 		fido_hid_get_usage;
 		fido_init;
--- a/fuzz/fuzz_largeblob.c
+++ b/fuzz/fuzz_largeblob.c
@@ -0,0 +1,271 @@
+/*
+ * Copyright (c) 2020 Yubico AB. All rights reserved.
+ * Use of this source code is governed by a BSD-style
+ * license that can be found in the LICENSE file.
+ */
+
+#include <assert.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+
+#include "mutator_aux.h"
+#include "wiredata_fido2.h"
+#include "dummy.h"
+#include "fido.h"
+
+#include "../openbsd-compat/openbsd-compat.h"
+
+/* Parameter set defining a FIDO2 "large blob" operation. */
+struct param {
+	char pin[MAXSTR];
+	int seed;
+	struct blob key;
+	struct blob get_wiredata;
+	struct blob set_wiredata;
+};
+
+/*
+ * Collection of HID reports from an authenticator issued with a FIDO2
+ * 'authenticatorLargeBlobs' 'get' command.
+ */
+static const uint8_t dummy_get_wiredata[] = {
+	WIREDATA_CTAP_INIT,
+	WIREDATA_CTAP_CBOR_INFO,
+	WIREDATA_CTAP_CBOR_LARGEBLOB_GET_ARRAY
+};
+
+/*
+ * Collection of HID reports from an authenticator issued with a FIDO2
+ * 'authenticatorLargeBlobs' 'set' command.
+ */
+static const uint8_t dummy_set_wiredata[] = {
+	WIREDATA_CTAP_INIT,
+	WIREDATA_CTAP_CBOR_INFO,
+	WIREDATA_CTAP_CBOR_LARGEBLOB_GET_ARRAY,
+	WIREDATA_CTAP_CBOR_AUTHKEY,
+	WIREDATA_CTAP_CBOR_PINTOKEN,
+	WIREDATA_CTAP_CBOR_STATUS
+};
+
+/*
+ * XXX this needs to match the encrypted blob embedded in
+ * WIREDATA_CTAP_CBOR_LARGEBLOB_GET_ARRAY.
+ */
+static const uint8_t dummy_key[] = {
+	0xa9, 0x1b, 0xc4, 0xdd, 0xfc, 0x9a, 0x93, 0x79,
+	0x75, 0xba, 0xf7, 0x7f, 0x4d, 0x57, 0xfc, 0xa6,
+	0xe1, 0xf8, 0x06, 0x43, 0x23, 0x99, 0x51, 0x32,
+	0xce, 0x6e, 0x19, 0x84, 0x50, 0x13, 0x2d, 0x7b
+};
+
+struct param *
+unpack(const uint8_t *ptr, size_t len)
+{
+	cbor_item_t *item = NULL, **v;
+	struct cbor_load_result cbor;
+	struct param *p;
+	int ok = -1;
+
+	if ((p = calloc(1, sizeof(*p))) == NULL ||
+	    (item = cbor_load(ptr, len, &cbor)) == NULL ||
+	    cbor.read != len ||
+	    cbor_isa_array(item) == false ||
+	    cbor_array_is_definite(item) == false ||
+	    cbor_array_size(item) != 5 ||
+	    (v = cbor_array_handle(item)) == NULL)
+		goto fail;
+
+	if (unpack_int(v[0], &p->seed) < 0 ||
+	    unpack_string(v[1], p->pin) < 0 ||
+	    unpack_blob(v[2], &p->key) < 0 ||
+	    unpack_blob(v[3], &p->get_wiredata) < 0 ||
+	    unpack_blob(v[4], &p->set_wiredata) < 0)
+		goto fail;
+
+	ok = 0;
+fail:
+	if (ok < 0) {
+		free(p);
+		p = NULL;
+	}
+
+	if (item)
+		cbor_decref(&item);
+
+	return p;
+}
+
+size_t
+pack(uint8_t *ptr, size_t len, const struct param *p)
+{
+	cbor_item_t *argv[5], *array = NULL;
+	size_t cbor_alloc_len, cbor_len = 0;
+	unsigned char *cbor = NULL;
+
+	memset(argv, 0, sizeof(argv));
+
+	if ((array = cbor_new_definite_array(5)) == NULL ||
+	    (argv[0] = pack_int(p->seed)) == NULL ||
+	    (argv[1] = pack_string(p->pin)) == NULL ||
+	    (argv[2] = pack_blob(&p->key)) == NULL ||
+	    (argv[3] = pack_blob(&p->get_wiredata)) == NULL ||
+	    (argv[4] = pack_blob(&p->set_wiredata)) == NULL)
+		goto fail;
+
+	for (size_t i = 0; i < 5; i++)
+		if (cbor_array_push(array, argv[i]) == false)
+			goto fail;
+
+	if ((cbor_len = cbor_serialize_alloc(array, &cbor,
+	    &cbor_alloc_len)) > len) {
+		cbor_len = 0;
+		goto fail;
+	}
+
+	memcpy(ptr, cbor, cbor_len);
+fail:
+	for (size_t i = 0; i < 5; i++)
+		if (argv[i])
+			cbor_decref(&argv[i]);
+
+	if (array)
+		cbor_decref(&array);
+
+	free(cbor);
+
+	return cbor_len;
+}
+
+size_t
+pack_dummy(uint8_t *ptr, size_t len)
+{
+	struct param dummy;
+	uint8_t blob[4096];
+	size_t blob_len;
+
+	memset(&dummy, 0, sizeof(dummy));
+
+	strlcpy(dummy.pin, dummy_pin, sizeof(dummy.pin));
+
+	dummy.get_wiredata.len = sizeof(dummy_get_wiredata);
+	dummy.set_wiredata.len = sizeof(dummy_set_wiredata);
+	dummy.key.len = sizeof(dummy_key);
+
+	memcpy(&dummy.get_wiredata.body, &dummy_get_wiredata,
+	    dummy.get_wiredata.len);
+	memcpy(&dummy.set_wiredata.body, &dummy_set_wiredata,
+	    dummy.set_wiredata.len);
+	memcpy(&dummy.key.body, &dummy_key, dummy.key.len);
+
+	assert((blob_len = pack(blob, sizeof(blob), &dummy)) != 0);
+
+	if (blob_len > len) {
+		memcpy(ptr, blob, len);
+		return len;
+	}
+
+	memcpy(ptr, blob, blob_len);
+
+	return blob_len;
+}
+
+static fido_dev_t *
+prepare_dev(void)
+{
+	fido_dev_t *dev;
+
+	if ((dev = open_dev(0)) == NULL)
+		return NULL;
+
+	return dev;
+}
+
+static void
+get_blob(const struct param *p, int array)
+{
+	fido_dev_t *dev;
+	u_char *ptr = NULL;
+	size_t len = 0;
+
+	set_wire_data(p->get_wiredata.body, p->get_wiredata.len);
+
+	if ((dev = prepare_dev()) == NULL)
+		return;
+
+	if (array)
+		fido_dev_largeblob_get_array(dev, &ptr, &len);
+	else
+		fido_dev_largeblob_get(dev, p->key.body, p->key.len, &ptr, &len);
+	consume(ptr, len);
+	free(ptr);
+
+	fido_dev_close(dev);
+	fido_dev_free(&dev);
+}
+
+
+static void
+set_blob(const struct param *p, int op)
+{
+	fido_dev_t *dev;
+	const char *pin;
+
+	set_wire_data(p->set_wiredata.body, p->set_wiredata.len);
+
+	if ((dev = prepare_dev()) == NULL)
+		return;
+	pin = p->pin;
+	if (strlen(pin) == 0)
+		pin = NULL;
+
+	switch (op) {
+	case 0:
+		fido_dev_largeblob_remove(dev, p->key.body, p->key.len, pin);
+		break;
+	case 1:
+		/* XXX reuse p->get_wiredata as the blob to be set */
+		fido_dev_largeblob_set(dev, p->key.body, p->key.len,
+		    p->get_wiredata.body, p->get_wiredata.len, pin);
+		break;
+	case 2:
+		/* XXX reuse p->get_wiredata as the body of the cbor array */
+		fido_dev_largeblob_set_array(dev, p->get_wiredata.body,
+		    p->get_wiredata.len, pin);
+	}
+
+	fido_dev_close(dev);
+	fido_dev_free(&dev);
+}
+
+void
+test(const struct param *p)
+{
+	prng_init((unsigned int)p->seed);
+	fido_init(FIDO_DEBUG);
+	fido_set_log_handler(consume_str);
+
+	get_blob(p, 0);
+	get_blob(p, 1);
+	set_blob(p, 0);
+	set_blob(p, 1);
+	set_blob(p, 2);
+}
+
+void
+mutate(struct param *p, unsigned int seed, unsigned int flags) NO_MSAN
+{
+	if (flags & MUTATE_SEED)
+		p->seed = (int)seed;
+
+	if (flags & MUTATE_PARAM) {
+		mutate_blob(&p->key);
+		mutate_string(p->pin);
+	}
+
+	if (flags & MUTATE_WIREDATA) {
+		mutate_blob(&p->get_wiredata);
+		mutate_blob(&p->set_wiredata);
+	}
+}
--- a/fuzz/wiredata_fido2.h
+++ b/fuzz/wiredata_fido2.h
@@ -556,4 +556,78 @@
 	0x6e, 0x67, 0x65, 0x72, 0x33, 0x00, 0x00, 0x00,	\
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00

+#define WIREDATA_CTAP_CBOR_LARGEBLOB_GET_ARRAY		\
+	0x89, 0xc9, 0x8d, 0x28, 0x90, 0x01, 0xe6, 0x00,	\
+	0xa1, 0x01, 0x59, 0x01, 0xe0, 0x81, 0xa3, 0x01,	\
+	0x59, 0x01, 0xb8, 0xb3, 0x26, 0x24, 0x99, 0xde,	\
+	0x06, 0x3f, 0xca, 0xde, 0x98, 0x8d, 0x9d, 0xc5,	\
+	0x3f, 0x26, 0x6c, 0xc7, 0x40, 0x93, 0xc4, 0x88,	\
+	0x06, 0x51, 0x4f, 0xb9, 0x61, 0xf2, 0xc9, 0x8d,	\
+	0xbc, 0xce, 0x79, 0x08, 0xec, 0x90, 0xc5, 0x5b,	\
+	0xe5, 0x0a, 0x72, 0x08, 0x7b, 0xe1, 0xf9, 0x16,	\
+	0x89, 0xc9, 0x8d, 0x28, 0x00, 0x06, 0x8b, 0x76,	\
+	0x32, 0xa0, 0xae, 0x55, 0xb2, 0x39, 0x71, 0xce,	\
+	0x34, 0x4b, 0x6e, 0x6b, 0x89, 0xa6, 0x5e, 0x69,	\
+	0x07, 0xac, 0xf6, 0x01, 0x3c, 0xba, 0x45, 0x7a,	\
+	0x75, 0x25, 0x3a, 0xbd, 0x95, 0x22, 0x9d, 0xc3,	\
+	0xe4, 0x42, 0x31, 0x5c, 0xb5, 0xf4, 0x64, 0x6a,	\
+	0x56, 0x1d, 0xab, 0xc7, 0x6e, 0x96, 0x75, 0xe7,	\
+	0xb3, 0x22, 0x0b, 0x82, 0xac, 0x57, 0x78, 0xdf,	\
+	0x89, 0xc9, 0x8d, 0x28, 0x01, 0x57, 0x06, 0xc5,	\
+	0x4b, 0x61, 0x0b, 0x4d, 0xa1, 0x66, 0xa0, 0x89,	\
+	0xad, 0x19, 0x8f, 0xd8, 0x96, 0x55, 0x22, 0x5f,	\
+	0xca, 0x2e, 0xc1, 0xd7, 0xbd, 0xa1, 0x83, 0x66,	\
+	0x4d, 0x85, 0xcb, 0x01, 0x60, 0x3f, 0xf7, 0xf7,	\
+	0xa3, 0x7a, 0xfa, 0x99, 0xa0, 0x1e, 0x25, 0x90,	\
+	0xd0, 0xd0, 0x3b, 0x54, 0x90, 0x77, 0x94, 0xa6,	\
+	0x88, 0xea, 0xc3, 0x6b, 0xa0, 0x59, 0x5e, 0x69,	\
+	0x89, 0xc9, 0x8d, 0x28, 0x02, 0x78, 0x0b, 0x2b,	\
+	0xab, 0x5b, 0x04, 0x2f, 0x78, 0x15, 0x86, 0x2b,	\
+	0x0f, 0x63, 0xb2, 0xd7, 0xc9, 0xe9, 0xac, 0x0e,	\
+	0xbc, 0x17, 0xe4, 0x19, 0x88, 0xe0, 0xe6, 0x13,	\
+	0xf8, 0x15, 0x08, 0xa7, 0xe1, 0x6e, 0x71, 0x5c,	\
+	0xef, 0x3e, 0xc1, 0x0f, 0x74, 0xdb, 0xdc, 0x52,	\
+	0x9c, 0xfc, 0xe9, 0xa9, 0xf3, 0x0d, 0x52, 0xbc,	\
+	0x0c, 0xe8, 0xba, 0xd1, 0x76, 0x46, 0x87, 0xb5,	\
+	0x89, 0xc9, 0x8d, 0x28, 0x03, 0x30, 0xe6, 0x9d,	\
+	0xa1, 0x2b, 0xa5, 0x9e, 0x3b, 0x86, 0xb3, 0x5f,	\
+	0xe3, 0x81, 0xa6, 0x76, 0x32, 0x9d, 0xf9, 0xc5,	\
+	0x07, 0x93, 0xb3, 0xdf, 0x64, 0xe2, 0x78, 0x9c,	\
+	0x00, 0xc7, 0x86, 0x79, 0xd6, 0x67, 0xa2, 0xfb,	\
+	0xf2, 0x8d, 0xea, 0xe9, 0xc8, 0xfc, 0x43, 0xd2,	\
+	0x0f, 0x2f, 0x7d, 0x9d, 0xd3, 0x8f, 0x9c, 0xdd,	\
+	0xa2, 0x9f, 0x42, 0x76, 0x40, 0xcc, 0x4a, 0xd0,	\
+	0x89, 0xc9, 0x8d, 0x28, 0x04, 0xb4, 0x87, 0x18,	\
+	0x06, 0xc3, 0xc7, 0x89, 0x98, 0x72, 0xcc, 0x1a,	\
+	0xd1, 0xd8, 0x78, 0xb9, 0x75, 0x0b, 0x92, 0xe3,	\
+	0xcc, 0xed, 0x38, 0x39, 0x4b, 0xa9, 0xcf, 0x30,	\
+	0xd6, 0xb5, 0xa1, 0x3f, 0xfa, 0x4f, 0x29, 0x99,	\
+	0xa9, 0x03, 0x77, 0xf6, 0x53, 0xfa, 0xd8, 0x32,	\
+	0xce, 0xf4, 0xf6, 0x0a, 0x3c, 0xe8, 0x9c, 0x3d,	\
+	0xaa, 0xe0, 0x7b, 0x2c, 0xa5, 0x28, 0xe1, 0xdd,	\
+	0x89, 0xc9, 0x8d, 0x28, 0x05, 0x51, 0xbf, 0xe1,	\
+	0xd4, 0xf5, 0x5e, 0x38, 0x2c, 0xec, 0xab, 0xdd,	\
+	0xb8, 0x5c, 0x13, 0x43, 0x62, 0xc2, 0xb6, 0x02,	\
+	0x18, 0xce, 0x9a, 0x62, 0x67, 0x6a, 0xeb, 0x99,	\
+	0xf6, 0x2f, 0xf1, 0xf1, 0xec, 0x3e, 0x74, 0xfa,	\
+	0xf8, 0x16, 0x43, 0xea, 0x1e, 0xef, 0x5d, 0x37,	\
+	0x6c, 0x13, 0xf9, 0x7f, 0x65, 0x09, 0xab, 0x60,	\
+	0x38, 0xda, 0x0f, 0xe7, 0xfa, 0x9e, 0x17, 0x10,	\
+	0x89, 0xc9, 0x8d, 0x28, 0x06, 0xdc, 0x4c, 0x4d,	\
+	0xae, 0x5c, 0xb4, 0x0d, 0x6b, 0x05, 0x6d, 0x25,	\
+	0x3f, 0x78, 0x5d, 0xf3, 0x34, 0x33, 0xa4, 0x89,	\
+	0x34, 0x0e, 0x88, 0x66, 0x40, 0x57, 0x6b, 0x34,	\
+	0x83, 0xfd, 0x39, 0xe7, 0xfb, 0x84, 0x09, 0xb3,	\
+	0x16, 0x8f, 0x80, 0xdf, 0x1b, 0xe0, 0x02, 0x4c,	\
+	0xde, 0x31, 0x2a, 0x32, 0x58, 0x5b, 0xa3, 0x23,	\
+	0x8e, 0x2a, 0xa6, 0xaf, 0x03, 0x19, 0x02, 0x7a,	\
+	0x89, 0xc9, 0x8d, 0x28, 0x07, 0xf8, 0xbf, 0xa6,	\
+	0xad, 0xf9, 0xd1, 0xdc, 0xbd, 0x6e, 0xb3, 0xc1,	\
+	0xfb, 0x65, 0xd8, 0x5f, 0x2e, 0x00, 0x00, 0x00,	\
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,	\
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,	\
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,	\
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,	\
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+
 #endif /* _WIREDATA_FIDO2_H */