etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
fuzz_cert.c (2772B)
      1 /*
      2  * X.509 cert parsing via ksba_cert_init_from_mem. Parsing is lazy, so the
      3  * accessors below force the deep parse (cert/dn/keyinfo/name/oid/time).
      4  * Reachable via gpgsm with an attacker-supplied certificate.
      5  */
      6 #include "harness.h"
      7 
      8 static int fuzz_one(const uint8_t *data, size_t size)
      9 {
     10     ksba_cert_t cert;
     11 
     12     if (ksba_cert_new(&cert))
     13         return 0;
     14 
     15     if (!ksba_cert_init_from_mem(cert, data, size)) {
     16         char *s;
     17         ksba_isotime_t t;
     18         ksba_sexp_t kid, serial;
     19         ksba_name_t nm, nm2;
     20         ksba_crl_reason_t reason;
     21         const char *oid;
     22         int i, crit, ca, pathlen;
     23         unsigned int flags;
     24         size_t off, len;
     25 
     26         ksba_free(ksba_cert_get_serial(cert));
     27         (void)ksba_cert_get_digest_algo(cert);          /* const, do not free */
     28 
     29         for (i = 0; i < KSBA_FUZZ_MAXITER && (s = ksba_cert_get_issuer(cert, i)); i++)
     30             ksba_free(s);
     31         for (i = 0; i < KSBA_FUZZ_MAXITER && (s = ksba_cert_get_subject(cert, i)); i++)
     32             ksba_free(s);
     33 
     34         ksba_cert_get_validity(cert, 0, t);
     35         ksba_cert_get_validity(cert, 1, t);
     36 
     37         ksba_free(ksba_cert_get_public_key(cert));
     38         ksba_free(ksba_cert_get_sig_val(cert));
     39 
     40         for (i = 0; i < KSBA_FUZZ_MAXITER &&
     41              !ksba_cert_get_extension(cert, i, &oid, &crit, &off, &len); i++)
     42             ;
     43 
     44         ksba_cert_is_ca(cert, &ca, &pathlen);
     45         ksba_cert_get_key_usage(cert, &flags);
     46         if (!ksba_cert_get_cert_policies(cert, &s))
     47             ksba_free(s);
     48         if (!ksba_cert_get_ext_key_usages(cert, &s))
     49             ksba_free(s);
     50 
     51         for (i = 0; i < KSBA_FUZZ_MAXITER; i++) {
     52             nm = nm2 = NULL;
     53             if (ksba_cert_get_crl_dist_point(cert, i, &nm, &nm2, &reason))
     54                 break;
     55             drain_name(nm);
     56             drain_name(nm2);
     57         }
     58 
     59         kid = serial = NULL;
     60         nm = NULL;
     61         if (!ksba_cert_get_auth_key_id(cert, &kid, &nm, &serial)) {
     62             ksba_free(kid);
     63             ksba_free(serial);
     64             drain_name(nm);
     65         }
     66         kid = NULL;
     67         if (!ksba_cert_get_subj_key_id(cert, &crit, &kid))
     68             ksba_free(kid);
     69 
     70         for (i = 0; i < KSBA_FUZZ_MAXITER; i++) {
     71             char *method = NULL;
     72             nm = NULL;
     73             if (ksba_cert_get_authority_info_access(cert, i, &method, &nm))
     74                 break;
     75             ksba_free(method);
     76             drain_name(nm);
     77         }
     78         for (i = 0; i < KSBA_FUZZ_MAXITER; i++) {
     79             char *method = NULL;
     80             nm = NULL;
     81             if (ksba_cert_get_subject_info_access(cert, i, &method, &nm))
     82                 break;
     83             ksba_free(method);
     84             drain_name(nm);
     85         }
     86     }
     87 
     88     ksba_cert_release(cert);
     89     return 0;
     90 }