etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
fuzz_cms.c (2203B)
      1 /*
      2  * CMS / PKCS#7 (S/MIME) parsing, reachable via gpgsm on an attacker-supplied
      3  * message. Iterated ksba_cms_parse drives the state machine, then the accessors.
      4  * Largest parser in the tree: cms.c + cms-parser.c.
      5  */
      6 #include "harness.h"
      7 
      8 static int fuzz_one(const uint8_t *data, size_t size)
      9 {
     10     ksba_reader_t reader;
     11     ksba_cms_t cms;
     12     ksba_stop_reason_t sr = KSBA_SR_RUNNING;
     13     int guard = 0, i;
     14 
     15     if (ksba_reader_new(&reader))
     16         return 0;
     17     if (ksba_reader_set_mem(reader, data, size)) {
     18         ksba_reader_release(reader);
     19         return 0;
     20     }
     21     if (ksba_cms_new(&cms)) {
     22         ksba_reader_release(reader);
     23         return 0;
     24     }
     25     ksba_cms_set_reader_writer(cms, reader, NULL);
     26 
     27     do {
     28         if (ksba_cms_parse(cms, &sr))
     29             break;
     30     } while (sr != KSBA_SR_READY && ++guard < 100000);
     31 
     32     ksba_cms_get_content_type(cms, 0);
     33     ksba_cms_get_content_type(cms, 1);
     34 
     35     for (i = 0; i < KSBA_FUZZ_MAXITER && ksba_cms_get_digest_algo_list(cms, i); i++)
     36         ;
     37     for (i = 0; i < KSBA_FUZZ_MAXITER; i++) {
     38         char *issuer = NULL;
     39         ksba_sexp_t serial = NULL;
     40         if (ksba_cms_get_issuer_serial(cms, i, &issuer, &serial))
     41             break;
     42         ksba_free(issuer);
     43         ksba_free(serial);
     44     }
     45     for (i = 0; i < KSBA_FUZZ_MAXITER; i++) {
     46         ksba_cert_t c = ksba_cms_get_cert(cms, i);
     47         if (!c)
     48             break;
     49         ksba_cert_release(c);
     50     }
     51     for (i = 0; i < KSBA_FUZZ_MAXITER; i++) {
     52         char *digest = NULL;
     53         size_t dlen;
     54         if (ksba_cms_get_message_digest(cms, i, &digest, &dlen))
     55             break;
     56         ksba_free(digest);
     57     }
     58     for (i = 0; i < KSBA_FUZZ_MAXITER; i++) {
     59         ksba_isotime_t st;
     60         if (ksba_cms_get_signing_time(cms, i, st))
     61             break;
     62     }
     63     for (i = 0; i < KSBA_FUZZ_MAXITER; i++) {
     64         ksba_sexp_t v = ksba_cms_get_sig_val(cms, i);
     65         if (!v)
     66             break;
     67         ksba_free(v);
     68     }
     69     for (i = 0; i < KSBA_FUZZ_MAXITER; i++) {
     70         ksba_sexp_t v = ksba_cms_get_enc_val(cms, i);
     71         if (!v)
     72             break;
     73         ksba_free(v);
     74     }
     75 
     76     ksba_cms_release(cms);
     77     ksba_reader_release(reader);
     78     return 0;
     79 }