etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
fuzz_crl.c (2171B)
      1 /*
      2  * CRL parsing: dirmngr fetches CRLs over HTTP/LDAP and parses them here, so this
      3  * is a remote attacker-controlled path (and CVE-2022-3515's home). Iterated
      4  * ksba_crl_parse pulls each revoked entry, then the accessors drive the rest.
      5  */
      6 #include "harness.h"
      7 
      8 static int fuzz_one(const uint8_t *data, size_t size)
      9 {
     10     ksba_reader_t reader;
     11     ksba_crl_t crl;
     12     ksba_stop_reason_t sr = KSBA_SR_RUNNING;
     13     int guard = 0;
     14 
     15     if (ksba_reader_new(&reader))
     16         return 0;
     17     if (ksba_reader_set_mem(reader, data, size)) {
     18         ksba_reader_release(reader);
     19         return 0;
     20     }
     21     if (ksba_crl_new(&crl)) {
     22         ksba_reader_release(reader);
     23         return 0;
     24     }
     25     ksba_crl_set_reader(crl, reader);
     26 
     27     do {
     28         if (ksba_crl_parse(crl, &sr))
     29             break;
     30         if (sr == KSBA_SR_GOT_ITEM) {
     31             ksba_sexp_t serial = NULL;
     32             ksba_isotime_t rdate;
     33             ksba_crl_reason_t reason;
     34             if (!ksba_crl_get_item(crl, &serial, rdate, &reason))
     35                 ksba_free(serial);
     36         }
     37     } while (sr != KSBA_SR_READY && ++guard < 100000);
     38 
     39     {
     40         char *issuer = NULL;
     41         ksba_isotime_t this_update, next_update;
     42         ksba_sexp_t number = NULL, kid = NULL, ser = NULL;
     43         ksba_name_t nm = NULL;
     44         int i;
     45 
     46         if (!ksba_crl_get_issuer(crl, &issuer))
     47             ksba_free(issuer);
     48         (void)ksba_crl_get_digest_algo(crl);             /* const, do not free */
     49         ksba_crl_get_update_times(crl, this_update, next_update);
     50         ksba_free(ksba_crl_get_sig_val(crl));
     51         if (!ksba_crl_get_crl_number(crl, &number))
     52             ksba_free(number);
     53         if (!ksba_crl_get_auth_key_id(crl, &kid, &nm, &ser)) {
     54             ksba_free(kid);
     55             ksba_free(ser);
     56             drain_name(nm);
     57         }
     58         for (i = 0; i < KSBA_FUZZ_MAXITER; i++) {
     59             const char *oid;
     60             const unsigned char *der;
     61             size_t derlen;
     62             int crit;
     63             if (ksba_crl_get_extension(crl, i, &oid, &crit, &der, &derlen))
     64                 break;
     65         }
     66     }
     67 
     68     ksba_crl_release(crl);
     69     ksba_reader_release(reader);
     70     return 0;
     71 }