summaryrefslogtreecommitdiffstats
path: root/security/nss/fuzz/asn1_mutators.cc
blob: 12d8c3728380e7fd02cb42e2f8db9f961b616ce5 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#include <assert.h>
#include <string.h>
#include <random>
#include <tuple>

#include "asn1_mutators.h"

using namespace std;

static tuple<uint8_t *, size_t> ParseItem(uint8_t *Data, size_t MaxLength) {
  // Short form. Bit 8 has value "0" and bits 7-1 give the length.
  if ((Data[1] & 0x80) == 0) {
    size_t length = min(static_cast<size_t>(Data[1]), MaxLength - 2);
    return make_tuple(&Data[2], length);
  }

  // Constructed, indefinite length. Read until {0x00, 0x00}.
  if (Data[1] == 0x80) {
    void *offset = memmem(&Data[2], MaxLength - 2, "\0", 2);
    size_t length = offset ? (static_cast<uint8_t *>(offset) - &Data[2]) + 2
                           : MaxLength - 2;
    return make_tuple(&Data[2], length);
  }

  // Long form. Two to 127 octets. Bit 8 of first octet has value "1"
  // and bits 7-1 give the number of additional length octets.
  size_t octets = min(static_cast<size_t>(Data[1] & 0x7f), MaxLength - 2);

  // Handle lengths bigger than 32 bits.
  if (octets > 4) {
    // Ignore any further children, assign remaining length.
    return make_tuple(&Data[2] + octets, MaxLength - 2 - octets);
  }

  // Parse the length.
  size_t length = 0;
  for (size_t j = 0; j < octets; j++) {
    length = (length << 8) | Data[2 + j];
  }

  length = min(length, MaxLength - 2 - octets);
  return make_tuple(&Data[2] + octets, length);
}

static vector<uint8_t *> ParseItems(uint8_t *Data, size_t Size) {
  vector<uint8_t *> items;
  vector<size_t> lengths;

  // The first item is always the whole corpus.
  items.push_back(Data);
  lengths.push_back(Size);

  // Can't use iterators here because the `items` vector is modified inside the
  // loop. That's safe as long as we always check `items.size()` before every
  // iteration, and only call `.push_back()` to append new items we found.
  // Items are accessed through `items.at()`, we hold no references.
  for (size_t i = 0; i < items.size(); i++) {
    uint8_t *item = items.at(i);
    size_t remaining = lengths.at(i);

    // Empty or primitive items have no children.
    if (remaining == 0 || (0x20 & item[0]) == 0) {
      continue;
    }

    while (remaining > 2) {
      uint8_t *content;
      size_t length;

      tie(content, length) = ParseItem(item, remaining);

      if (length > 0) {
        // Record the item.
        items.push_back(content);

        // Record the length for further parsing.
        lengths.push_back(length);
      }

      // Reduce number of bytes left in current item.
      remaining -= length + (content - item);

      // Skip the item we just parsed.
      item = content + length;
    }
  }

  return items;
}

size_t ASN1MutatorFlipConstructed(uint8_t *Data, size_t Size, size_t MaxSize,
                                  unsigned int Seed) {
  auto items = ParseItems(Data, Size);

  std::mt19937 rng(Seed);
  std::uniform_int_distribution<size_t> dist(0, items.size() - 1);
  uint8_t *item = items.at(dist(rng));

  // Flip "constructed" type bit.
  item[0] ^= 0x20;

  return Size;
}

size_t ASN1MutatorChangeType(uint8_t *Data, size_t Size, size_t MaxSize,
                             unsigned int Seed) {
  auto items = ParseItems(Data, Size);

  std::mt19937 rng(Seed);
  std::uniform_int_distribution<size_t> dist(0, items.size() - 1);
  uint8_t *item = items.at(dist(rng));

  // Change type to a random int [0, 30].
  static std::uniform_int_distribution<size_t> tdist(0, 30);
  item[0] = tdist(rng);

  return Size;
}