/src/botan/src/fuzzer/mode_padding.cpp
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * (C) 2018 Jack Lloyd |
3 | | * |
4 | | * Botan is released under the Simplified BSD License (see license.txt) |
5 | | */ |
6 | | |
7 | | #include "fuzzers.h" |
8 | | #include <botan/mode_pad.h> |
9 | | #include <botan/internal/tls_cbc.h> |
10 | | |
11 | | namespace { |
12 | | |
13 | | size_t ref_pkcs7_unpad(const uint8_t in[], size_t len) |
14 | 139 | { |
15 | 139 | if(len <= 2) |
16 | 0 | return len; |
17 | 139 | |
18 | 139 | const size_t padding_length = in[len-1]; |
19 | 139 | |
20 | 139 | if(padding_length == 0 || padding_length > len) |
21 | 56 | return len; |
22 | 83 | |
23 | 83 | const size_t padding_start = len - padding_length; |
24 | 83 | |
25 | 500 | for(size_t i = padding_start; i != len; ++i) |
26 | 478 | { |
27 | 478 | if(in[i] != padding_length) |
28 | 61 | return len; |
29 | 478 | } |
30 | 83 | |
31 | 83 | return len - padding_length; |
32 | 83 | } |
33 | | |
34 | | size_t ref_x923_unpad(const uint8_t in[], size_t len) |
35 | 139 | { |
36 | 139 | if(len <= 2) |
37 | 0 | return len; |
38 | 139 | |
39 | 139 | const size_t padding_length = in[len-1]; |
40 | 139 | |
41 | 139 | if(padding_length == 0 || padding_length > len) |
42 | 56 | return len; |
43 | 83 | const size_t padding_start = len - padding_length; |
44 | 83 | |
45 | 296 | for(size_t i = padding_start; i != len - 1; ++i) |
46 | 285 | { |
47 | 285 | if(in[i] != 0) |
48 | 72 | { |
49 | 72 | return len; |
50 | 72 | } |
51 | 285 | } |
52 | 83 | |
53 | 83 | return len - padding_length; |
54 | 83 | } |
55 | | |
56 | | size_t ref_oneandzero_unpad(const uint8_t in[], size_t len) |
57 | 191 | { |
58 | 191 | if(len <= 2) |
59 | 0 | return len; |
60 | 191 | |
61 | 191 | size_t idx = len - 1; |
62 | 191 | |
63 | 191 | for(;;) |
64 | 3.87k | { |
65 | 3.87k | if(in[idx] == 0) |
66 | 3.68k | { |
67 | 3.68k | if(idx == 0) |
68 | 3 | return len; |
69 | 3.68k | idx -= 1; |
70 | 3.68k | continue; |
71 | 3.68k | } |
72 | 188 | else if(in[idx] == 0x80) |
73 | 9 | { |
74 | 9 | return idx; |
75 | 9 | } |
76 | 179 | else |
77 | 179 | return len; |
78 | 3.87k | } |
79 | 191 | |
80 | 191 | return len; |
81 | 191 | } |
82 | | |
83 | | size_t ref_esp_unpad(const uint8_t in[], size_t len) |
84 | 139 | { |
85 | 139 | if(len <= 2) |
86 | 0 | return len; |
87 | 139 | |
88 | 139 | const size_t padding_bytes = in[len - 1]; |
89 | 139 | |
90 | 139 | if(padding_bytes == 0 || padding_bytes > len) |
91 | 56 | { |
92 | 56 | return len; |
93 | 56 | } |
94 | 83 | |
95 | 83 | const size_t padding_start = len - padding_bytes; |
96 | 126 | for(size_t i = padding_start; i != len; ++i) |
97 | 114 | { |
98 | 114 | if(in[i] != (i - padding_start + 1)) |
99 | 71 | { |
100 | 71 | return len; |
101 | 71 | } |
102 | 114 | } |
103 | 83 | |
104 | 83 | return len - padding_bytes; |
105 | 83 | } |
106 | | |
107 | | uint16_t ref_tls_cbc_unpad(const uint8_t in[], size_t len) |
108 | 221 | { |
109 | 221 | if(len == 0) |
110 | 0 | return 0; |
111 | 221 | |
112 | 221 | const size_t padding_length = in[(len-1)]; |
113 | 221 | |
114 | 221 | if(padding_length >= len) |
115 | 88 | return 0; |
116 | 133 | |
117 | 133 | /* |
118 | 133 | * TLS v1.0 and up require all the padding bytes be the same value |
119 | 133 | * and allows up to 255 bytes. |
120 | 133 | */ |
121 | 883 | for(size_t i = 0; i != 1 + padding_length; ++i) |
122 | 837 | { |
123 | 837 | if(in[(len-i-1)] != padding_length) |
124 | 87 | return 0; |
125 | 837 | } |
126 | 133 | return padding_length + 1; |
127 | 133 | } |
128 | | |
129 | | } |
130 | | |
131 | | void fuzz(const uint8_t in[], size_t len) |
132 | 221 | { |
133 | 221 | static Botan::PKCS7_Padding pkcs7; |
134 | 221 | static Botan::ANSI_X923_Padding x923; |
135 | 221 | static Botan::OneAndZeros_Padding oneandzero; |
136 | 221 | static Botan::ESP_Padding esp; |
137 | 221 | |
138 | 221 | if(pkcs7.valid_blocksize(len)) |
139 | 139 | { |
140 | 139 | const size_t ct_pkcs7 = pkcs7.unpad(in, len); |
141 | 139 | const size_t ref_pkcs7 = ref_pkcs7_unpad(in, len); |
142 | 139 | FUZZER_ASSERT_EQUAL(ct_pkcs7, ref_pkcs7); |
143 | 139 | } |
144 | 221 | |
145 | 221 | if(x923.valid_blocksize(len)) |
146 | 139 | { |
147 | 139 | const size_t ct_x923 = x923.unpad(in, len); |
148 | 139 | const size_t ref_x923 = ref_x923_unpad(in, len); |
149 | 139 | FUZZER_ASSERT_EQUAL(ct_x923, ref_x923); |
150 | 139 | } |
151 | 221 | |
152 | 221 | if(oneandzero.valid_blocksize(len)) |
153 | 191 | { |
154 | 191 | const size_t ct_oneandzero = oneandzero.unpad(in, len); |
155 | 191 | const size_t ref_oneandzero = ref_oneandzero_unpad(in, len); |
156 | 191 | FUZZER_ASSERT_EQUAL(ct_oneandzero, ref_oneandzero); |
157 | 191 | } |
158 | 221 | |
159 | 221 | if(esp.valid_blocksize(len)) |
160 | 139 | { |
161 | 139 | const size_t ct_esp = esp.unpad(in, len); |
162 | 139 | const size_t ref_esp = ref_esp_unpad(in, len); |
163 | 139 | FUZZER_ASSERT_EQUAL(ct_esp, ref_esp); |
164 | 139 | } |
165 | 221 | |
166 | 221 | const uint16_t ct_cbc = Botan::TLS::check_tls_cbc_padding(in, len); |
167 | 221 | const uint16_t ref_cbc = ref_tls_cbc_unpad(in, len); |
168 | 221 | FUZZER_ASSERT_EQUAL(ct_cbc, ref_cbc); |
169 | 221 | } |