Coverage Report

Created: 2019-09-11 14:12

/src/botan/src/fuzzer/pkcs1.cpp
Line
Count
Source (jump to first uncovered line)
1
/*
2
* (C) 2015,2016 Jack Lloyd
3
*
4
* Botan is released under the Simplified BSD License (see license.txt)
5
*/
6
#include "fuzzers.h"
7
8
#include <botan/eme_pkcs.h>
9
#include <botan/hex.h>
10
11
namespace {
12
13
std::vector<uint8_t> simple_pkcs1_unpad(const uint8_t in[], size_t len)
14
200
   {
15
200
   if(len < 10)
16
10
      throw Botan::Decoding_Error("bad len");
17
190
18
190
   if(in[0] != 0 || in[1] != 2)
19
94
      throw Botan::Decoding_Error("bad header field");
20
96
21
76.1k
   for(size_t i = 2; i < len; ++i)
22
76.1k
      {
23
76.1k
      if(in[i] == 0)
24
92
         {
25
92
         if(i < 10) // at least 8 padding bytes required
26
21
            throw Botan::Decoding_Error("insufficient padding bytes");
27
71
         return std::vector<uint8_t>(in + i + 1, in + len);
28
71
         }
29
76.1k
      }
30
96
31
96
   throw Botan::Decoding_Error("delim not found");
32
96
   }
33
34
}
35
36
void fuzz(const uint8_t in[], size_t len)
37
200
   {
38
200
   static Botan::EME_PKCS1v15 pkcs1;
39
200
40
200
   Botan::secure_vector<uint8_t> lib_result;
41
200
   std::vector<uint8_t> ref_result;
42
200
   bool lib_rejected = false, ref_rejected = false;
43
200
44
200
   try
45
200
      {
46
200
      uint8_t valid_mask = 0;
47
200
      Botan::secure_vector<uint8_t> decoded = (static_cast<Botan::EME*>(&pkcs1))->unpad(valid_mask, in, len);
48
200
49
200
      if(valid_mask == 0)
50
129
         lib_rejected = true;
51
71
      else if(valid_mask == 0xFF)
52
71
         lib_rejected = false;
53
71
      else
54
71
         FUZZER_WRITE_AND_CRASH("Invalid valid_mask from unpad");
55
200
      }
56
200
   catch(Botan::Decoding_Error&) { lib_rejected = true; }
57
200
58
200
   try
59
200
      {
60
200
      ref_result = simple_pkcs1_unpad(in, len);
61
200
      }
62
200
   catch(Botan::Decoding_Error& e) { ref_rejected = true; }
63
200
64
200
   if(lib_rejected == true && ref_rejected == false)
65
0
      {
66
0
      FUZZER_WRITE_AND_CRASH("Library rejected input accepted by ref "
67
0
                             << Botan::hex_encode(ref_result));
68
0
      }
69
200
   else if(ref_rejected == true && lib_rejected == false)
70
0
      {
71
0
      FUZZER_WRITE_AND_CRASH("Library accepted input rejected by ref "
72
0
                             << Botan::hex_encode(lib_result));
73
0
      }
74
200
   // otherwise the two implementations agree
75
200
   }