Coverage Report

Created: 2020-06-30 13:58

/src/botan/src/fuzzer/oaep.cpp
Line
Count
Source (jump to first uncovered line)
1
/*
2
* (C) 2018 Jack Lloyd
3
*
4
* Botan is released under the Simplified BSD License (see license.txt)
5
*/
6
#include "fuzzers.h"
7
8
#include <botan/oaep.h>
9
#include <botan/hex.h>
10
11
namespace {
12
13
Botan::secure_vector<uint8_t>
14
ref_oaep_unpad(uint8_t& valid_mask,
15
               const uint8_t in[], size_t len,
16
               const Botan::secure_vector<uint8_t>& Phash)
17
212
   {
18
212
   const size_t hlen = Phash.size();
19
212
20
212
   if(len < 2*hlen + 1)
21
6
      {
22
6
      return Botan::secure_vector<uint8_t>();
23
6
      }
24
206
25
651
   for(size_t i = hlen; i != 2*hlen; ++i)
26
546
      {
27
546
      if(in[i] != Phash[i-hlen])
28
101
         {
29
101
         return Botan::secure_vector<uint8_t>();
30
101
         }
31
546
      }
32
206
33
768
   for(size_t i = 2*hlen; i != len; ++i)
34
756
      {
35
756
      if(in[i] != 0x00 && in[i] != 0x01)
36
29
         {
37
29
         return Botan::secure_vector<uint8_t>();
38
29
         }
39
727
40
727
      if(in[i] == 0x01)
41
64
         {
42
64
         valid_mask = 0xFF;
43
64
         return Botan::secure_vector<uint8_t>(in + i + 1, in + len);
44
64
         }
45
727
      }
46
105
47
105
   return Botan::secure_vector<uint8_t>();
48
105
   }
49
50
inline bool all_zeros(const Botan::secure_vector<uint8_t>& v)
51
296
   {
52
134k
   for(size_t i = 0; i != v.size(); ++i)
53
133k
      {
54
133k
      if(v[i] != 0)
55
0
         return false;
56
133k
      }
57
296
   return true;
58
296
   }
59
60
}
61
62
void fuzz(const uint8_t in[], size_t len)
63
212
   {
64
212
   static const Botan::secure_vector<uint8_t> Phash = { 1, 2, 3, 4 };
65
212
66
212
   uint8_t lib_valid_mask = 0;
67
212
   const Botan::secure_vector<uint8_t> lib_output = Botan::oaep_find_delim(lib_valid_mask, in, len, Phash);
68
212
   FUZZER_ASSERT_TRUE(lib_valid_mask == 0 || lib_valid_mask == 0xFF);
69
212
70
212
   uint8_t ref_valid_mask = 0;
71
212
   const Botan::secure_vector<uint8_t> ref_output = ref_oaep_unpad(ref_valid_mask, in, len, Phash);
72
212
   FUZZER_ASSERT_TRUE(ref_valid_mask == 0 || ref_valid_mask == 0xFF);
73
212
74
212
   if(ref_valid_mask == 0xFF && lib_valid_mask == 0x00)
75
0
      {
76
0
      FUZZER_WRITE_AND_CRASH("Ref accepted but library rejected, output " << Botan::hex_encode(ref_output) << "\n");
77
0
      }
78
212
   else if(ref_valid_mask == 0x00 && lib_valid_mask == 0xFF)
79
0
      {
80
0
      FUZZER_WRITE_AND_CRASH("Lib accepted but ref rejected, output = " << Botan::hex_encode(lib_output) << "\n");
81
0
      }
82
212
83
212
   if(ref_valid_mask == 0x00)
84
148
      {
85
148
      FUZZER_ASSERT_TRUE(all_zeros(ref_output));
86
148
      }
87
212
88
212
   if(lib_valid_mask == 0x00)
89
148
      {
90
148
      FUZZER_ASSERT_TRUE(all_zeros(lib_output));
91
148
      }
92
212
93
212
   if(ref_valid_mask && lib_valid_mask)
94
64
      {
95
64
      if(ref_output != lib_output)
96
0
         {
97
0
         FUZZER_WRITE_AND_CRASH("Ref and lib both accepted but produced different output:"
98
0
                                << " ref = " << Botan::hex_encode(ref_output)
99
0
                                << " lib = " << Botan::hex_encode(lib_output));
100
0
         }
101
64
      }
102
212
   }