Coverage Report

Created: 2025-07-09 07:10

/src/curl_fuzzer/curl_fuzzer_tlv.cc
Line
Count
Source (jump to first uncovered line)
1
/***************************************************************************
2
 *                                  _   _ ____  _
3
 *  Project                     ___| | | |  _ \| |
4
 *                             / __| | | | |_) | |
5
 *                            | (__| |_| |  _ <| |___
6
 *                             \___|\___/|_| \_\_____|
7
 *
8
 * Copyright (C) 2017, Max Dymond, <cmeister2@gmail.com>, et al.
9
 *
10
 * This software is licensed as described in the file COPYING, which
11
 * you should have received as part of this distribution. The terms
12
 * are also available at https://curl.se/docs/copyright.html.
13
 *
14
 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
15
 * copies of the Software, and permit persons to whom the Software is
16
 * furnished to do so, under the terms of the COPYING file.
17
 *
18
 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
19
 * KIND, either express or implied.
20
 *
21
 ***************************************************************************/
22
#include <stdlib.h>
23
#include <string.h>
24
#include <curl/curl.h>
25
#include "curl_fuzzer.h"
26
27
/**
28
 * TLV access function - gets the first TLV from a data stream.
29
 */
30
int fuzz_get_first_tlv(FUZZ_DATA *fuzz,
31
                       TLV *tlv)
32
632k
{
33
  /* Reset the cursor. */
34
632k
  fuzz->state.data_pos = 0;
35
632k
  return fuzz_get_tlv_comn(fuzz, tlv);
36
632k
}
37
38
/**
39
 * TLV access function - gets the next TLV from a data stream.
40
*/
41
int fuzz_get_next_tlv(FUZZ_DATA *fuzz,
42
                      TLV *tlv)
43
4.36M
{
44
  /* Advance the cursor by the full length of the previous TLV. */
45
4.36M
  fuzz->state.data_pos += sizeof(TLV_RAW) + tlv->length;
46
47
  /* Work out if there's a TLV's worth of data to read */
48
4.36M
  if(fuzz->state.data_pos + sizeof(TLV_RAW) > fuzz->state.data_len) {
49
    /* No more TLVs to parse */
50
491k
    return TLV_RC_NO_MORE_TLVS;
51
491k
  }
52
53
3.87M
  return fuzz_get_tlv_comn(fuzz, tlv);
54
4.36M
}
55
56
/**
57
 * Common TLV function for accessing TLVs in a data stream.
58
 */
59
int fuzz_get_tlv_comn(FUZZ_DATA *fuzz,
60
                      TLV *tlv)
61
4.50M
{
62
4.50M
  int rc = 0;
63
4.50M
  size_t data_offset;
64
4.50M
  TLV_RAW *raw;
65
66
  /* Start by casting the data stream to a TLV. */
67
4.50M
  raw = (TLV_RAW *)&fuzz->state.data[fuzz->state.data_pos];
68
4.50M
  data_offset = fuzz->state.data_pos + sizeof(TLV_RAW);
69
70
  /* Set the TLV values. */
71
4.50M
  tlv->type = to_u16(raw->raw_type);
72
4.50M
  tlv->length = to_u32(raw->raw_length);
73
4.50M
  tlv->value = &fuzz->state.data[data_offset];
74
75
4.50M
  FV_PRINTF(fuzz, "TLV: type %x length %u\n", tlv->type, tlv->length);
76
77
  /* Use uint64s to verify lengths of TLVs so that overflow problems don't
78
     matter. */
79
4.50M
  uint64_t check_length = data_offset;
80
4.50M
  check_length += tlv->length;
81
82
4.50M
  uint64_t remaining_len = fuzz->state.data_len;
83
4.50M
  FV_PRINTF(fuzz, "Check length of data: %" PRIu64 " \n", check_length);
84
4.50M
  FV_PRINTF(fuzz, "Remaining length of data: %" PRIu64 " \n", remaining_len);
85
86
  /* Sanity check that the TLV length is ok. */
87
4.50M
  if(check_length > remaining_len) {
88
79.7k
    FV_PRINTF(fuzz, "Returning TLV_RC_SIZE_ERROR\n");
89
79.7k
    rc = TLV_RC_SIZE_ERROR;
90
79.7k
  }
91
92
4.50M
  return rc;
93
4.50M
}
94
95
/**
96
 * Do different actions on the CURL handle for different received TLVs.
97
 */
98
int fuzz_parse_tlv(FUZZ_DATA *fuzz, TLV *tlv)
99
4.02M
{
100
4.02M
  int rc;
101
4.02M
  char *tmp = NULL;
102
4.02M
  uint32_t tmp_u32;
103
4.02M
  curl_slist *new_list;
104
105
4.02M
  switch(tlv->type) {
106
    /* The pointers in response TLVs will always be valid as long as the fuzz
107
       data is in scope, which is the entirety of this file. */
108
28.9k
    FRESPONSETLV(&fuzz->sockman[0], TLV_TYPE_RESPONSE0, 0);
109
30.1k
    FRESPONSETLV(&fuzz->sockman[0], TLV_TYPE_RESPONSE1, 1);
110
9.28k
    FRESPONSETLV(&fuzz->sockman[0], TLV_TYPE_RESPONSE2, 2);
111
20.7k
    FRESPONSETLV(&fuzz->sockman[0], TLV_TYPE_RESPONSE3, 3);
112
8.38k
    FRESPONSETLV(&fuzz->sockman[0], TLV_TYPE_RESPONSE4, 4);
113
17.7k
    FRESPONSETLV(&fuzz->sockman[0], TLV_TYPE_RESPONSE5, 5);
114
9.14k
    FRESPONSETLV(&fuzz->sockman[0], TLV_TYPE_RESPONSE6, 6);
115
5.02k
    FRESPONSETLV(&fuzz->sockman[0], TLV_TYPE_RESPONSE7, 7);
116
3.14k
    FRESPONSETLV(&fuzz->sockman[0], TLV_TYPE_RESPONSE8, 8);
117
18.0k
    FRESPONSETLV(&fuzz->sockman[0], TLV_TYPE_RESPONSE9, 9);
118
2.90k
    FRESPONSETLV(&fuzz->sockman[0], TLV_TYPE_RESPONSE10, 10);
119
120
3.58k
    FRESPONSETLV(&fuzz->sockman[1], TLV_TYPE_SECOND_RESPONSE0, 0);
121
3.87k
    FRESPONSETLV(&fuzz->sockman[1], TLV_TYPE_SECOND_RESPONSE1, 1);
122
123
2.03k
    case TLV_TYPE_UPLOAD1:
124
      /* The pointers in the TLV will always be valid as long as the fuzz data
125
         is in scope, which is the entirety of this file. */
126
127
2.03k
      FCHECK_OPTION_UNSET(fuzz, CURLOPT_UPLOAD);
128
129
2.01k
      fuzz->upload1_data = tlv->value;
130
2.01k
      fuzz->upload1_data_len = tlv->length;
131
132
2.01k
      FSET_OPTION(fuzz, CURLOPT_UPLOAD, 1L);
133
2.01k
      FSET_OPTION(fuzz,
134
2.01k
                  CURLOPT_INFILESIZE_LARGE,
135
2.01k
                  (curl_off_t)fuzz->upload1_data_len);
136
2.01k
      break;
137
138
309k
    case TLV_TYPE_HEADER:
139
      /* Limit the number of headers that can be added to a message to prevent
140
         timeouts. */
141
309k
      if(fuzz->header_list_count >= TLV_MAX_NUM_CURLOPT_HEADER) {
142
13
        rc = 255;
143
13
        goto EXIT_LABEL;
144
13
      }
145
146
309k
      tmp = fuzz_tlv_to_string(tlv);
147
309k
      if (tmp == NULL) {
148
        // keep on despite allocation failure
149
0
        break;
150
0
      }
151
309k
      new_list = curl_slist_append(fuzz->header_list, tmp);
152
309k
      if (new_list == NULL) {
153
0
        break;
154
0
      }
155
309k
      fuzz->header_list = new_list;
156
309k
      fuzz->header_list_count++;
157
309k
      break;
158
159
40.4k
    case TLV_TYPE_MAIL_RECIPIENT:
160
      /* Limit the number of headers that can be added to a message to prevent
161
         timeouts. */
162
40.4k
      if(fuzz->header_list_count >= TLV_MAX_NUM_CURLOPT_HEADER) {
163
12
        rc = 255;
164
12
        goto EXIT_LABEL;
165
12
      }
166
40.4k
      tmp = fuzz_tlv_to_string(tlv);
167
40.4k
      if (tmp == NULL) {
168
        // keep on despite allocation failure
169
0
        break;
170
0
      }
171
40.4k
      new_list = curl_slist_append(fuzz->mail_recipients_list, tmp);
172
40.4k
      if (new_list != NULL) {
173
40.4k
        fuzz->mail_recipients_list = new_list;
174
40.4k
        fuzz->header_list_count++;
175
40.4k
      }
176
40.4k
      break;
177
178
3.17M
    case TLV_TYPE_MIME_PART:
179
3.17M
      if(fuzz->mime == NULL) {
180
5.47k
        fuzz->mime = curl_mime_init(fuzz->easy);
181
5.47k
      }
182
183
3.17M
      fuzz->part = curl_mime_addpart(fuzz->mime);
184
185
      /* This TLV may have sub TLVs. */
186
3.17M
      fuzz_add_mime_part(tlv, fuzz->part);
187
188
3.17M
      break;
189
190
1.24k
    case TLV_TYPE_POSTFIELDS:
191
1.24k
      FCHECK_OPTION_UNSET(fuzz, CURLOPT_POSTFIELDS);
192
1.22k
      fuzz->postfields = fuzz_tlv_to_string(tlv);
193
1.22k
      FSET_OPTION(fuzz, CURLOPT_POSTFIELDS, fuzz->postfields);
194
1.22k
      break;
195
196
1.01k
    case TLV_TYPE_HTTPPOSTBODY:
197
1.01k
      FCHECK_OPTION_UNSET(fuzz, CURLOPT_HTTPPOST);
198
997
      fuzz_setup_http_post(fuzz, tlv);
199
997
      FSET_OPTION(fuzz, CURLOPT_HTTPPOST, fuzz->httppost);
200
997
      break;
201
202
    /* Define a set of u32 options. */
203
20.4k
    FU32TLV(fuzz, TLV_TYPE_HTTPAUTH, CURLOPT_HTTPAUTH);
204
1.19k
    FU32TLV(fuzz, TLV_TYPE_OPTHEADER, CURLOPT_HEADER);
205
1.82k
    FU32TLV(fuzz, TLV_TYPE_NOBODY, CURLOPT_NOBODY);
206
6.77k
    FU32TLV(fuzz, TLV_TYPE_FOLLOWLOCATION, CURLOPT_FOLLOWLOCATION);
207
2.00k
    FU32TLV(fuzz, TLV_TYPE_WILDCARDMATCH, CURLOPT_WILDCARDMATCH);
208
8.37k
    FU32TLV(fuzz, TLV_TYPE_RTSP_REQUEST, CURLOPT_RTSP_REQUEST);
209
511
    FU32TLV(fuzz, TLV_TYPE_RTSP_CLIENT_CSEQ, CURLOPT_RTSP_CLIENT_CSEQ);
210
47.2k
    FU32TLV(fuzz, TLV_TYPE_HTTP_VERSION, CURLOPT_HTTP_VERSION);
211
2.46k
    FU32TLV(fuzz, TLV_TYPE_NETRC, CURLOPT_NETRC);
212
297
    FU32TLV(fuzz, TLV_TYPE_WS_OPTIONS, CURLOPT_WS_OPTIONS);
213
2.01k
    FU32TLV(fuzz, TLV_TYPE_CONNECT_ONLY, CURLOPT_CONNECT_ONLY);
214
1.48k
    FU32TLV(fuzz, TLV_TYPE_POST, CURLOPT_POST);
215
38.8k
    FU32TLV(fuzz, TLV_TYPE_PROXYTYPE, CURLOPT_PROXYTYPE);
216
2.41k
    FU32TLV(fuzz, TLV_TYPE_PORT, CURLOPT_PORT);
217
3.30k
    FU32TLV(fuzz, TLV_TYPE_LOW_SPEED_LIMIT, CURLOPT_LOW_SPEED_LIMIT);
218
1.97k
    FU32TLV(fuzz, TLV_TYPE_LOW_SPEED_TIME, CURLOPT_LOW_SPEED_TIME);
219
3.24k
    FU32TLV(fuzz, TLV_TYPE_RESUME_FROM, CURLOPT_RESUME_FROM);
220
444
    FU32TLV(fuzz, TLV_TYPE_TIMEVALUE, CURLOPT_TIMEVALUE);
221
12.2k
    FU32TLV(fuzz, TLV_TYPE_NOPROGRESS, CURLOPT_NOPROGRESS);
222
780
    FU32TLV(fuzz, TLV_TYPE_FAILONERROR, CURLOPT_FAILONERROR);
223
191
    FU32TLV(fuzz, TLV_TYPE_DIRLISTONLY, CURLOPT_DIRLISTONLY);
224
210
    FU32TLV(fuzz, TLV_TYPE_APPEND, CURLOPT_APPEND);
225
3.48k
    FU32TLV(fuzz, TLV_TYPE_TRANSFERTEXT, CURLOPT_TRANSFERTEXT);
226
594
    FU32TLV(fuzz, TLV_TYPE_AUTOREFERER, CURLOPT_AUTOREFERER);
227
1.39k
    FU32TLV(fuzz, TLV_TYPE_PROXYPORT, CURLOPT_PROXYPORT);
228
    // too easy for API misuse FU32TLV(fuzz, TLV_TYPE_POSTFIELDSIZE, CURLOPT_POSTFIELDSIZE);
229
244
    FU32TLV(fuzz, TLV_TYPE_HTTPPROXYTUNNEL, CURLOPT_HTTPPROXYTUNNEL);
230
364
    FU32TLV(fuzz, TLV_TYPE_SSL_VERIFYPEER, CURLOPT_SSL_VERIFYPEER);
231
1.90k
    FU32TLV(fuzz, TLV_TYPE_MAXREDIRS, CURLOPT_MAXREDIRS);
232
593
    FU32TLV(fuzz, TLV_TYPE_FILETIME, CURLOPT_FILETIME);
233
1.80k
    FU32TLV(fuzz, TLV_TYPE_MAXCONNECTS, CURLOPT_MAXCONNECTS);
234
340
    FU32TLV(fuzz, TLV_TYPE_FRESH_CONNECT, CURLOPT_FRESH_CONNECT);
235
273
    FU32TLV(fuzz, TLV_TYPE_FORBID_REUSE, CURLOPT_FORBID_REUSE);
236
4.89k
    FU32TLV(fuzz, TLV_TYPE_CONNECTTIMEOUT, CURLOPT_CONNECTTIMEOUT);
237
228
    FU32TLV(fuzz, TLV_TYPE_HTTPGET, CURLOPT_HTTPGET);
238
293
    FU32TLV(fuzz, TLV_TYPE_SSL_VERIFYHOST, CURLOPT_SSL_VERIFYHOST);
239
183
    FU32TLV(fuzz, TLV_TYPE_FTP_USE_EPSV, CURLOPT_FTP_USE_EPSV);
240
273
    FU32TLV(fuzz, TLV_TYPE_SSLENGINE_DEFAULT, CURLOPT_SSLENGINE_DEFAULT);
241
2.63k
    FU32TLV(fuzz, TLV_TYPE_DNS_CACHE_TIMEOUT, CURLOPT_DNS_CACHE_TIMEOUT);
242
249
    FU32TLV(fuzz, TLV_TYPE_COOKIESESSION, CURLOPT_COOKIESESSION);
243
5.37k
    FU32TLV(fuzz, TLV_TYPE_BUFFERSIZE, CURLOPT_BUFFERSIZE);
244
673
    FU32TLV(fuzz, TLV_TYPE_NOSIGNAL, CURLOPT_NOSIGNAL);
245
489
    FU32TLV(fuzz, TLV_TYPE_UNRESTRICTED_AUTH, CURLOPT_UNRESTRICTED_AUTH);
246
177
    FU32TLV(fuzz, TLV_TYPE_FTP_USE_EPRT, CURLOPT_FTP_USE_EPRT);
247
1.55k
    FU32TLV(fuzz, TLV_TYPE_FTP_CREATE_MISSING_DIRS, CURLOPT_FTP_CREATE_MISSING_DIRS);
248
2.97k
    FU32TLV(fuzz, TLV_TYPE_MAXFILESIZE, CURLOPT_MAXFILESIZE);
249
597
    FU32TLV(fuzz, TLV_TYPE_TCP_NODELAY, CURLOPT_TCP_NODELAY);
250
311
    FU32TLV(fuzz, TLV_TYPE_IGNORE_CONTENT_LENGTH, CURLOPT_IGNORE_CONTENT_LENGTH);
251
229
    FU32TLV(fuzz, TLV_TYPE_FTP_SKIP_PASV_IP, CURLOPT_FTP_SKIP_PASV_IP);
252
3.36k
    FU32TLV(fuzz, TLV_TYPE_LOCALPORT, CURLOPT_LOCALPORT);
253
2.00k
    FU32TLV(fuzz, TLV_TYPE_LOCALPORTRANGE, CURLOPT_LOCALPORTRANGE);
254
177
    FU32TLV(fuzz, TLV_TYPE_SSL_SESSIONID_CACHE, CURLOPT_SSL_SESSIONID_CACHE);
255
1.46k
    FU32TLV(fuzz, TLV_TYPE_FTP_SSL_CCC, CURLOPT_FTP_SSL_CCC);
256
6.68k
    FU32TLV(fuzz, TLV_TYPE_CONNECTTIMEOUT_MS, CURLOPT_CONNECTTIMEOUT_MS);
257
749
    FU32TLV(fuzz, TLV_TYPE_HTTP_TRANSFER_DECODING, CURLOPT_HTTP_TRANSFER_DECODING);
258
174
    FU32TLV(fuzz, TLV_TYPE_HTTP_CONTENT_DECODING, CURLOPT_HTTP_CONTENT_DECODING);
259
1.71k
    FU32TLV(fuzz, TLV_TYPE_NEW_FILE_PERMS, CURLOPT_NEW_FILE_PERMS);
260
49
    FU32TLV(fuzz, TLV_TYPE_NEW_DIRECTORY_PERMS, CURLOPT_NEW_DIRECTORY_PERMS);
261
1.47k
    FU32TLV(fuzz, TLV_TYPE_PROXY_TRANSFER_MODE, CURLOPT_PROXY_TRANSFER_MODE);
262
4.38k
    FU32TLV(fuzz, TLV_TYPE_ADDRESS_SCOPE, CURLOPT_ADDRESS_SCOPE);
263
232
    FU32TLV(fuzz, TLV_TYPE_CERTINFO, CURLOPT_CERTINFO);
264
1.70k
    FU32TLV(fuzz, TLV_TYPE_TFTP_BLKSIZE, CURLOPT_TFTP_BLKSIZE);
265
64
    FU32TLV(fuzz, TLV_TYPE_SOCKS5_GSSAPI_NEC, CURLOPT_SOCKS5_GSSAPI_NEC);
266
175
    FU32TLV(fuzz, TLV_TYPE_FTP_USE_PRET, CURLOPT_FTP_USE_PRET);
267
190
    FU32TLV(fuzz, TLV_TYPE_RTSP_SERVER_CSEQ, CURLOPT_RTSP_SERVER_CSEQ);
268
918
    FU32TLV(fuzz, TLV_TYPE_TRANSFER_ENCODING, CURLOPT_TRANSFER_ENCODING);
269
1.31k
    FU32TLV(fuzz, TLV_TYPE_ACCEPTTIMEOUT_MS, CURLOPT_ACCEPTTIMEOUT_MS);
270
1.12k
    FU32TLV(fuzz, TLV_TYPE_TCP_KEEPALIVE, CURLOPT_TCP_KEEPALIVE);
271
2.19k
    FU32TLV(fuzz, TLV_TYPE_TCP_KEEPIDLE, CURLOPT_TCP_KEEPIDLE);
272
2.58k
    FU32TLV(fuzz, TLV_TYPE_TCP_KEEPINTVL, CURLOPT_TCP_KEEPINTVL);
273
489
    FU32TLV(fuzz, TLV_TYPE_SASL_IR, CURLOPT_SASL_IR);
274
392
    FU32TLV(fuzz, TLV_TYPE_SSL_ENABLE_ALPN, CURLOPT_SSL_ENABLE_ALPN);
275
1.26k
    FU32TLV(fuzz, TLV_TYPE_EXPECT_100_TIMEOUT_MS, CURLOPT_EXPECT_100_TIMEOUT_MS);
276
373
    FU32TLV(fuzz, TLV_TYPE_SSL_VERIFYSTATUS, CURLOPT_SSL_VERIFYSTATUS);
277
63
    FU32TLV(fuzz, TLV_TYPE_SSL_FALSESTART, CURLOPT_SSL_FALSESTART);
278
354
    FU32TLV(fuzz, TLV_TYPE_PATH_AS_IS, CURLOPT_PATH_AS_IS);
279
307
    FU32TLV(fuzz, TLV_TYPE_PIPEWAIT, CURLOPT_PIPEWAIT);
280
1.79k
    FU32TLV(fuzz, TLV_TYPE_STREAM_WEIGHT, CURLOPT_STREAM_WEIGHT);
281
352
    FU32TLV(fuzz, TLV_TYPE_TFTP_NO_OPTIONS, CURLOPT_TFTP_NO_OPTIONS);
282
202
    FU32TLV(fuzz, TLV_TYPE_TCP_FASTOPEN, CURLOPT_TCP_FASTOPEN);
283
288
    FU32TLV(fuzz, TLV_TYPE_KEEP_SENDING_ON_ERROR, CURLOPT_KEEP_SENDING_ON_ERROR);
284
1.31k
    FU32TLV(fuzz, TLV_TYPE_PROXY_SSL_VERIFYPEER, CURLOPT_PROXY_SSL_VERIFYPEER);
285
294
    FU32TLV(fuzz, TLV_TYPE_PROXY_SSL_VERIFYHOST, CURLOPT_PROXY_SSL_VERIFYHOST);
286
241
    FU32TLV(fuzz, TLV_TYPE_PROXY_SSL_OPTIONS, CURLOPT_PROXY_SSL_OPTIONS);
287
659
    FU32TLV(fuzz, TLV_TYPE_SUPPRESS_CONNECT_HEADERS, CURLOPT_SUPPRESS_CONNECT_HEADERS);
288
1.15k
    FU32TLV(fuzz, TLV_TYPE_SOCKS5_AUTH, CURLOPT_SOCKS5_AUTH);
289
122
    FU32TLV(fuzz, TLV_TYPE_SSH_COMPRESSION, CURLOPT_SSH_COMPRESSION);
290
1.24k
    FU32TLV(fuzz, TLV_TYPE_HAPPY_EYEBALLS_TIMEOUT_MS, CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS);
291
460
    FU32TLV(fuzz, TLV_TYPE_HAPROXYPROTOCOL, CURLOPT_HAPROXYPROTOCOL);
292
625
    FU32TLV(fuzz, TLV_TYPE_DNS_SHUFFLE_ADDRESSES, CURLOPT_DNS_SHUFFLE_ADDRESSES);
293
250
    FU32TLV(fuzz, TLV_TYPE_DISALLOW_USERNAME_IN_URL, CURLOPT_DISALLOW_USERNAME_IN_URL);
294
6.08k
    FU32TLV(fuzz, TLV_TYPE_UPLOAD_BUFFERSIZE, CURLOPT_UPLOAD_BUFFERSIZE);
295
1.30k
    FU32TLV(fuzz, TLV_TYPE_UPKEEP_INTERVAL_MS, CURLOPT_UPKEEP_INTERVAL_MS);
296
255
    FU32TLV(fuzz, TLV_TYPE_HTTP09_ALLOWED, CURLOPT_HTTP09_ALLOWED);
297
365
    FU32TLV(fuzz, TLV_TYPE_ALTSVC_CTRL, CURLOPT_ALTSVC_CTRL);
298
1.72k
    FU32TLV(fuzz, TLV_TYPE_MAXAGE_CONN, CURLOPT_MAXAGE_CONN);
299
172
    FU32TLV(fuzz, TLV_TYPE_MAIL_RCPT_ALLOWFAILS, CURLOPT_MAIL_RCPT_ALLOWFAILS);
300
314
    FU32TLV(fuzz, TLV_TYPE_HSTS_CTRL, CURLOPT_HSTS_CTRL);
301
195
    FU32TLV(fuzz, TLV_TYPE_DOH_SSL_VERIFYPEER, CURLOPT_DOH_SSL_VERIFYPEER);
302
152
    FU32TLV(fuzz, TLV_TYPE_DOH_SSL_VERIFYHOST, CURLOPT_DOH_SSL_VERIFYHOST);
303
284
    FU32TLV(fuzz, TLV_TYPE_DOH_SSL_VERIFYSTATUS, CURLOPT_DOH_SSL_VERIFYSTATUS);
304
1.99k
    FU32TLV(fuzz, TLV_TYPE_MAXLIFETIME_CONN, CURLOPT_MAXLIFETIME_CONN);
305
229
    FU32TLV(fuzz, TLV_TYPE_MIME_OPTIONS, CURLOPT_MIME_OPTIONS);
306
3.21k
    FU32TLV(fuzz, TLV_TYPE_CA_CACHE_TIMEOUT, CURLOPT_CA_CACHE_TIMEOUT);
307
142
    FU32TLV(fuzz, TLV_TYPE_QUICK_EXIT, CURLOPT_QUICK_EXIT);
308
1.25k
    FU32TLV(fuzz, TLV_TYPE_SERVER_RESPONSE_TIMEOUT_MS, CURLOPT_SERVER_RESPONSE_TIMEOUT_MS);
309
2.05k
    FU32TLV(fuzz, TLV_TYPE_TCP_KEEPCNT, CURLOPT_TCP_KEEPCNT);
310
2.49k
    FU32TLV(fuzz, TLV_TYPE_SSLVERSION, CURLOPT_SSLVERSION);
311
3.40k
    FU32TLV(fuzz, TLV_TYPE_TIMECONDITION, CURLOPT_TIMECONDITION);
312
3.70k
    FU32TLV(fuzz, TLV_TYPE_PROXYAUTH, CURLOPT_PROXYAUTH);
313
1.52k
    FU32TLV(fuzz, TLV_TYPE_IPRESOLVE, CURLOPT_IPRESOLVE);
314
1.53k
    FU32TLV(fuzz, TLV_TYPE_USE_SSL, CURLOPT_USE_SSL);
315
1.30k
    FU32TLV(fuzz, TLV_TYPE_FTPSSLAUTH, CURLOPT_FTPSSLAUTH);
316
1.45k
    FU32TLV(fuzz, TLV_TYPE_FTP_FILEMETHOD, CURLOPT_FTP_FILEMETHOD);
317
99
    FU32TLV(fuzz, TLV_TYPE_SSH_AUTH_TYPES, CURLOPT_SSH_AUTH_TYPES);
318
1.51k
    FU32TLV(fuzz, TLV_TYPE_POSTREDIR, CURLOPT_POSTREDIR);
319
52
    FU32TLV(fuzz, TLV_TYPE_GSSAPI_DELEGATION, CURLOPT_GSSAPI_DELEGATION);
320
355
    FU32TLV(fuzz, TLV_TYPE_SSL_OPTIONS, CURLOPT_SSL_OPTIONS);
321
5.39k
    FU32TLV(fuzz, TLV_TYPE_HEADEROPT, CURLOPT_HEADEROPT);
322
1.64k
    FU32TLV(fuzz, TLV_TYPE_PROXY_SSLVERSION, CURLOPT_PROXY_SSLVERSION);
323
4.07k
    FU32TLV(fuzz, TLV_TYPE_RESUME_FROM_LARGE, CURLOPT_RESUME_FROM_LARGE);
324
2.81k
    FU32TLV(fuzz, TLV_TYPE_MAXFILESIZE_LARGE, CURLOPT_MAXFILESIZE_LARGE);
325
    // too easy for API misuse FU32TLV(fuzz, TLV_TYPE_POSTFIELDSIZE_LARGE, CURLOPT_POSTFIELDSIZE_LARGE);
326
5.21k
    FU32TLV(fuzz, TLV_TYPE_MAX_SEND_SPEED_LARGE, CURLOPT_MAX_SEND_SPEED_LARGE);
327
9.08k
    FU32TLV(fuzz, TLV_TYPE_MAX_RECV_SPEED_LARGE, CURLOPT_MAX_RECV_SPEED_LARGE);
328
754
    FU32TLV(fuzz, TLV_TYPE_TIMEVALUE_LARGE, CURLOPT_TIMEVALUE_LARGE);
329
330
    /* Define a set of singleton TLVs - they can only have their value set once
331
       and all follow the same pattern. */
332
214k
    FSINGLETONTLV(fuzz, TLV_TYPE_URL, CURLOPT_URL);
333
7.46k
    FSINGLETONTLV(fuzz, TLV_TYPE_DOH_URL, CURLOPT_DOH_URL);
334
3.18k
    FSINGLETONTLV(fuzz, TLV_TYPE_USERNAME, CURLOPT_USERNAME);
335
2.68k
    FSINGLETONTLV(fuzz, TLV_TYPE_PASSWORD, CURLOPT_PASSWORD);
336
1.38k
    FSINGLETONTLV(fuzz, TLV_TYPE_COOKIE, CURLOPT_COOKIE);
337
4.03k
    FSINGLETONTLV(fuzz, TLV_TYPE_RANGE, CURLOPT_RANGE);
338
1.93k
    FSINGLETONTLV(fuzz, TLV_TYPE_CUSTOMREQUEST, CURLOPT_CUSTOMREQUEST);
339
814
    FSINGLETONTLV(fuzz, TLV_TYPE_MAIL_FROM, CURLOPT_MAIL_FROM);
340
4.94k
    FSINGLETONTLV(fuzz, TLV_TYPE_ACCEPTENCODING, CURLOPT_ACCEPT_ENCODING);
341
723
    FSINGLETONTLV(fuzz, TLV_TYPE_RTSP_SESSION_ID, CURLOPT_RTSP_SESSION_ID);
342
296
    FSINGLETONTLV(fuzz, TLV_TYPE_RTSP_STREAM_URI, CURLOPT_RTSP_STREAM_URI);
343
344
    FSINGLETONTLV(fuzz, TLV_TYPE_RTSP_TRANSPORT, CURLOPT_RTSP_TRANSPORT);
344
196
    FSINGLETONTLV(fuzz, TLV_TYPE_MAIL_AUTH, CURLOPT_MAIL_AUTH);
345
798
    FSINGLETONTLV(fuzz, TLV_TYPE_LOGIN_OPTIONS, CURLOPT_LOGIN_OPTIONS);
346
2.23k
    FSINGLETONTLV(fuzz, TLV_TYPE_XOAUTH2_BEARER, CURLOPT_XOAUTH2_BEARER);
347
3.33k
    FSINGLETONTLV(fuzz, TLV_TYPE_USERPWD, CURLOPT_USERPWD);
348
2.24k
    FSINGLETONTLV(fuzz, TLV_TYPE_USERAGENT, CURLOPT_USERAGENT);
349
106
    FSINGLETONTLV(fuzz, TLV_TYPE_SSH_HOST_PUBLIC_KEY_SHA256, CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256);
350
31.9k
    FSINGLETONTLV(fuzz, TLV_TYPE_PROXY, CURLOPT_PROXY);
351
4.91k
    FSINGLETONTLV(fuzz, TLV_TYPE_PROXYUSERPWD, CURLOPT_PROXYUSERPWD);
352
430
    FSINGLETONTLV(fuzz, TLV_TYPE_REFERER, CURLOPT_REFERER);
353
600
    FSINGLETONTLV(fuzz, TLV_TYPE_FTPPORT, CURLOPT_FTPPORT);
354
328
    FSINGLETONTLV(fuzz, TLV_TYPE_SSLCERT, CURLOPT_SSLCERT);
355
114
    FSINGLETONTLV(fuzz, TLV_TYPE_KEYPASSWD, CURLOPT_KEYPASSWD);
356
6.14k
    FSINGLETONTLV(fuzz, TLV_TYPE_INTERFACE, CURLOPT_INTERFACE);
357
44
    FSINGLETONTLV(fuzz, TLV_TYPE_KRBLEVEL, CURLOPT_KRBLEVEL);
358
1.58k
    FSINGLETONTLV(fuzz, TLV_TYPE_CAINFO, CURLOPT_CAINFO);
359
14.6k
    FSINGLETONTLV(fuzz, TLV_TYPE_SSL_CIPHER_LIST, CURLOPT_SSL_CIPHER_LIST);
360
140
    FSINGLETONTLV(fuzz, TLV_TYPE_SSLCERTTYPE, CURLOPT_SSLCERTTYPE);
361
88
    FSINGLETONTLV(fuzz, TLV_TYPE_SSLKEY, CURLOPT_SSLKEY);
362
92
    FSINGLETONTLV(fuzz, TLV_TYPE_SSLKEYTYPE, CURLOPT_SSLKEYTYPE);
363
17.2k
    FSINGLETONTLV(fuzz, TLV_TYPE_SSLENGINE, CURLOPT_SSLENGINE);
364
1.04k
    FSINGLETONTLV(fuzz, TLV_TYPE_CAPATH, CURLOPT_CAPATH);
365
152
    FSINGLETONTLV(fuzz, TLV_TYPE_FTP_ACCOUNT, CURLOPT_FTP_ACCOUNT);
366
21.4k
    FSINGLETONTLV(fuzz, TLV_TYPE_COOKIELIST, CURLOPT_COOKIELIST);
367
124
    FSINGLETONTLV(fuzz, TLV_TYPE_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_ALTERNATIVE_TO_USER);
368
30
    FSINGLETONTLV(fuzz, TLV_TYPE_SSH_PUBLIC_KEYFILE, CURLOPT_SSH_PUBLIC_KEYFILE);
369
32
    FSINGLETONTLV(fuzz, TLV_TYPE_SSH_PRIVATE_KEYFILE, CURLOPT_SSH_PRIVATE_KEYFILE);
370
34
    FSINGLETONTLV(fuzz, TLV_TYPE_SSH_HOST_PUBLIC_KEY_MD5, CURLOPT_SSH_HOST_PUBLIC_KEY_MD5);
371
190
    FSINGLETONTLV(fuzz, TLV_TYPE_ISSUERCERT, CURLOPT_ISSUERCERT);
372
252
    FSINGLETONTLV(fuzz, TLV_TYPE_PROXYUSERNAME, CURLOPT_PROXYUSERNAME);
373
156
    FSINGLETONTLV(fuzz, TLV_TYPE_PROXYPASSWORD, CURLOPT_PROXYPASSWORD);
374
4.98k
    FSINGLETONTLV(fuzz, TLV_TYPE_NOPROXY, CURLOPT_NOPROXY);
375
28
    FSINGLETONTLV(fuzz, TLV_TYPE_SSH_KNOWNHOSTS, CURLOPT_SSH_KNOWNHOSTS);
376
440
    FSINGLETONTLV(fuzz, TLV_TYPE_TLSAUTH_USERNAME, CURLOPT_TLSAUTH_USERNAME);
377
530
    FSINGLETONTLV(fuzz, TLV_TYPE_TLSAUTH_PASSWORD, CURLOPT_TLSAUTH_PASSWORD);
378
102
    FSINGLETONTLV(fuzz, TLV_TYPE_TLSAUTH_TYPE, CURLOPT_TLSAUTH_TYPE);
379
44
    FSINGLETONTLV(fuzz, TLV_TYPE_DNS_SERVERS, CURLOPT_DNS_SERVERS);
380
32
    FSINGLETONTLV(fuzz, TLV_TYPE_DNS_INTERFACE, CURLOPT_DNS_INTERFACE);
381
38
    FSINGLETONTLV(fuzz, TLV_TYPE_DNS_LOCAL_IP4, CURLOPT_DNS_LOCAL_IP4);
382
30
    FSINGLETONTLV(fuzz, TLV_TYPE_DNS_LOCAL_IP6, CURLOPT_DNS_LOCAL_IP6);
383
364
    FSINGLETONTLV(fuzz, TLV_TYPE_PINNEDPUBLICKEY, CURLOPT_PINNEDPUBLICKEY);
384
1.54k
    FSINGLETONTLV(fuzz, TLV_TYPE_UNIX_SOCKET_PATH, CURLOPT_UNIX_SOCKET_PATH);
385
409
    FSINGLETONTLV(fuzz, TLV_TYPE_PROXY_SERVICE_NAME, CURLOPT_PROXY_SERVICE_NAME);
386
238
    FSINGLETONTLV(fuzz, TLV_TYPE_SERVICE_NAME, CURLOPT_SERVICE_NAME);
387
2.09k
    FSINGLETONTLV(fuzz, TLV_TYPE_DEFAULT_PROTOCOL, CURLOPT_DEFAULT_PROTOCOL);
388
408
    FSINGLETONTLV(fuzz, TLV_TYPE_PROXY_CAINFO, CURLOPT_PROXY_CAINFO);
389
654
    FSINGLETONTLV(fuzz, TLV_TYPE_PROXY_CAPATH, CURLOPT_PROXY_CAPATH);
390
196
    FSINGLETONTLV(fuzz, TLV_TYPE_PROXY_TLSAUTH_USERNAME, CURLOPT_PROXY_TLSAUTH_USERNAME);
391
184
    FSINGLETONTLV(fuzz, TLV_TYPE_PROXY_TLSAUTH_PASSWORD, CURLOPT_PROXY_TLSAUTH_PASSWORD);
392
110
    FSINGLETONTLV(fuzz, TLV_TYPE_PROXY_TLSAUTH_TYPE, CURLOPT_PROXY_TLSAUTH_TYPE);
393
216
    FSINGLETONTLV(fuzz, TLV_TYPE_PROXY_SSLCERT, CURLOPT_PROXY_SSLCERT);
394
102
    FSINGLETONTLV(fuzz, TLV_TYPE_PROXY_SSLCERTTYPE, CURLOPT_PROXY_SSLCERTTYPE);
395
144
    FSINGLETONTLV(fuzz, TLV_TYPE_PROXY_SSLKEY, CURLOPT_PROXY_SSLKEY);
396
114
    FSINGLETONTLV(fuzz, TLV_TYPE_PROXY_SSLKEYTYPE, CURLOPT_PROXY_SSLKEYTYPE);
397
340
    FSINGLETONTLV(fuzz, TLV_TYPE_PROXY_KEYPASSWD, CURLOPT_PROXY_KEYPASSWD);
398
7.12k
    FSINGLETONTLV(fuzz, TLV_TYPE_PROXY_SSL_CIPHER_LIST, CURLOPT_PROXY_SSL_CIPHER_LIST);
399
450
    FSINGLETONTLV(fuzz, TLV_TYPE_PROXY_CRLFILE, CURLOPT_PROXY_CRLFILE);
400
40.2k
    FSINGLETONTLV(fuzz, TLV_TYPE_PRE_PROXY, CURLOPT_PRE_PROXY);
401
304
    FSINGLETONTLV(fuzz, TLV_TYPE_PROXY_PINNEDPUBLICKEY, CURLOPT_PROXY_PINNEDPUBLICKEY);
402
1.03k
    FSINGLETONTLV(fuzz, TLV_TYPE_ABSTRACT_UNIX_SOCKET, CURLOPT_ABSTRACT_UNIX_SOCKET);
403
554
    FSINGLETONTLV(fuzz, TLV_TYPE_REQUEST_TARGET, CURLOPT_REQUEST_TARGET);
404
3.30k
    FSINGLETONTLV(fuzz, TLV_TYPE_TLS13_CIPHERS, CURLOPT_TLS13_CIPHERS);
405
1.75k
    FSINGLETONTLV(fuzz, TLV_TYPE_PROXY_TLS13_CIPHERS, CURLOPT_PROXY_TLS13_CIPHERS);
406
212
    FSINGLETONTLV(fuzz, TLV_TYPE_SASL_AUTHZID, CURLOPT_SASL_AUTHZID);
407
235
    FSINGLETONTLV(fuzz, TLV_TYPE_PROXY_ISSUERCERT, CURLOPT_PROXY_ISSUERCERT);
408
4.42k
    FSINGLETONTLV(fuzz, TLV_TYPE_SSL_EC_CURVES, CURLOPT_SSL_EC_CURVES);
409
11.7k
    FSINGLETONTLV(fuzz, TLV_TYPE_AWS_SIGV4, CURLOPT_AWS_SIGV4);
410
2.47k
    FSINGLETONTLV(fuzz, TLV_TYPE_REDIR_PROTOCOLS_STR, CURLOPT_REDIR_PROTOCOLS_STR);
411
760
    FSINGLETONTLV(fuzz, TLV_TYPE_HAPROXY_CLIENT_IP, CURLOPT_HAPROXY_CLIENT_IP);
412
30
    FSINGLETONTLV(fuzz, TLV_TYPE_ECH, CURLOPT_ECH);
413
498
    default:
414
      /* The fuzzer generates lots of unknown TLVs - we don't want these in the
415
         corpus so we reject any unknown TLVs. */
416
498
      rc = 127;
417
498
      goto EXIT_LABEL;
418
0
      break;
419
4.02M
  }
420
421
3.99M
  rc = 0;
422
423
4.02M
EXIT_LABEL:
424
425
4.02M
  fuzz_free((void **)&tmp);
426
427
4.02M
  return rc;
428
3.99M
}
429
430
/**
431
 * Converts a TLV data and length into an allocated string.
432
 */
433
char *fuzz_tlv_to_string(TLV *tlv)
434
922k
{
435
922k
  char *tlvstr;
436
437
  /* Allocate enough space, plus a null terminator */
438
922k
  tlvstr = (char *)malloc(tlv->length + 1);
439
440
922k
  if(tlvstr != NULL) {
441
922k
    memcpy(tlvstr, tlv->value, tlv->length);
442
922k
    tlvstr[tlv->length] = 0;
443
922k
  }
444
445
922k
  return tlvstr;
446
922k
}
447
448
/* set up for CURLOPT_HTTPPOST, an alternative API to CURLOPT_MIMEPOST */
449
void fuzz_setup_http_post(FUZZ_DATA *fuzz, TLV *tlv)
450
997
{
451
997
  if (fuzz->httppost == NULL) {
452
997
    struct curl_httppost *post = NULL;
453
997
    struct curl_httppost *last = NULL;
454
455
997
    fuzz->post_body = fuzz_tlv_to_string(tlv);
456
997
    if (fuzz->post_body == NULL) {
457
0
      return;
458
0
    }
459
460
    /* This is just one of several possible entrypoints to
461
     * the HTTPPOST API. see https://curl.se/libcurl/c/curl_formadd.html
462
     * for lots of others which could be added here.
463
     */
464
997
    curl_formadd(&post, &last,
465
997
     CURLFORM_COPYNAME, FUZZ_HTTPPOST_NAME,
466
997
     CURLFORM_PTRCONTENTS, fuzz->post_body,
467
997
     CURLFORM_CONTENTLEN, (curl_off_t) strlen(fuzz->post_body),
468
997
     CURLFORM_END);
469
470
997
    fuzz->last_post_part = last;
471
997
    fuzz->httppost = post;
472
997
  }
473
474
997
  return;
475
997
}
476
477
/**
478
 * Extract the values from the TLV.
479
 */
480
int fuzz_add_mime_part(TLV *src_tlv, curl_mimepart *part)
481
3.17M
{
482
3.17M
  FUZZ_DATA part_fuzz;
483
3.17M
  TLV tlv;
484
3.17M
  int rc = 0;
485
3.17M
  int tlv_rc;
486
487
3.17M
  memset(&part_fuzz, 0, sizeof(FUZZ_DATA));
488
489
3.17M
  if(src_tlv->length < sizeof(TLV_RAW)) {
490
    /* Not enough data for a single TLV - don't continue */
491
2.70M
    goto EXIT_LABEL;
492
2.70M
  }
493
494
  /* Set up the state parser */
495
469k
  part_fuzz.state.data = src_tlv->value;
496
469k
  part_fuzz.state.data_len = src_tlv->length;
497
498
469k
  for(tlv_rc = fuzz_get_first_tlv(&part_fuzz, &tlv);
499
836k
      tlv_rc == 0;
500
469k
      tlv_rc = fuzz_get_next_tlv(&part_fuzz, &tlv)) {
501
502
    /* Have the TLV in hand. Parse the TLV. */
503
406k
    rc = fuzz_parse_mime_tlv(part, &tlv);
504
505
406k
    if(rc != 0) {
506
      /* Failed to parse the TLV. Can't continue. */
507
39.1k
      goto EXIT_LABEL;
508
39.1k
    }
509
406k
  }
510
511
430k
  if(tlv_rc != TLV_RC_NO_MORE_TLVS) {
512
    /* A TLV call failed. Can't continue. */
513
78.4k
    goto EXIT_LABEL;
514
78.4k
  }
515
516
3.17M
EXIT_LABEL:
517
518
3.17M
  return(rc);
519
430k
}
520
521
/**
522
 * Do different actions on the mime part for different received TLVs.
523
 */
524
int fuzz_parse_mime_tlv(curl_mimepart *part, TLV *tlv)
525
406k
{
526
406k
  int rc;
527
406k
  char *tmp;
528
529
406k
  switch(tlv->type) {
530
349k
    case TLV_TYPE_MIME_PART_NAME:
531
349k
      tmp = fuzz_tlv_to_string(tlv);
532
349k
      curl_mime_name(part, tmp);
533
349k
      fuzz_free((void **)&tmp);
534
349k
      break;
535
536
17.6k
    case TLV_TYPE_MIME_PART_DATA:
537
17.6k
      curl_mime_data(part, (const char *)tlv->value, tlv->length);
538
17.6k
      break;
539
540
39.1k
    default:
541
      /* The fuzzer generates lots of unknown TLVs - we don't want these in the
542
         corpus so we reject any unknown TLVs. */
543
39.1k
      rc = 255;
544
39.1k
      goto EXIT_LABEL;
545
0
      break;
546
406k
  }
547
548
367k
  rc = 0;
549
550
406k
EXIT_LABEL:
551
552
406k
  return rc;
553
367k
}