/src/curl_fuzzer/legacy_fuzzer.cc

Source
/***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
 *                             / __| | | | |_) | |
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
 * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
 * are also available at https://curl.se/docs/copyright.html.
 *
 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
 * copies of the Software, and permit persons to whom the Software is
 * furnished to do so, under the terms of the COPYING file.
 *
 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
 * KIND, either express or implied.
 *
 ***************************************************************************/

#include <stdlib.h>
#include <signal.h>
#include <string.h>
#include <unistd.h>
#include <curl/curl.h>
#include "curl_fuzzer.h"
#include "legacy_fuzzer.h"
#include "legacy_protocol_allowlist.h"
#include "legacy_tlv_mutator.h"

/**
 * Run one legacy TLV input independently of the exported libFuzzer symbol.
 * Keeping the implementation behind a normal C++ function lets every
 * protocol binary expose its own same-named source entrypoint, which is how
 * Fuzz Introspector attributes a binary's runtime coverage to its call tree.
 */
int LegacyFuzzerTestOneInput(const uint8_t *data, size_t size)
{
  int rc = 0;
  int tlv_rc;
  FUZZ_DATA fuzz;
  TLV tlv;

  /* Ignore SIGPIPE errors. We'll handle the errors ourselves. */
  signal(SIGPIPE, SIG_IGN);

  /* Have to set all fields to zero before getting to the terminate function */
  memset(&fuzz, 0, sizeof(FUZZ_DATA));

  if(size < sizeof(TLV_RAW)) {
    /* Not enough data for a single TLV - don't continue */
    goto EXIT_LABEL;
  }

  /* Try to initialize the fuzz data */
  FTRY(fuzz_initialize_fuzz_data(&fuzz, data, size));

  for(tlv_rc = fuzz_get_first_tlv(&fuzz, &tlv);
      tlv_rc == 0;
      tlv_rc = fuzz_get_next_tlv(&fuzz, &tlv)) {

    /* Have the TLV in hand. Parse the TLV. */
    rc = fuzz_parse_tlv(&fuzz, &tlv);

    if(rc != 0) {
      /* Failed to parse the TLV. Can't continue. */
      goto EXIT_LABEL;
    }
  }

  if(tlv_rc != TLV_RC_NO_MORE_TLVS) {
    /* A TLV call failed. Can't continue. */
    goto EXIT_LABEL;
  }

  /* Set up the standard easy options. */
  FTRY(fuzz_set_easy_options(&fuzz));

  /**
   * Add in more curl options that have been accumulated over possibly
   * multiple TLVs.
   */
  if(fuzz.header_list != NULL) {
    curl_easy_setopt(fuzz.easy, CURLOPT_HTTPHEADER, fuzz.header_list);
  }

  if(fuzz.mail_recipients_list != NULL) {
    curl_easy_setopt(fuzz.easy, CURLOPT_MAIL_RCPT, fuzz.mail_recipients_list);
  }

  if(fuzz.mime != NULL) {
    curl_easy_setopt(fuzz.easy, CURLOPT_MIMEPOST, fuzz.mime);
  }

  if (fuzz.httppost != NULL) {
    curl_easy_setopt(fuzz.easy, CURLOPT_HTTPPOST, fuzz.httppost);
  }

  /* Run the transfer. */
  fuzz_handle_transfer(&fuzz);

EXIT_LABEL:

  fuzz_terminate_fuzz_data(&fuzz);

  /* This function must always return 0. Non-zero codes are reserved. */
  return 0;
}

/**
 * Utility function to convert 4 bytes to a u32 predictably.
 */
uint32_t to_u32(const uint8_t b[4])
{
  uint32_t u;
  /* Promote into the unsigned result type before shifting. uint8_t otherwise
     promotes to signed int, and values with the high bit set make the
     left-shift undefined before curl ever observes the fuzzed boundary. */
  u = (static_cast<uint32_t>(b[0]) << 24) |
      (static_cast<uint32_t>(b[1]) << 16) |
      (static_cast<uint32_t>(b[2]) << 8) |
      static_cast<uint32_t>(b[3]);
  return u;
}

/**
 * Utility function to convert 2 bytes to a u16 predictably.
 */
uint16_t to_u16(const uint8_t b[2])
{
  uint16_t u;
  u = (b[0] << 8) + b[1];
  return u;
}

/**
 * Initialize the local fuzz data structure.
 */
int fuzz_initialize_fuzz_data(FUZZ_DATA *fuzz,
                              const uint8_t *data,
                              size_t data_len)
{
  int rc = 0;
  int ii;

  /* Initialize the fuzz data. */
  memset(fuzz, 0, sizeof(FUZZ_DATA));

  /* Create an easy handle. This will have all of the settings configured on
     it. */
  fuzz->easy = curl_easy_init();
  FCHECK(fuzz->easy != NULL);

  /* Set up the state parser */
  fuzz->state.data = data;
  fuzz->state.data_len = data_len;

  /* Set up the state of the server sockets. */
  for(ii = 0; ii < FUZZ_NUM_CONNECTIONS; ii++) {
    fuzz->sockman[ii].index = ii;
    fuzz->sockman[ii].fd_state = FUZZ_SOCK_CLOSED;
  }

  /* Check for verbose mode. */
  fuzz->verbose = (getenv("FUZZ_VERBOSE") != NULL);

  FCHECK(setenv("CURL_HSTS_HTTP", "1", 0) == 0);
  FCHECK(setenv("CURL_ALTSVC_HTTP", "1", 0) == 0);

EXIT_LABEL:

  return rc;
}

/**
 * Reapply resolver-sensitive string options with their canonical loopback
 * values before starting a transfer.
 *
 * Custom mutation and crossover already finalize generated buffers, but an
 * initial corpus entry or standalone reproducer is executed without passing
 * through either callback. The option tracker identifies only values that the
 * TLV parser successfully applied, so this does not enable routing options that
 * were absent from the input. DNS_INTERFACE is deliberately excluded: with
 * c-ares it is a device name passed to ares_set_local_dev(), not a hostname.
 */
static int fuzz_finalize_routing_options(FUZZ_DATA *fuzz)
{
  int rc = 0;

#define FFINALIZE_ROUTING_OPTION(TLVTYPE, CURLOPTNAME)                         \
  if(fuzz->options[(CURLOPTNAME) % 1000]) {                                   \
    const char *canonical =                                                   \
      legacy_tlv_mutator::CanonicalRoutingValue((TLVTYPE));                   \
    FCHECK(canonical != NULL);                                                 \
    FTRY(curl_easy_setopt(fuzz->easy, (CURLOPTNAME), canonical));              \
  }

  FFINALIZE_ROUTING_OPTION(TLV_TYPE_PROXY, CURLOPT_PROXY);
  FFINALIZE_ROUTING_OPTION(TLV_TYPE_FTPPORT, CURLOPT_FTPPORT);
  FFINALIZE_ROUTING_OPTION(TLV_TYPE_INTERFACE, CURLOPT_INTERFACE);
  FFINALIZE_ROUTING_OPTION(TLV_TYPE_PRE_PROXY, CURLOPT_PRE_PROXY);

#undef FFINALIZE_ROUTING_OPTION

EXIT_LABEL:
  return rc;
}

/**
 * Set standard options on the curl easy.
 */
int fuzz_set_easy_options(FUZZ_DATA *fuzz)
{
  int rc = 0;

  /* Existing seeds and direct reproducers bypass the custom mutator. Close
     that path before any transfer can resolve a corpus-provided endpoint. */
  FTRY(fuzz_finalize_routing_options(fuzz));

  /* Set some standard options on the CURL easy handle. We need to override the
     socket function so that we create our own sockets to present to CURL. */
  FTRY(curl_easy_setopt(fuzz->easy,
                        CURLOPT_OPENSOCKETFUNCTION,
                        fuzz_open_socket));
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_OPENSOCKETDATA, fuzz));

  /* In case something tries to set a socket option, intercept this. */
  FTRY(curl_easy_setopt(fuzz->easy,
                        CURLOPT_SOCKOPTFUNCTION,
                        fuzz_sockopt_callback));

  /* Set the standard read function callback. */
  FTRY(curl_easy_setopt(fuzz->easy,
                        CURLOPT_READFUNCTION,
                        fuzz_read_callback));
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_READDATA, fuzz));

  /* Set the standard write function callback. */
  FTRY(curl_easy_setopt(fuzz->easy,
                        CURLOPT_WRITEFUNCTION,
                        fuzz_write_callback));
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_WRITEDATA, fuzz));

  /* Set the writable cookie jar path so cookies are tested. */
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_COOKIEJAR, FUZZ_COOKIE_JAR_PATH));

  /* Set the RO cookie file path so cookies are tested. */
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_COOKIEFILE, FUZZ_RO_COOKIE_FILE_PATH));

  /* Set altsvc header cache filepath so that it can be fuzzed. */
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_ALTSVC, FUZZ_ALT_SVC_HEADER_CACHE_PATH));

  /* Set the hsts header cache filepath so that it can be fuzzed. */
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_HSTS, FUZZ_HSTS_HEADER_CACHE_PATH));

  /* Set the Certificate Revocation List file path so it can be fuzzed */
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_CRLFILE, FUZZ_CRL_FILE_PATH));

  /* Loading the host trust store for every WSS mutation dominates the
     WebSocket target even when the in-process mock immediately ends the TLS
     handshake. Keep this exception local to that target: the other legacy
     fuzzers should retain libcurl's verification default so their ordinary
     mutations continue to cover certificate setup. An explicit
     SSL_VERIFYPEER TLV still restores verification in the WebSocket target. */
#ifdef FUZZ_PROTOCOLS_WS
  if(!fuzz->options[CURLOPT_SSL_VERIFYPEER % 1000]) {
    FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_SSL_VERIFYPEER, 0L));
  }
#endif

  /* Set the .netrc file path so it can be fuzzed */
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_NETRC_FILE, FUZZ_NETRC_FILE_PATH));

  /* Time out requests quickly. */
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_TIMEOUT_MS, 200L));
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_SERVER_RESPONSE_TIMEOUT, 1L));

  /* Can enable verbose mode by having the environment variable FUZZ_VERBOSE. */
  if(fuzz->verbose) {
    FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_VERBOSE, 1L));
  }

  /* Force resolution of all addresses to a specific IP address. */
  fuzz->connect_to_list = curl_slist_append(NULL, "::127.0.1.127:");
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_CONNECT_TO, fuzz->connect_to_list));

  /* Limit the protocols in use by this fuzzer. */
  FTRY(fuzz_set_allowed_protocols(fuzz));

EXIT_LABEL:

  return rc;
}

/**
 * Terminate the fuzz data structure, including freeing any allocated memory.
 */
void fuzz_terminate_fuzz_data(FUZZ_DATA *fuzz)
{
  int ii;

  fuzz_free((void **)&fuzz->postfields);

  for(ii = 0; ii < FUZZ_NUM_CONNECTIONS; ii++) {
    if(fuzz->sockman[ii].fd_state != FUZZ_SOCK_CLOSED) {
      close(fuzz->sockman[ii].fd);
      fuzz->sockman[ii].fd_state = FUZZ_SOCK_CLOSED;
    }
  }

  if(fuzz->connect_to_list != NULL) {
    curl_slist_free_all(fuzz->connect_to_list);
    fuzz->connect_to_list = NULL;
  }

  if(fuzz->header_list != NULL) {
    curl_slist_free_all(fuzz->header_list);
    fuzz->header_list = NULL;
  }

  if(fuzz->mail_recipients_list != NULL) {
    curl_slist_free_all(fuzz->mail_recipients_list);
    fuzz->mail_recipients_list = NULL;
  }

  if(fuzz->mime != NULL) {
    curl_mime_free(fuzz->mime);
    fuzz->mime = NULL;
  }

  if(fuzz->easy != NULL) {
    curl_easy_cleanup(fuzz->easy);
    fuzz->easy = NULL;
  }

  /* When you have passed the struct curl_httppost pointer to curl_easy_setopt
   * (using the CURLOPT_HTTPPOST option), you must not free the list until after
   *  you have called curl_easy_cleanup for the curl handle.
   *  https://curl.se/libcurl/c/curl_formadd.html */
  if (fuzz->httppost != NULL) {
    curl_formfree(fuzz->httppost);
    fuzz->httppost = NULL;
  }

  // free after httppost and last_post_part.
  if (fuzz->post_body != NULL) {
    fuzz_free((void **)&fuzz->post_body);
  }
}

/**
 * If a pointer has been allocated, free that pointer.
 */
void fuzz_free(void **ptr)
{
  if(*ptr != NULL) {
    free(*ptr);
    *ptr = NULL;
  }
}

/**
 * Function for handling the fuzz transfer, including sending responses to
 * requests.
 */
int fuzz_handle_transfer(FUZZ_DATA *fuzz)
{
  int rc = 0;
  CURLM *multi_handle;
  int still_running; /* keep number of running handles */
  CURLMsg *msg; /* for picking up messages with the transfer status */
  int msgs_left; /* how many messages are left */
  int double_timeout = 0;
  fd_set fdread;
  fd_set fdwrite;
  fd_set fdexcep;
  struct timeval timeout;
  int select_rc;
  CURLMcode mc;
  int maxfd = -1;
  long curl_timeo = -1;
  int ii;
  FUZZ_SOCKET_MANAGER *sman[FUZZ_NUM_CONNECTIONS];

  for(ii = 0; ii < FUZZ_NUM_CONNECTIONS; ii++) {
    sman[ii] = &fuzz->sockman[ii];

    /* Set up the starting index for responses. */
    sman[ii]->response_index = 1;
  }

  /* init a multi stack */
  multi_handle = curl_multi_init();

  /* add the individual transfers */
  curl_multi_add_handle(multi_handle, fuzz->easy);

  /* Do an initial process. This might end the transfer immediately. */
  curl_multi_perform(multi_handle, &still_running);
  FV_PRINTF(fuzz,
            "FUZZ: Initial perform; still running? %d \n",
            still_running);

  while(still_running) {
    /* Reset the sets of file descriptors. */
    FD_ZERO(&fdread);
    FD_ZERO(&fdwrite);
    FD_ZERO(&fdexcep);

    /* Set a timeout of 10ms. This is lower than recommended by the multi guide
       but we're not going to any remote servers, so everything should complete
       very quickly. */
    timeout.tv_sec = 0;
    timeout.tv_usec = 10000;

    /* get file descriptors from the transfers */
    mc = curl_multi_fdset(multi_handle, &fdread, &fdwrite, &fdexcep, &maxfd);
    if(mc != CURLM_OK) {
      fprintf(stderr, "curl_multi_fdset() failed, code %d.\n", mc);
      rc = -1;
      break;
    }

    for(ii = 0; ii < FUZZ_NUM_CONNECTIONS; ii++) {
      /* Add the socket FD into the readable set if connected. */
      if(sman[ii]->fd_state == FUZZ_SOCK_OPEN) {
        FD_SET(sman[ii]->fd, &fdread);

        /* Work out the maximum FD between the cURL file descriptors and the
           server FD. */
        maxfd = FUZZ_MAX(sman[ii]->fd, maxfd);
      }
    }

    /* Work out what file descriptors need work. */
    rc = fuzz_select(maxfd + 1, &fdread, &fdwrite, &fdexcep, &timeout);

    if(rc == -1) {
      /* Had an issue while selecting a file descriptor. Let's just exit. */
      FV_PRINTF(fuzz, "FUZZ: select failed, exiting \n");
      break;
    }

    /* Check to see if a server file descriptor is readable. If it is,
       then send the next response from the fuzzing data. */
    int server_data_sent = 0;
    for(ii = 0; ii < FUZZ_NUM_CONNECTIONS; ii++) {
      if(sman[ii]->fd_state == FUZZ_SOCK_OPEN &&
         FD_ISSET(sman[ii]->fd, &fdread)) {
        rc = fuzz_send_next_response(fuzz, sman[ii]);
        if(rc != 0) {
          /* Failed to send a response. Break out here. */
          break;
        }
        server_data_sent = 1;
      }
    }

    /* Stall detection: exit after two consecutive iterations where no new
       data was provided to curl. This handles both select() timeouts and
       cases where curl registers a writable fd but cannot make progress
       (e.g. HTTP/2 egress stuck with no real peer to drain to). */
    if(!server_data_sent) {
      FV_PRINTF(fuzz, "FUZZ: No data sent; stall count %d \n", double_timeout);
      if(double_timeout == 1) {
        break;
      }
      double_timeout = 1;
    }
    else {
      double_timeout = 0;
    }

    curl_multi_perform(multi_handle, &still_running);
  }

  /* Remove the easy handle from the multi stack. */
  curl_multi_remove_handle(multi_handle, fuzz->easy);

  /* Clean up the multi handle - the top level function will handle the easy
     handle. */
  curl_multi_cleanup(multi_handle);

  return rc;
}

/**
 * Sends the next fuzzing response to the server file descriptor.
 */
int fuzz_send_next_response(FUZZ_DATA *fuzz, FUZZ_SOCKET_MANAGER *sman)
{
  int rc = 0;
  ssize_t ret_in;
  ssize_t ret_out;
  char buffer[8192];
  const uint8_t *data;
  size_t data_len;

  /* Need to read all data sent by the client so the file descriptor becomes
     unreadable. Because the file descriptor is non-blocking we won't just
     hang here. */
  do {
    ret_in = read(sman->fd, buffer, sizeof(buffer));
    if(fuzz->verbose && ret_in > 0) {
      printf("FUZZ[%d]: Received %zu bytes \n==>\n", sman->index, ret_in);
      fwrite(buffer, ret_in, 1, stdout);
      printf("\n<==\n");
    }
  } while (ret_in > 0);

  /* Now send a response to the request that the client just made. */
  FV_PRINTF(fuzz,
            "FUZZ[%d]: Sending next response: %d \n",
            sman->index,
            sman->response_index);
  data = sman->responses[sman->response_index].data;
  data_len = sman->responses[sman->response_index].data_len;

  if(data != NULL) {
    if(write(sman->fd, data, data_len) != (ssize_t)data_len) {
      /* Failed to write the data back to the client. Prevent any further
         testing. */
      rc = -1;
    }
  }

  /* Work out if there are any more responses. If not, then shut down the
     server. */
  sman->response_index++;

  if(sman->response_index >= TLV_MAX_NUM_RESPONSES ||
     sman->responses[sman->response_index].data == NULL) {
    FV_PRINTF(fuzz,
              "FUZZ[%d]: Shutting down server socket: %d \n",
              sman->index,
              sman->fd);
    shutdown(sman->fd, SHUT_WR);
    sman->fd_state = FUZZ_SOCK_SHUTDOWN;
  }

  return rc;
}

/**
 * Wrapper for select() so profiling can track it.
 */
int fuzz_select(int nfds,
                fd_set *readfds,
                fd_set *writefds,
                fd_set *exceptfds,
                struct timeval *timeout) {
  return select(nfds, readfds, writefds, exceptfds, timeout);
}

/**
 * Set allowed protocols based on the compile options.
 *
 * Note that it can only use ONE of the FUZZ_PROTOCOLS_* defines.
 */
int fuzz_set_allowed_protocols(FUZZ_DATA *fuzz)
{
  int rc = 0;
  const char *allowed_protocols = "";

#ifdef FUZZ_PROTOCOLS_ALL
  /* CURLOPT_PROTOCOLS_STR rejects the complete value if even one requested
     protocol was compiled out. Derive the generic target's stable safety
     policy from this libcurl build so optional RTMP and SSH backends cannot
     prevent every transfer from starting. */
  allowed_protocols = legacy_protocol_allowlist::ForCurrentCurl().c_str();
#endif
#ifdef FUZZ_PROTOCOLS_DICT
  allowed_protocols = "dict";
#endif
#ifdef FUZZ_PROTOCOLS_FILE
  allowed_protocols = "file";
#endif
#ifdef FUZZ_PROTOCOLS_FTP
  allowed_protocols = "ftp,ftps";
#endif
#ifdef FUZZ_PROTOCOLS_GOPHER
  allowed_protocols = "gopher,gophers";
#endif
#ifdef FUZZ_PROTOCOLS_HTTP
  allowed_protocols = "http";
#endif
#ifdef FUZZ_PROTOCOLS_HTTPS
  allowed_protocols = "https";
#endif
#ifdef FUZZ_PROTOCOLS_IMAP
  allowed_protocols = "imap,imaps";
#endif
#ifdef FUZZ_PROTOCOLS_LDAP
  allowed_protocols = "ldap,ldaps";
#endif
#ifdef FUZZ_PROTOCOLS_MQTT
  allowed_protocols = "mqtt";
#endif
#ifdef FUZZ_PROTOCOLS_POP3
  allowed_protocols = "pop3,pop3s";
#endif
#ifdef FUZZ_PROTOCOLS_RTMP
  allowed_protocols = "rtmp,rtmpe,rtmps,rtmpt,rtmpte,rtmpts";
#endif
#ifdef FUZZ_PROTOCOLS_RTSP
  allowed_protocols = "rtsp";
#endif
#ifdef FUZZ_PROTOCOLS_SCP
  allowed_protocols = "scp";
#endif
#ifdef FUZZ_PROTOCOLS_SFTP
  allowed_protocols = "sftp";
#endif
#ifdef FUZZ_PROTOCOLS_SMTP
  allowed_protocols = "smtp,smtps";
#endif
#ifdef FUZZ_PROTOCOLS_TFTP
  allowed_protocols = "tftp";
#endif
#ifdef FUZZ_PROTOCOLS_WS
  // http is required by websockets
  allowed_protocols = "http,ws,wss";
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_CONNECT_ONLY, 2L));
#endif

  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_PROTOCOLS_STR, allowed_protocols));

EXIT_LABEL:

  return rc;
}

Coverage Report

Created: 2026-10-22 06:56