/src/openssl111/fuzz/bignum.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved. |
3 | | * |
4 | | * Licensed under the OpenSSL licenses, (the "License"); |
5 | | * you may not use this file except in compliance with the License. |
6 | | * You may obtain a copy of the License at |
7 | | * https://www.openssl.org/source/license.html |
8 | | * or in the file LICENSE in the source distribution. |
9 | | */ |
10 | | |
11 | | /* |
12 | | * Confirm that a^b mod c agrees when calculated cleverly vs naively, for |
13 | | * random a, b and c. |
14 | | */ |
15 | | |
16 | | #include <stdio.h> |
17 | | #include <openssl/bn.h> |
18 | | #include <openssl/err.h> |
19 | | #include "fuzzer.h" |
20 | | |
21 | | |
22 | | int FuzzerInitialize(int *argc, char ***argv) |
23 | 2 | { |
24 | 2 | OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL); |
25 | 2 | ERR_get_state(); |
26 | | |
27 | 2 | return 1; |
28 | 2 | } |
29 | | |
30 | | int FuzzerTestOneInput(const uint8_t *buf, size_t len) |
31 | 3.32k | { |
32 | 3.32k | int success = 0; |
33 | 3.32k | size_t l1 = 0, l2 = 0, l3 = 0; |
34 | 3.32k | int s1 = 0, s3 = 0; |
35 | 3.32k | BN_CTX *ctx; |
36 | 3.32k | BIGNUM *b1; |
37 | 3.32k | BIGNUM *b2; |
38 | 3.32k | BIGNUM *b3; |
39 | 3.32k | BIGNUM *b4; |
40 | 3.32k | BIGNUM *b5; |
41 | | |
42 | 3.32k | b1 = BN_new(); |
43 | 3.32k | b2 = BN_new(); |
44 | 3.32k | b3 = BN_new(); |
45 | 3.32k | b4 = BN_new(); |
46 | 3.32k | b5 = BN_new(); |
47 | 3.32k | ctx = BN_CTX_new(); |
48 | | |
49 | | /* Divide the input into three parts, using the values of the first two |
50 | | * bytes to choose lengths, which generate b1, b2 and b3. Use three bits |
51 | | * of the third byte to choose signs for the three numbers. |
52 | | */ |
53 | 3.32k | if (len > 2) { |
54 | 3.32k | len -= 3; |
55 | 3.32k | l1 = (buf[0] * len) / 255; |
56 | 3.32k | ++buf; |
57 | 3.32k | l2 = (buf[0] * (len - l1)) / 255; |
58 | 3.32k | ++buf; |
59 | 3.32k | l3 = len - l1 - l2; |
60 | | |
61 | 3.32k | s1 = buf[0] & 1; |
62 | 3.32k | s3 = buf[0] & 4; |
63 | 3.32k | ++buf; |
64 | 3.32k | } |
65 | 3.32k | OPENSSL_assert(BN_bin2bn(buf, l1, b1) == b1); |
66 | 3.32k | BN_set_negative(b1, s1); |
67 | 3.32k | OPENSSL_assert(BN_bin2bn(buf + l1, l2, b2) == b2); |
68 | 3.32k | OPENSSL_assert(BN_bin2bn(buf + l1 + l2, l3, b3) == b3); |
69 | 3.32k | BN_set_negative(b3, s3); |
70 | | |
71 | | /* mod 0 is undefined */ |
72 | 3.32k | if (BN_is_zero(b3)) { |
73 | 57 | success = 1; |
74 | 57 | goto done; |
75 | 57 | } |
76 | | |
77 | 3.27k | OPENSSL_assert(BN_mod_exp(b4, b1, b2, b3, ctx)); |
78 | 3.27k | OPENSSL_assert(BN_mod_exp_simple(b5, b1, b2, b3, ctx)); |
79 | | |
80 | 3.27k | success = BN_cmp(b4, b5) == 0; |
81 | 3.27k | if (!success) { |
82 | 0 | BN_print_fp(stdout, b1); |
83 | 0 | putchar('\n'); |
84 | 0 | BN_print_fp(stdout, b2); |
85 | 0 | putchar('\n'); |
86 | 0 | BN_print_fp(stdout, b3); |
87 | 0 | putchar('\n'); |
88 | 0 | BN_print_fp(stdout, b4); |
89 | 0 | putchar('\n'); |
90 | 0 | BN_print_fp(stdout, b5); |
91 | 0 | putchar('\n'); |
92 | 0 | } |
93 | | |
94 | 3.32k | done: |
95 | 3.32k | OPENSSL_assert(success); |
96 | 3.32k | BN_free(b1); |
97 | 3.32k | BN_free(b2); |
98 | 3.32k | BN_free(b3); |
99 | 3.32k | BN_free(b4); |
100 | 3.32k | BN_free(b5); |
101 | 3.32k | BN_CTX_free(ctx); |
102 | 3.32k | ERR_clear_error(); |
103 | | |
104 | 3.32k | return 0; |
105 | 3.27k | } |
106 | | |
107 | | void FuzzerCleanup(void) |
108 | 0 | { |
109 | 0 | } |