/*

 * Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.

 *

 * Licensed under the Apache License 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 * https://www.openssl.org/source/license.html

 * or in the file LICENSE in the source distribution.

 */

/*

 * Test hashtable operation.

 */

#include <limits.h>

#include <openssl/err.h>

#include <openssl/bio.h>

#include <internal/common.h>

#include <internal/hashtable.h>

#include "fuzzer.h"

/*

 * Make the key space very small here to make lookups

 * easy to predict for the purposes of validation

 * A two byte key gives us 65536 possible entries

 * so we can allocate a flat table to compare to

 */

HT_START_KEY_DEFN(fuzzer_key)

HT_DEF_KEY_FIELD(fuzzkey, uint16_t)

HT_END_KEY_DEFN(FUZZER_KEY)

#define FZ_FLAG_ALLOCATED (1 << 0)

typedef struct fuzzer_value_st {

    uint64_t flags;

    uint64_t value;

} FUZZER_VALUE;

IMPLEMENT_HT_VALUE_TYPE_FNS(FUZZER_VALUE, fz, static)

hashtable.c:ossl_ht_fz_FUZZER_VALUE_from_value

Line

Count

Source

37

IMPLEMENT_HT_VALUE_TYPE_FNS(FUZZER_VALUE, fz, static)

hashtable.c:ossl_ht_fz_FUZZER_VALUE_insert

Line

Count

Source

37

IMPLEMENT_HT_VALUE_TYPE_FNS(FUZZER_VALUE, fz, static)

hashtable.c:ossl_ht_fz_FUZZER_VALUE_get

Line

Count

Source

37

IMPLEMENT_HT_VALUE_TYPE_FNS(FUZZER_VALUE, fz, static)

static size_t skipped_values = 0;

static size_t inserts = 0;

static size_t replacements = 0;

static size_t deletes = 0;

static size_t flushes = 0;

static size_t lookups = 0;

static size_t foreaches = 0;

static size_t filters = 0;

static int valfound;

static FUZZER_VALUE *prediction_table = NULL;

static HT *fuzzer_table = NULL;

/*

 * Operational values

 */

#define OP_INSERT 0

#define OP_DELETE 1

#define OP_LOOKUP 2

#define OP_FLUSH 3

#define OP_FOREACH 4

#define OP_FILTER 5

#define OP_END 6

#define OP_MASK 0x3f

#define INSERT_REPLACE_MASK 0x40

#define OPERATION(x) (((x) & OP_MASK) % OP_END)

#define IS_REPLACE(x) ((x) & INSERT_REPLACE_MASK)

static int table_iterator(HT_VALUE *v, void *arg)

{

    uint16_t keyval = (*(uint16_t *)arg);

    FUZZER_VALUE *f = ossl_ht_fz_FUZZER_VALUE_from_value(v);

    if (f != NULL && f == &prediction_table[keyval]) {

        valfound = 1;

        return 0;

    }

    return 1;

}

static int filter_iterator(HT_VALUE *v, void *arg)

{

    uint16_t keyval = (*(uint16_t *)arg);

    FUZZER_VALUE *f = ossl_ht_fz_FUZZER_VALUE_from_value(v);

    if (f != NULL && f == &prediction_table[keyval])

        return 1;

    return 0;

}

static void fuzz_free_cb(HT_VALUE *v)

{

    FUZZER_VALUE *f = ossl_ht_fz_FUZZER_VALUE_from_value(v);

    if (f != NULL)

        f->flags &= ~FZ_FLAG_ALLOCATED;

}

int FuzzerInitialize(int *argc, char ***argv)

{

    HT_CONFIG fuzz_conf = { NULL, fuzz_free_cb, NULL, 0, 1, 0 };

    OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);

    ERR_clear_error();

    prediction_table = OPENSSL_calloc(65537, sizeof(FUZZER_VALUE));

    if (prediction_table == NULL)

        return -1;

    fuzzer_table = ossl_ht_new(&fuzz_conf);

    if (fuzzer_table == NULL) {

        OPENSSL_free(prediction_table);

        return -1;

    }

    return 0;

}

int FuzzerTestOneInput(const uint8_t *buf, size_t len)

{

    uint8_t op_flags;

    uint16_t keyval;

    int rc;

    int rc_prediction = 1;

    size_t i;

    FUZZER_VALUE *valptr, *lval;

    FUZZER_KEY key;

    HT_VALUE *v = NULL;

    HT_VALUE tv;

    HT_VALUE_LIST *htvlist;

    /*

     * We need at least 11 bytes to be able to do anything here

     * 1 byte to detect the operation to perform, 2 bytes

     * for the lookup key, and 8 bytes of value

     */

    if (len < 11) {

        skipped_values++;

        return -1;

    }

    /*

     * parse out our operation flags and key

     */

    op_flags = buf[0];

    memcpy(&keyval, &buf[1], sizeof(uint16_t));

    /*

     * Initialize our key

     */

    HT_INIT_KEY(&key);

    /*

     * Now do our operation

     */

    switch (OPERATION(op_flags)) {

    case OP_INSERT:

        valptr = &prediction_table[keyval];

        /* reset our key */

        HT_KEY_RESET(&key);

        /* set the proper key value */

        HT_SET_KEY_FIELD(&key, fuzzkey, keyval);

        memcpy(&valptr->value, &buf[3], sizeof(uint64_t));

        /* lock the table */

        ossl_ht_write_lock(fuzzer_table);

        /*

         * do the insert/replace

         */

        if (IS_REPLACE(op_flags))

            rc = ossl_ht_fz_FUZZER_VALUE_insert(fuzzer_table, TO_HT_KEY(&key),

                valptr, &lval);

        else

            rc = ossl_ht_fz_FUZZER_VALUE_insert(fuzzer_table, TO_HT_KEY(&key),

                valptr, NULL);

        /*

         * unlock the table

         */

        ossl_ht_write_unlock(fuzzer_table);

        /*

         * mark the entry as being allocated

         */

        if (rc == 1) {

            valptr->flags |= FZ_FLAG_ALLOCATED;

            IS_REPLACE(op_flags) ? replacements++ : inserts++;

        }

        break;

    case OP_DELETE:

        valptr = &prediction_table[keyval];

        /* reset our key */

        HT_KEY_RESET(&key);

        /* set the proper key value */

        HT_SET_KEY_FIELD(&key, fuzzkey, keyval);

        /* lock the table */

        ossl_ht_write_lock(fuzzer_table);

        /*

         * do the delete

         */

        rc = ossl_ht_delete(fuzzer_table, TO_HT_KEY(&key));

        /*

         * unlock the table

         */

        ossl_ht_write_unlock(fuzzer_table);

        /*

         * successful deletion if there wasn't a conflict

         */

        if (rc == 1)

            deletes++;

        break;

    case OP_LOOKUP:

        valptr = &prediction_table[keyval];

        lval = NULL;

        /* reset our key */

        HT_KEY_RESET(&key);

        /* set the proper key value */

        HT_SET_KEY_FIELD(&key, fuzzkey, keyval);

        /* lock the table for reading */

        if (!ossl_ht_read_lock(fuzzer_table))

            return 0;

        /*

         * If the value to find is not already allocated

         * then we expect a miss in the lookup

         * i.e. we predict a return code of NULL instead

         * of a pointer

         */

        if (!(valptr->flags & FZ_FLAG_ALLOCATED))

            valptr = NULL;

        /*

         * do the lookup

         */

        lval = ossl_ht_fz_FUZZER_VALUE_get(fuzzer_table, TO_HT_KEY(&key), &v);

        /*

         * unlock the table

         */

        ossl_ht_read_unlock(fuzzer_table);

        /*

         * Now check to make sure we did the right thing

         */

        if (valptr == NULL)

            OPENSSL_assert(lval == NULL);

        else

            OPENSSL_assert(lval == NULL || lval == valptr);

        /*

         * if we expect a positive lookup, make sure that

         * we can use the _type and to_value functions

         */

        if (valptr != NULL && lval != NULL) {

            OPENSSL_assert(ossl_ht_fz_FUZZER_VALUE_type(v) == 1);

            v = ossl_ht_fz_FUZZER_VALUE_to_value(lval, &tv);

            OPENSSL_assert(v->value == lval);

            lookups++;

        }

        break;

    case OP_FLUSH:

        /*

         * only flush the table rarely

         */

        if ((flushes % 100000) != 1) {

            skipped_values++;

            flushes++;

            return 0;

        }

        /*

         * lock the table

         */

        ossl_ht_write_lock(fuzzer_table);

        rc = ossl_ht_flush(fuzzer_table);

        ossl_ht_write_unlock(fuzzer_table);

        /*

         * now check to make sure everything is free

         */

        if (rc == 1) {

            for (i = 0; i < USHRT_MAX; i++)

                OPENSSL_assert((prediction_table[i].flags & FZ_FLAG_ALLOCATED) == 0);

            flushes++;

        }

        break;

    case OP_FOREACH:

        valfound = 0;

        valptr = &prediction_table[keyval];

        rc_prediction = 0;

        if (valptr->flags & FZ_FLAG_ALLOCATED)

            rc_prediction = 1;

        ossl_ht_foreach_until(fuzzer_table, table_iterator, &keyval);

        OPENSSL_assert(valfound == rc_prediction);

        foreaches++;

        break;

    case OP_FILTER:

        valptr = &prediction_table[keyval];

        rc_prediction = 0;

        if (valptr->flags & FZ_FLAG_ALLOCATED)

            rc_prediction = 1;

        htvlist = ossl_ht_filter(fuzzer_table, 1, filter_iterator, &keyval);

        if (htvlist != NULL) {

            OPENSSL_assert(htvlist->list_len == (size_t)rc_prediction);

            ossl_ht_value_list_free(htvlist);

            filters++;

        }

        break;

    default:

        return -1;

    }

    return 0;

}

void FuzzerCleanup(void)

{

    ossl_ht_free(fuzzer_table);

    OPENSSL_free(prediction_table);

    OPENSSL_cleanup();

}