maxmustermann/dogecoin
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Make asmap Interpreter errors fatal and fuzz test it

Browse source
This commit is contained in:
Pieter Wuille 2020-04-03 13:32:34 -07:00
parent c81aefc537
commit 7cf97fda15
2 changed files with 34 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

45
src/test/fuzz/asmap.cpp
View file

@ -3,26 +3,47 @@
// file COPYING or http://www.opensource.org/licenses/mit-license.php. // file COPYING or http://www.opensource.org/licenses/mit-license.php.
#include <netaddress.h> #include <netaddress.h>
#include <test/fuzz/FuzzedDataProvider.h>
#include <test/fuzz/fuzz.h> #include <test/fuzz/fuzz.h>
#include <cstdint> #include <cstdint>
#include <vector> #include <vector>
//! asmap code that consumes nothing
static const std::vector<bool> IPV6_PREFIX_ASMAP = {};
//! asmap code that consumes the 96 prefix bits of ::ffff:0/96 (IPv4-in-IPv6 map)
static const std::vector<bool> IPV4_PREFIX_ASMAP = {
true, true, false, true, true, true, true, true, true, true, false, false, false, false, false, false, false, false, // Match 0x00
true, true, false, true, true, true, true, true, true, true, false, false, false, false, false, false, false, false, // Match 0x00
true, true, false, true, true, true, true, true, true, true, false, false, false, false, false, false, false, false, // Match 0x00
true, true, false, true, true, true, true, true, true, true, false, false, false, false, false, false, false, false, // Match 0x00
true, true, false, true, true, true, true, true, true, true, false, false, false, false, false, false, false, false, // Match 0x00
true, true, false, true, true, true, true, true, true, true, false, false, false, false, false, false, false, false, // Match 0x00
true, true, false, true, true, true, true, true, true, true, false, false, false, false, false, false, false, false, // Match 0x00
true, true, false, true, true, true, true, true, true, true, false, false, false, false, false, false, false, false, // Match 0x00
true, true, false, true, true, true, true, true, true, true, false, false, false, false, false, false, false, false, // Match 0x00
true, true, false, true, true, true, true, true, true, true, false, false, false, false, false, false, false, false, // Match 0x00
true, true, false, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, // Match 0xFF
true, true, false, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true // Match 0xFF
};
void test_one_input(const std::vector<uint8_t>& buffer) void test_one_input(const std::vector<uint8_t>& buffer)
{ {
FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size()); // Encoding: [7 bits: asmap size] [1 bit: ipv6?] [3-130 bytes: asmap] [4 or 16 bytes: addr]
const Network network = fuzzed_data_provider.PickValueInArray({NET_IPV4, NET_IPV6}); if (buffer.size() < 1 + 3 + 4) return;
if (fuzzed_data_provider.remaining_bytes() < 16) { int asmap_size = 3 + (buffer[0] & 127);
return; bool ipv6 = buffer[0] & 128;
} int addr_size = ipv6 ? 16 : 4;
CNetAddr net_addr; if (buffer.size() < size_t(1 + asmap_size + addr_size)) return;
net_addr.SetRaw(network, fuzzed_data_provider.ConsumeBytes<uint8_t>(16).data()); std::vector<bool> asmap = ipv6 ? IPV6_PREFIX_ASMAP : IPV4_PREFIX_ASMAP;
std::vector<bool> asmap; asmap.reserve(asmap.size() + 8 * asmap_size);
for (const char cur_byte : fuzzed_data_provider.ConsumeRemainingBytes<char>()) { for (int i = 0; i < asmap_size; ++i) {
for (int bit = 0; bit < 8; ++bit) { for (int j = 0; j < 8; ++j) {
asmap.push_back((cur_byte >> bit) & 1); asmap.push_back((buffer[1 + i] >> j) & 1);
} }
} }
if (!SanityCheckASMap(asmap)) return;
CNetAddr net_addr;
net_addr.SetRaw(ipv6 ? NET_IPV6 : NET_IPV4, buffer.data() + 1 + asmap_size);
(void)net_addr.GetMappedAS(asmap); (void)net_addr.GetMappedAS(asmap);
} }

2
src/util/asmap.cpp
View file

@ -116,7 +116,7 @@ uint32_t Interpret(const std::vector<bool> &asmap, const std::vector<bool> &ip)
break; // Instruction straddles EOF break; // Instruction straddles EOF
} }
} }
// Reached EOF without RETURN, or aborted (see any of the breaks above). assert(false); // Reached EOF without RETURN, or aborted (see any of the breaks above) - should have been caught by SanityCheckASMap below
return 0; // 0 is not a valid ASN return 0; // 0 is not a valid ASN
} }