summaryrefslogtreecommitdiff
path: root/fuzz/fuzz_credman.c
diff options
context:
space:
mode:
Diffstat (limited to 'fuzz/fuzz_credman.c')
-rw-r--r--fuzz/fuzz_credman.c667
1 files changed, 667 insertions, 0 deletions
diff --git a/fuzz/fuzz_credman.c b/fuzz/fuzz_credman.c
new file mode 100644
index 0000000..4359938
--- /dev/null
+++ b/fuzz/fuzz_credman.c
@@ -0,0 +1,667 @@
1/*
2 * Copyright (c) 2019 Yubico AB. All rights reserved.
3 * Use of this source code is governed by a BSD-style
4 * license that can be found in the LICENSE file.
5 */
6
7#include <assert.h>
8#include <stdint.h>
9#include <stdlib.h>
10#include <string.h>
11#include <stdio.h>
12
13#include "mutator_aux.h"
14#include "fido.h"
15#include "fido/credman.h"
16
17#include "../openbsd-compat/openbsd-compat.h"
18
19#define TAG_META_WIRE_DATA 0x01
20#define TAG_RP_WIRE_DATA 0x02
21#define TAG_RK_WIRE_DATA 0x03
22#define TAG_DEL_WIRE_DATA 0x04
23#define TAG_CRED_ID 0x05
24#define TAG_PIN 0x06
25#define TAG_RP_ID 0x07
26#define TAG_SEED 0x08
27
28/* Parameter set defining a FIDO2 credential management operation. */
29struct param {
30 char pin[MAXSTR];
31 char rp_id[MAXSTR];
32 int seed;
33 struct blob cred_id;
34 struct blob del_wire_data;
35 struct blob meta_wire_data;
36 struct blob rk_wire_data;
37 struct blob rp_wire_data;
38};
39
40/* Example parameters. */
41static const uint8_t dummy_cred_id[] = {
42 0x4f, 0x72, 0x98, 0x42, 0x4a, 0xe1, 0x17, 0xa5,
43 0x85, 0xa0, 0xef, 0x3b, 0x11, 0x24, 0x4a, 0x3d,
44};
45static const char dummy_pin[] = "[n#899:~m";
46static const char dummy_rp_id[] = "yubico.com";
47
48/*
49 * Collection of HID reports from an authenticator issued with a FIDO2
50 * 'getCredsMetadata' credential management command.
51 */
52static const uint8_t dummy_meta_wire_data[] = {
53 0xff, 0xff, 0xff, 0xff, 0x86, 0x00, 0x11, 0xc5,
54 0xb7, 0x89, 0xba, 0x8d, 0x5f, 0x94, 0x1b, 0x00,
55 0x12, 0x00, 0x04, 0x02, 0x00, 0x04, 0x05, 0x05,
56 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
57 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
58 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
59 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
60 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
61 0x00, 0x12, 0x00, 0x04, 0x90, 0x00, 0x51, 0x00,
62 0xa1, 0x01, 0xa5, 0x01, 0x02, 0x03, 0x38, 0x18,
63 0x20, 0x01, 0x21, 0x58, 0x20, 0x93, 0xc5, 0x64,
64 0x71, 0xe9, 0xd1, 0xb8, 0xed, 0xf6, 0xd5, 0xf3,
65 0xa7, 0xd5, 0x96, 0x70, 0xbb, 0xd5, 0x20, 0xa1,
66 0xa3, 0xd3, 0x93, 0x4c, 0x5c, 0x20, 0x5c, 0x22,
67 0xeb, 0xb0, 0x6a, 0x27, 0x59, 0x22, 0x58, 0x20,
68 0x63, 0x02, 0x33, 0xa8, 0xed, 0x3c, 0xbc, 0xe9,
69 0x00, 0x12, 0x00, 0x04, 0x00, 0xda, 0x44, 0xf5,
70 0xed, 0xda, 0xe6, 0xa4, 0xad, 0x3f, 0x9e, 0xf8,
71 0x50, 0x8d, 0x01, 0x47, 0x6c, 0x4e, 0x72, 0xa4,
72 0x04, 0x13, 0xa8, 0x65, 0x97, 0x00, 0x00, 0x00,
73 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
74 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
75 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
76 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
77 0x00, 0x12, 0x00, 0x04, 0x90, 0x00, 0x14, 0x00,
78 0xa1, 0x02, 0x50, 0x6f, 0x11, 0x96, 0x21, 0x92,
79 0x52, 0xf1, 0x6b, 0xd4, 0x2c, 0xe3, 0xf8, 0xc9,
80 0x8c, 0x47, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
81 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
82 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
83 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
84 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
85 0x00, 0x12, 0x00, 0x04, 0x90, 0x00, 0x07, 0x00,
86 0xa2, 0x01, 0x00, 0x02, 0x18, 0x19, 0x00, 0x00,
87 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
88 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
89 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
90 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
91 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
92 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
93};
94
95/*
96 * Collection of HID reports from an authenticator issued with a FIDO2
97 * 'enumerateRPsBegin' credential management command.
98 */
99static const uint8_t dummy_rp_wire_data[] = {
100 0xff, 0xff, 0xff, 0xff, 0x86, 0x00, 0x11, 0x87,
101 0xbf, 0xc6, 0x7f, 0x36, 0xf5, 0xe2, 0x49, 0x00,
102 0x15, 0x00, 0x02, 0x02, 0x00, 0x04, 0x05, 0x05,
103 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
104 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
105 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
106 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
107 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
108 0x00, 0x15, 0x00, 0x02, 0x90, 0x00, 0x51, 0x00,
109 0xa1, 0x01, 0xa5, 0x01, 0x02, 0x03, 0x38, 0x18,
110 0x20, 0x01, 0x21, 0x58, 0x20, 0x12, 0xc1, 0x81,
111 0x6b, 0x92, 0x6a, 0x56, 0x05, 0xfe, 0xdb, 0xab,
112 0x90, 0x2f, 0x57, 0x0b, 0x3d, 0x85, 0x3e, 0x3f,
113 0xbc, 0xe5, 0xd3, 0xb6, 0x86, 0xdf, 0x10, 0x43,
114 0xc2, 0xaf, 0x87, 0x34, 0x0e, 0x22, 0x58, 0x20,
115 0xd3, 0x0f, 0x7e, 0x5d, 0x10, 0x33, 0x57, 0x24,
116 0x00, 0x15, 0x00, 0x02, 0x00, 0x6e, 0x90, 0x58,
117 0x61, 0x2a, 0xd2, 0xc2, 0x1e, 0x08, 0xea, 0x91,
118 0xcb, 0x44, 0x66, 0x73, 0x29, 0x92, 0x29, 0x59,
119 0x91, 0xa3, 0x4d, 0x2c, 0xbb, 0x00, 0x00, 0x00,
120 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
121 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
122 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
123 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
124 0x00, 0x15, 0x00, 0x02, 0x90, 0x00, 0x14, 0x00,
125 0xa1, 0x02, 0x50, 0x6d, 0x95, 0x0e, 0x73, 0x78,
126 0x46, 0x13, 0x2e, 0x07, 0xbf, 0xeb, 0x61, 0x31,
127 0x37, 0x36, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
128 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
129 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
130 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
131 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
132 0x00, 0x15, 0x00, 0x02, 0x90, 0x00, 0x37, 0x00,
133 0xa3, 0x03, 0xa1, 0x62, 0x69, 0x64, 0x6a, 0x79,
134 0x75, 0x62, 0x69, 0x63, 0x6f, 0x2e, 0x63, 0x6f,
135 0x6d, 0x04, 0x58, 0x20, 0x37, 0x82, 0x09, 0xb7,
136 0x2d, 0xef, 0xcb, 0xa9, 0x1d, 0xcb, 0xf8, 0x54,
137 0xed, 0xb4, 0xda, 0xa6, 0x48, 0x82, 0x8a, 0x2c,
138 0xbd, 0x18, 0x0a, 0xfc, 0x77, 0xa7, 0x44, 0x34,
139 0x65, 0x5a, 0x1c, 0x7d, 0x05, 0x03, 0x00, 0x00,
140 0x00, 0x15, 0x00, 0x02, 0x90, 0x00, 0x36, 0x00,
141 0xa2, 0x03, 0xa1, 0x62, 0x69, 0x64, 0x6b, 0x79,
142 0x75, 0x62, 0x69, 0x6b, 0x65, 0x79, 0x2e, 0x6f,
143 0x72, 0x67, 0x04, 0x58, 0x20, 0x12, 0x6b, 0xba,
144 0x6a, 0x2d, 0x7a, 0x81, 0x84, 0x25, 0x7b, 0x74,
145 0xdd, 0x1d, 0xdd, 0x46, 0xb6, 0x2a, 0x8c, 0xa2,
146 0xa7, 0x83, 0xfe, 0xdb, 0x5b, 0x19, 0x48, 0x73,
147 0x55, 0xb7, 0xe3, 0x46, 0x09, 0x00, 0x00, 0x00,
148 0x00, 0x15, 0x00, 0x02, 0x90, 0x00, 0x37, 0x00,
149 0xa2, 0x03, 0xa1, 0x62, 0x69, 0x64, 0x6c, 0x77,
150 0x65, 0x62, 0x61, 0x75, 0x74, 0x68, 0x6e, 0x2e,
151 0x64, 0x65, 0x76, 0x04, 0x58, 0x20, 0xd6, 0x32,
152 0x7d, 0x8c, 0x6a, 0x5d, 0xe6, 0xae, 0x0e, 0x33,
153 0xd0, 0xa3, 0x31, 0xfb, 0x67, 0x77, 0xb9, 0x4e,
154 0xf4, 0x73, 0x19, 0xfe, 0x7e, 0xfd, 0xfa, 0x82,
155 0x70, 0x8e, 0x1f, 0xbb, 0xa2, 0x55, 0x00, 0x00,
156};
157
158/*
159 * Collection of HID reports from an authenticator issued with a FIDO2
160 * 'enumerateCredentialsBegin' credential management command.
161 */
162static const uint8_t dummy_rk_wire_data[] = {
163 0xff, 0xff, 0xff, 0xff, 0x86, 0x00, 0x11, 0x35,
164 0x3b, 0x34, 0xb9, 0xcb, 0xeb, 0x40, 0x55, 0x00,
165 0x15, 0x00, 0x04, 0x02, 0x00, 0x04, 0x05, 0x05,
166 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
167 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
168 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
169 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
170 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
171 0x00, 0x15, 0x00, 0x04, 0x90, 0x00, 0x51, 0x00,
172 0xa1, 0x01, 0xa5, 0x01, 0x02, 0x03, 0x38, 0x18,
173 0x20, 0x01, 0x21, 0x58, 0x20, 0x12, 0xc1, 0x81,
174 0x6b, 0x92, 0x6a, 0x56, 0x05, 0xfe, 0xdb, 0xab,
175 0x90, 0x2f, 0x57, 0x0b, 0x3d, 0x85, 0x3e, 0x3f,
176 0xbc, 0xe5, 0xd3, 0xb6, 0x86, 0xdf, 0x10, 0x43,
177 0xc2, 0xaf, 0x87, 0x34, 0x0e, 0x22, 0x58, 0x20,
178 0xd3, 0x0f, 0x7e, 0x5d, 0x10, 0x33, 0x57, 0x24,
179 0x00, 0x15, 0x00, 0x04, 0x00, 0x6e, 0x90, 0x58,
180 0x61, 0x2a, 0xd2, 0xc2, 0x1e, 0x08, 0xea, 0x91,
181 0xcb, 0x44, 0x66, 0x73, 0x29, 0x92, 0x29, 0x59,
182 0x91, 0xa3, 0x4d, 0x2c, 0xbb, 0x00, 0x00, 0x00,
183 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
184 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
185 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
186 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
187 0x00, 0x15, 0x00, 0x04, 0x90, 0x00, 0x14, 0x00,
188 0xa1, 0x02, 0x50, 0x1b, 0xf0, 0x01, 0x0d, 0x32,
189 0xee, 0x28, 0xa4, 0x5a, 0x7f, 0x56, 0x5b, 0x28,
190 0xfd, 0x1f, 0x48, 0x00, 0x00, 0x00, 0x00, 0x00,
191 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
192 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
193 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
194 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
195 0x00, 0x15, 0x00, 0x04, 0x90, 0x00, 0xc5, 0x00,
196 0xa5, 0x06, 0xa3, 0x62, 0x69, 0x64, 0x58, 0x20,
197 0xe4, 0xe1, 0x06, 0x31, 0xde, 0x00, 0x0f, 0x4f,
198 0x12, 0x6e, 0xc9, 0x68, 0x2d, 0x43, 0x3f, 0xf1,
199 0x02, 0x2c, 0x6e, 0xe6, 0x96, 0x10, 0xbf, 0x73,
200 0x35, 0xc9, 0x20, 0x27, 0x06, 0xba, 0x39, 0x09,
201 0x64, 0x6e, 0x61, 0x6d, 0x65, 0x6a, 0x62, 0x6f,
202 0x62, 0x20, 0x62, 0x61, 0x6e, 0x61, 0x6e, 0x61,
203 0x00, 0x15, 0x00, 0x04, 0x00, 0x6b, 0x64, 0x69,
204 0x73, 0x70, 0x6c, 0x61, 0x79, 0x4e, 0x61, 0x6d,
205 0x65, 0x67, 0x62, 0x62, 0x61, 0x6e, 0x61, 0x6e,
206 0x61, 0x07, 0xa2, 0x62, 0x69, 0x64, 0x50, 0x19,
207 0xf7, 0x78, 0x0c, 0xa0, 0xbc, 0xb9, 0xa6, 0xd5,
208 0x1e, 0xd7, 0x87, 0xfb, 0x6c, 0x80, 0x03, 0x64,
209 0x74, 0x79, 0x70, 0x65, 0x6a, 0x70, 0x75, 0x62,
210 0x6c, 0x69, 0x63, 0x2d, 0x6b, 0x65, 0x79, 0x08,
211 0x00, 0x15, 0x00, 0x04, 0x01, 0xa5, 0x01, 0x02,
212 0x03, 0x26, 0x20, 0x01, 0x21, 0x58, 0x20, 0x81,
213 0x6c, 0xdd, 0x8c, 0x8f, 0x8c, 0xc8, 0x43, 0xa7,
214 0xbb, 0x79, 0x51, 0x09, 0xb1, 0xdf, 0xbe, 0xc4,
215 0xa5, 0x54, 0x16, 0x9e, 0x58, 0x56, 0xb3, 0x0b,
216 0x34, 0x4f, 0xa5, 0x6c, 0x05, 0xa2, 0x21, 0x22,
217 0x58, 0x20, 0xcd, 0xc2, 0x0c, 0x99, 0x83, 0x5a,
218 0x61, 0x73, 0xd8, 0xe0, 0x74, 0x23, 0x46, 0x64,
219 0x00, 0x15, 0x00, 0x04, 0x02, 0x39, 0x4c, 0xb0,
220 0xf4, 0x6c, 0x0a, 0x37, 0x72, 0xaa, 0xa8, 0xea,
221 0x58, 0xd3, 0xd4, 0xe0, 0x51, 0xb2, 0x28, 0x09,
222 0x05, 0x0a, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
223 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
224 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
225 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
226 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
227 0x00, 0x15, 0x00, 0x04, 0x90, 0x00, 0xa0, 0x00,
228 0xa4, 0x06, 0xa3, 0x62, 0x69, 0x64, 0x58, 0x20,
229 0x56, 0xa1, 0x3c, 0x06, 0x2b, 0xad, 0xa2, 0x21,
230 0x7d, 0xcd, 0x91, 0x08, 0x47, 0xa8, 0x8a, 0x06,
231 0x06, 0xf6, 0x66, 0x91, 0xf6, 0xeb, 0x89, 0xe4,
232 0xdf, 0x26, 0xbc, 0x46, 0x59, 0xc3, 0x7d, 0xc0,
233 0x64, 0x6e, 0x61, 0x6d, 0x65, 0x6a, 0x62, 0x6f,
234 0x62, 0x20, 0x62, 0x61, 0x6e, 0x61, 0x6e, 0x61,
235 0x00, 0x15, 0x00, 0x04, 0x00, 0x6b, 0x64, 0x69,
236 0x73, 0x70, 0x6c, 0x61, 0x79, 0x4e, 0x61, 0x6d,
237 0x65, 0x67, 0x62, 0x62, 0x61, 0x6e, 0x61, 0x6e,
238 0x61, 0x07, 0xa2, 0x62, 0x69, 0x64, 0x50, 0xd8,
239 0x27, 0x4b, 0x25, 0xed, 0x19, 0xef, 0x11, 0xaf,
240 0xa6, 0x89, 0x7b, 0x84, 0x50, 0xe7, 0x62, 0x64,
241 0x74, 0x79, 0x70, 0x65, 0x6a, 0x70, 0x75, 0x62,
242 0x6c, 0x69, 0x63, 0x2d, 0x6b, 0x65, 0x79, 0x08,
243 0x00, 0x15, 0x00, 0x04, 0x01, 0xa4, 0x01, 0x01,
244 0x03, 0x27, 0x20, 0x06, 0x21, 0x58, 0x20, 0x8d,
245 0xfe, 0x45, 0xd5, 0x7d, 0xb6, 0x17, 0xab, 0x86,
246 0x2d, 0x32, 0xf6, 0x85, 0xf0, 0x92, 0x76, 0xb7,
247 0xce, 0x73, 0xca, 0x4e, 0x0e, 0xfd, 0xd5, 0xdb,
248 0x2a, 0x1d, 0x55, 0x90, 0x96, 0x52, 0xc2, 0x0a,
249 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
250 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
251 0x00, 0x15, 0x00, 0x04, 0x90, 0x00, 0xa0, 0x00,
252 0xa4, 0x06, 0xa3, 0x62, 0x69, 0x64, 0x58, 0x20,
253 0x04, 0x0e, 0x0f, 0xa0, 0xcd, 0x60, 0x35, 0x9a,
254 0xba, 0x47, 0x0c, 0x10, 0xb6, 0x82, 0x6e, 0x2f,
255 0x66, 0xb9, 0xa7, 0xcf, 0xd8, 0x47, 0xb4, 0x3d,
256 0xfd, 0x77, 0x1a, 0x38, 0x22, 0xa1, 0xda, 0xa5,
257 0x64, 0x6e, 0x61, 0x6d, 0x65, 0x6a, 0x62, 0x6f,
258 0x62, 0x20, 0x62, 0x61, 0x6e, 0x61, 0x6e, 0x61,
259 0x00, 0x15, 0x00, 0x04, 0x00, 0x6b, 0x64, 0x69,
260 0x73, 0x70, 0x6c, 0x61, 0x79, 0x4e, 0x61, 0x6d,
261 0x65, 0x67, 0x62, 0x62, 0x61, 0x6e, 0x61, 0x6e,
262 0x61, 0x07, 0xa2, 0x62, 0x69, 0x64, 0x50, 0x00,
263 0x5d, 0xdf, 0xef, 0xe2, 0xf3, 0x06, 0xb2, 0xa5,
264 0x46, 0x4d, 0x98, 0xbc, 0x14, 0x65, 0xc1, 0x64,
265 0x74, 0x79, 0x70, 0x65, 0x6a, 0x70, 0x75, 0x62,
266 0x6c, 0x69, 0x63, 0x2d, 0x6b, 0x65, 0x79, 0x08,
267 0x00, 0x15, 0x00, 0x04, 0x01, 0xa4, 0x01, 0x01,
268 0x03, 0x27, 0x20, 0x06, 0x21, 0x58, 0x20, 0x72,
269 0x79, 0x14, 0x69, 0xdf, 0xcb, 0x64, 0x75, 0xee,
270 0xd4, 0x45, 0x94, 0xbc, 0x48, 0x4d, 0x2a, 0x9f,
271 0xc9, 0xf4, 0xb5, 0x1b, 0x05, 0xa6, 0x5b, 0x54,
272 0x9a, 0xac, 0x6c, 0x2e, 0xc6, 0x90, 0x62, 0x0a,
273 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
274 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
275 0x00, 0x15, 0x00, 0x04, 0x90, 0x00, 0xc3, 0x00,
276 0xa4, 0x06, 0xa3, 0x62, 0x69, 0x64, 0x58, 0x20,
277 0xce, 0x32, 0xd8, 0x79, 0xdd, 0x86, 0xa2, 0x42,
278 0x7c, 0xc3, 0xe1, 0x95, 0x12, 0x93, 0x1a, 0x03,
279 0xe6, 0x70, 0xb8, 0xff, 0xcd, 0xa5, 0xdf, 0x15,
280 0xfc, 0x88, 0x2a, 0xf5, 0x44, 0xf1, 0x33, 0x9c,
281 0x64, 0x6e, 0x61, 0x6d, 0x65, 0x6a, 0x62, 0x6f,
282 0x62, 0x20, 0x62, 0x61, 0x6e, 0x61, 0x6e, 0x61,
283 0x00, 0x15, 0x00, 0x04, 0x00, 0x6b, 0x64, 0x69,
284 0x73, 0x70, 0x6c, 0x61, 0x79, 0x4e, 0x61, 0x6d,
285 0x65, 0x67, 0x62, 0x62, 0x61, 0x6e, 0x61, 0x6e,
286 0x61, 0x07, 0xa2, 0x62, 0x69, 0x64, 0x50, 0x0a,
287 0x26, 0x5b, 0x7e, 0x1a, 0x2a, 0xba, 0x70, 0x5f,
288 0x18, 0x26, 0x14, 0xb2, 0x71, 0xca, 0x98, 0x64,
289 0x74, 0x79, 0x70, 0x65, 0x6a, 0x70, 0x75, 0x62,
290 0x6c, 0x69, 0x63, 0x2d, 0x6b, 0x65, 0x79, 0x08,
291 0x00, 0x15, 0x00, 0x04, 0x01, 0xa5, 0x01, 0x02,
292 0x03, 0x26, 0x20, 0x01, 0x21, 0x58, 0x20, 0x8b,
293 0x48, 0xf0, 0x69, 0xfb, 0x22, 0xfb, 0xf3, 0x86,
294 0x57, 0x7c, 0xdd, 0x82, 0x2c, 0x1c, 0x0c, 0xdc,
295 0x27, 0xe2, 0x6a, 0x4c, 0x1a, 0x10, 0x04, 0x27,
296 0x51, 0x3e, 0x2a, 0x9d, 0x3a, 0xb6, 0xb5, 0x22,
297 0x58, 0x20, 0x70, 0xfe, 0x91, 0x67, 0x64, 0x53,
298 0x63, 0x83, 0x72, 0x31, 0xe9, 0xe5, 0x20, 0xb7,
299 0x00, 0x15, 0x00, 0x04, 0x02, 0xee, 0xc9, 0xfb,
300 0x63, 0xd7, 0xe4, 0x76, 0x39, 0x80, 0x82, 0x74,
301 0xb8, 0xfa, 0x67, 0xf5, 0x1b, 0x8f, 0xe0, 0x0a,
302 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
303 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
304 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
305 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
306 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
307 0x00, 0x15, 0x00, 0x04, 0x90, 0x00, 0xc3, 0x00,
308 0xa4, 0x06, 0xa3, 0x62, 0x69, 0x64, 0x58, 0x20,
309 0xf9, 0xa3, 0x67, 0xbf, 0x5e, 0x80, 0x95, 0xdb,
310 0x4c, 0xc5, 0x8f, 0x65, 0x36, 0xc5, 0xaf, 0xdd,
311 0x90, 0x2e, 0x62, 0x68, 0x67, 0x9c, 0xa2, 0x26,
312 0x2f, 0x2a, 0xf9, 0x3a, 0xda, 0x15, 0xf2, 0x27,
313 0x64, 0x6e, 0x61, 0x6d, 0x65, 0x6a, 0x62, 0x6f,
314 0x62, 0x20, 0x62, 0x61, 0x6e, 0x61, 0x6e, 0x61,
315 0x00, 0x15, 0x00, 0x04, 0x00, 0x6b, 0x64, 0x69,
316 0x73, 0x70, 0x6c, 0x61, 0x79, 0x4e, 0x61, 0x6d,
317 0x65, 0x67, 0x62, 0x62, 0x61, 0x6e, 0x61, 0x6e,
318 0x61, 0x07, 0xa2, 0x62, 0x69, 0x64, 0x50, 0xfb,
319 0xa6, 0xbe, 0xc1, 0x01, 0xf6, 0x7a, 0x81, 0xf9,
320 0xcd, 0x6d, 0x20, 0x41, 0x7a, 0x1c, 0x40, 0x64,
321 0x74, 0x79, 0x70, 0x65, 0x6a, 0x70, 0x75, 0x62,
322 0x6c, 0x69, 0x63, 0x2d, 0x6b, 0x65, 0x79, 0x08,
323 0x00, 0x15, 0x00, 0x04, 0x01, 0xa5, 0x01, 0x02,
324 0x03, 0x26, 0x20, 0x01, 0x21, 0x58, 0x20, 0xda,
325 0x2b, 0x53, 0xc3, 0xbe, 0x48, 0xf8, 0xab, 0xbd,
326 0x06, 0x28, 0x46, 0xfa, 0x35, 0xab, 0xf9, 0xc5,
327 0x2e, 0xfd, 0x3c, 0x38, 0x88, 0xb3, 0xe1, 0xa7,
328 0xc5, 0xc6, 0xed, 0x72, 0x54, 0x37, 0x93, 0x22,
329 0x58, 0x20, 0x12, 0x82, 0x32, 0x2d, 0xab, 0xbc,
330 0x64, 0xb3, 0xed, 0xcc, 0xd5, 0x22, 0xec, 0x79,
331 0x00, 0x15, 0x00, 0x04, 0x02, 0x4b, 0xe2, 0x4d,
332 0x0c, 0x4b, 0x8d, 0x31, 0x4c, 0xb4, 0x0f, 0xd4,
333 0xa9, 0xbe, 0x0c, 0xab, 0x9e, 0x0a, 0xc9, 0x0a,
334 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
335 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
336 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
337 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
338 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
339};
340
341/*
342 * Collection of HID reports from an authenticator issued with a FIDO2
343 * 'deleteCredential' credential management command.
344 */
345static const uint8_t dummy_del_wire_data[] = {
346 0xff, 0xff, 0xff, 0xff, 0x86, 0x00, 0x11, 0x8b,
347 0xe1, 0xf0, 0x3a, 0x18, 0xa5, 0xda, 0x59, 0x00,
348 0x15, 0x00, 0x05, 0x02, 0x00, 0x04, 0x05, 0x05,
349 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
350 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
351 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
352 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
353 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
354 0x00, 0x15, 0x00, 0x05, 0x90, 0x00, 0x51, 0x00,
355 0xa1, 0x01, 0xa5, 0x01, 0x02, 0x03, 0x38, 0x18,
356 0x20, 0x01, 0x21, 0x58, 0x20, 0x12, 0xc1, 0x81,
357 0x6b, 0x92, 0x6a, 0x56, 0x05, 0xfe, 0xdb, 0xab,
358 0x90, 0x2f, 0x57, 0x0b, 0x3d, 0x85, 0x3e, 0x3f,
359 0xbc, 0xe5, 0xd3, 0xb6, 0x86, 0xdf, 0x10, 0x43,
360 0xc2, 0xaf, 0x87, 0x34, 0x0e, 0x22, 0x58, 0x20,
361 0xd3, 0x0f, 0x7e, 0x5d, 0x10, 0x33, 0x57, 0x24,
362 0x00, 0x15, 0x00, 0x05, 0x00, 0x6e, 0x90, 0x58,
363 0x61, 0x2a, 0xd2, 0xc2, 0x1e, 0x08, 0xea, 0x91,
364 0xcb, 0x44, 0x66, 0x73, 0x29, 0x92, 0x29, 0x59,
365 0x91, 0xa3, 0x4d, 0x2c, 0xbb, 0x00, 0x00, 0x00,
366 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
367 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
368 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
369 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
370 0x00, 0x15, 0x00, 0x05, 0x90, 0x00, 0x14, 0x00,
371 0xa1, 0x02, 0x50, 0x33, 0xf1, 0x3b, 0xde, 0x1e,
372 0xa5, 0xd1, 0xbf, 0xf6, 0x5d, 0x63, 0xb6, 0xfc,
373 0xd2, 0x24, 0xe8, 0x00, 0x00, 0x00, 0x00, 0x00,
374 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
375 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
376 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
377 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
378 0x00, 0x15, 0x00, 0x05, 0x90, 0x00, 0x01, 0x00,
379 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
380 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
381 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
382 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
383 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
384 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
385 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
386};
387
388int LLVMFuzzerTestOneInput(const uint8_t *, size_t);
389size_t LLVMFuzzerCustomMutator(uint8_t *, size_t, size_t, unsigned int);
390
391static int
392unpack(const uint8_t *ptr, size_t len, struct param *p) NO_MSAN
393{
394 uint8_t **pp = (void *)&ptr;
395
396 if (unpack_string(TAG_PIN, pp, &len, p->pin) < 0 ||
397 unpack_string(TAG_RP_ID, pp, &len, p->rp_id) < 0 ||
398 unpack_blob(TAG_CRED_ID, pp, &len, &p->cred_id) < 0 ||
399 unpack_blob(TAG_META_WIRE_DATA, pp, &len, &p->meta_wire_data) < 0 ||
400 unpack_blob(TAG_RP_WIRE_DATA, pp, &len, &p->rp_wire_data) < 0 ||
401 unpack_blob(TAG_RK_WIRE_DATA, pp, &len, &p->rk_wire_data) < 0 ||
402 unpack_blob(TAG_DEL_WIRE_DATA, pp, &len, &p->del_wire_data) < 0 ||
403 unpack_int(TAG_SEED, pp, &len, &p->seed) < 0)
404 return (-1);
405
406 return (0);
407}
408
409static size_t
410pack(uint8_t *ptr, size_t len, const struct param *p)
411{
412 const size_t max = len;
413
414 if (pack_string(TAG_PIN, &ptr, &len, p->pin) < 0 ||
415 pack_string(TAG_RP_ID, &ptr, &len, p->rp_id) < 0 ||
416 pack_blob(TAG_CRED_ID, &ptr, &len, &p->cred_id) < 0 ||
417 pack_blob(TAG_META_WIRE_DATA, &ptr, &len, &p->meta_wire_data) < 0 ||
418 pack_blob(TAG_RP_WIRE_DATA, &ptr, &len, &p->rp_wire_data) < 0 ||
419 pack_blob(TAG_RK_WIRE_DATA, &ptr, &len, &p->rk_wire_data) < 0 ||
420 pack_blob(TAG_DEL_WIRE_DATA, &ptr, &len, &p->del_wire_data) < 0 ||
421 pack_int(TAG_SEED, &ptr, &len, p->seed) < 0)
422 return (0);
423
424 return (max - len);
425}
426
427static fido_dev_t *
428prepare_dev()
429{
430 fido_dev_t *dev;
431 fido_dev_io_t io;
432
433 io.open = dev_open;
434 io.close = dev_close;
435 io.read = dev_read;
436 io.write = dev_write;
437
438 if ((dev = fido_dev_new()) == NULL || fido_dev_set_io_functions(dev,
439 &io) != FIDO_OK || fido_dev_open(dev, "nodev") != FIDO_OK) {
440 fido_dev_free(&dev);
441 return (NULL);
442 }
443
444 return (dev);
445}
446
447static void
448get_metadata(struct param *p)
449{
450 fido_dev_t *dev;
451 fido_credman_metadata_t *metadata;
452 uint64_t existing;
453 uint64_t remaining;
454
455 set_wire_data(p->meta_wire_data.body, p->meta_wire_data.len);
456
457 if ((dev = prepare_dev()) == NULL) {
458 return;
459 }
460 if ((metadata = fido_credman_metadata_new()) == NULL) {
461 fido_dev_close(dev);
462 fido_dev_free(&dev);
463 return;
464 }
465
466 fido_credman_get_dev_metadata(dev, metadata, p->pin);
467
468 existing = fido_credman_rk_existing(metadata);
469 remaining = fido_credman_rk_remaining(metadata);
470 consume(&existing, sizeof(existing));
471 consume(&remaining, sizeof(remaining));
472
473 fido_credman_metadata_free(&metadata);
474 fido_dev_close(dev);
475 fido_dev_free(&dev);
476}
477
478static void
479get_rp_list(struct param *p)
480{
481 fido_dev_t *dev;
482 fido_credman_rp_t *rp;
483
484 set_wire_data(p->rp_wire_data.body, p->rp_wire_data.len);
485
486 if ((dev = prepare_dev()) == NULL) {
487 return;
488 }
489 if ((rp = fido_credman_rp_new()) == NULL) {
490 fido_dev_close(dev);
491 fido_dev_free(&dev);
492 return;
493 }
494
495 fido_credman_get_dev_rp(dev, rp, p->pin);
496
497 /* +1 on purpose */
498 for (size_t i = 0; i < fido_credman_rp_count(rp) + 1; i++) {
499 consume(fido_credman_rp_id_hash_ptr(rp, i),
500 fido_credman_rp_id_hash_len(rp, i));
501 consume(fido_credman_rp_id(rp, i),
502 xstrlen(fido_credman_rp_id(rp, i)));
503 consume(fido_credman_rp_name(rp, i),
504 xstrlen(fido_credman_rp_name(rp, i)));
505 }
506
507 fido_credman_rp_free(&rp);
508 fido_dev_close(dev);
509 fido_dev_free(&dev);
510}
511
512static void
513get_rk_list(struct param *p)
514{
515 fido_dev_t *dev;
516 fido_credman_rk_t *rk;
517 const fido_cred_t *cred;
518 int type;
519
520 set_wire_data(p->rk_wire_data.body, p->rk_wire_data.len);
521
522 if ((dev = prepare_dev()) == NULL) {
523 return;
524 }
525 if ((rk = fido_credman_rk_new()) == NULL) {
526 fido_dev_close(dev);
527 fido_dev_free(&dev);
528 return;
529 }
530
531 fido_credman_get_dev_rk(dev, p->rp_id, rk, p->pin);
532
533 /* +1 on purpose */
534 for (size_t i = 0; i < fido_credman_rk_count(rk) + 1; i++) {
535 if ((cred = fido_credman_rk(rk, i)) == NULL) {
536 assert(i >= fido_credman_rk_count(rk));
537 continue;
538 }
539 type = fido_cred_type(cred);
540 consume(&type, sizeof(type));
541 consume(fido_cred_id_ptr(cred), fido_cred_id_len(cred));
542 consume(fido_cred_pubkey_ptr(cred), fido_cred_pubkey_len(cred));
543 consume(fido_cred_user_id_ptr(cred),
544 fido_cred_user_id_len(cred));
545 consume(fido_cred_user_name(cred),
546 xstrlen(fido_cred_user_name(cred)));
547 consume(fido_cred_display_name(cred),
548 xstrlen(fido_cred_display_name(cred)));
549 }
550
551 fido_credman_rk_free(&rk);
552 fido_dev_close(dev);
553 fido_dev_free(&dev);
554}
555
556static void
557del_rk(struct param *p)
558{
559 fido_dev_t *dev;
560
561 set_wire_data(p->del_wire_data.body, p->del_wire_data.len);
562
563 if ((dev = prepare_dev()) == NULL) {
564 return;
565 }
566
567 fido_credman_del_dev_rk(dev, p->cred_id.body, p->cred_id.len, p->pin);
568 fido_dev_close(dev);
569 fido_dev_free(&dev);
570}
571
572int
573LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
574{
575 struct param p;
576
577 memset(&p, 0, sizeof(p));
578
579 if (unpack(data, size, &p) < 0)
580 return (0);
581
582 srandom((unsigned int)p.seed);
583
584 fido_init(0);
585
586 get_metadata(&p);
587 get_rp_list(&p);
588 get_rk_list(&p);
589 del_rk(&p);
590
591 return (0);
592}
593
594static size_t
595pack_dummy(uint8_t *ptr, size_t len)
596{
597 struct param dummy;
598 uint8_t blob[32768];
599 size_t blob_len;
600
601 memset(&dummy, 0, sizeof(dummy));
602
603 strlcpy(dummy.pin, dummy_pin, sizeof(dummy.pin));
604 strlcpy(dummy.rp_id, dummy_rp_id, sizeof(dummy.rp_id));
605
606 dummy.meta_wire_data.len = sizeof(dummy_meta_wire_data);
607 dummy.rp_wire_data.len = sizeof(dummy_rp_wire_data);
608 dummy.rk_wire_data.len = sizeof(dummy_rk_wire_data);
609 dummy.del_wire_data.len = sizeof(dummy_del_wire_data);
610 dummy.cred_id.len = sizeof(dummy_cred_id);
611
612 memcpy(&dummy.meta_wire_data.body, &dummy_meta_wire_data,
613 dummy.meta_wire_data.len);
614 memcpy(&dummy.rp_wire_data.body, &dummy_rp_wire_data,
615 dummy.rp_wire_data.len);
616 memcpy(&dummy.rk_wire_data.body, &dummy_rk_wire_data,
617 dummy.rk_wire_data.len);
618 memcpy(&dummy.del_wire_data.body, &dummy_del_wire_data,
619 dummy.del_wire_data.len);
620 memcpy(&dummy.cred_id.body, &dummy_cred_id, dummy.cred_id.len);
621
622 blob_len = pack(blob, sizeof(blob), &dummy);
623 assert(blob_len != 0);
624
625 if (blob_len > len) {
626 memcpy(ptr, blob, len);
627 return (len);
628 }
629
630 memcpy(ptr, blob, blob_len);
631
632 return (blob_len);
633}
634
635size_t
636LLVMFuzzerCustomMutator(uint8_t *data, size_t size, size_t maxsize,
637 unsigned int seed) NO_MSAN
638{
639 struct param p;
640 uint8_t blob[16384];
641 size_t blob_len;
642
643 memset(&p, 0, sizeof(p));
644
645 if (unpack(data, size, &p) < 0)
646 return (pack_dummy(data, maxsize));
647
648 p.seed = (int)seed;
649
650 mutate_blob(&p.cred_id);
651 mutate_blob(&p.meta_wire_data);
652 mutate_blob(&p.rp_wire_data);
653 mutate_blob(&p.rk_wire_data);
654 mutate_blob(&p.del_wire_data);
655
656 mutate_string(p.pin);
657 mutate_string(p.rp_id);
658
659 blob_len = pack(blob, sizeof(blob), &p);
660
661 if (blob_len == 0 || blob_len > maxsize)
662 return (0);
663
664 memcpy(data, blob, blob_len);
665
666 return (blob_len);
667}
generated by cgit v1.2.3 (git 2.39.1) at 2024-05-06 06:28:00 +0000