From 8aa82b337081b7a22c35dddad8d62fb1ca9ea884 Mon Sep 17 00:00:00 2001
From: Pauli <pauli@openssl.org>
Date: Fri, 4 Nov 2022 08:43:38 +1100
Subject: [PATCH] fuzz: add punycode decoder fuzz test

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/19591)
---
 fuzz/build.info                               |  10 +++++
 .../0000000000000000000000000000000000000000  | Bin 0 -> 132 bytes
 .../0000000000000000000000000000000000000001  | Bin 0 -> 18 bytes
 fuzz/fuzzer.h                                 |   3 ++
 fuzz/punycode.c                               |  42 ++++++++++++++++++
 include/crypto/punycode.h                     |   2 +
 6 files changed, 57 insertions(+)
 create mode 100644 fuzz/corpora/punycode/0000000000000000000000000000000000000000
 create mode 100644 fuzz/corpora/punycode/0000000000000000000000000000000000000001
 create mode 100644 fuzz/punycode.c

diff --git a/fuzz/build.info b/fuzz/build.info
index 7b26b8c152..7ba41a7a6e 100644
--- a/fuzz/build.info
+++ b/fuzz/build.info
@@ -10,6 +10,7 @@
 
 IF[{- !$disabled{"fuzz-afl"} || !$disabled{"fuzz-libfuzzer"} -}]
   PROGRAMS{noinst}=asn1 asn1parse bignum bndiv client conf crl server x509
+  PROGRAMS{noinst}=punycode
 
   IF[{- !$disabled{"cmp"} -}]
     PROGRAMS{noinst}=cmp
@@ -63,6 +64,10 @@ IF[{- !$disabled{"fuzz-afl"} || !$disabled{"fuzz-libfuzzer"} -}]
   INCLUDE[ct]=../include {- $ex_inc -}
   DEPEND[ct]=../libcrypto {- $ex_lib -}
 
+  SOURCE[punycode]=punycode.c driver.c
+  INCLUDE[punycode]=../include {- $ex_inc -}
+  DEPEND[punycode]=../libcrypto.a {- $ex_lib -}
+
   SOURCE[server]=server.c driver.c fuzz_rand.c
   INCLUDE[server]=../include {- $ex_inc -}
   DEPEND[server]=../libcrypto ../libssl {- $ex_lib -}
@@ -74,6 +79,7 @@ ENDIF
 
 IF[{- !$disabled{tests} -}]
   PROGRAMS{noinst}=asn1-test asn1parse-test bignum-test bndiv-test client-test conf-test crl-test server-test x509-test
+  PROGRAMS{noinst}=punycode-test
 
   IF[{- !$disabled{"cmp"} -}]
     PROGRAMS{noinst}=cmp-test
@@ -128,6 +134,10 @@ IF[{- !$disabled{tests} -}]
   INCLUDE[ct-test]=../include
   DEPEND[ct-test]=../libcrypto
 
+  SOURCE[punycode-test]=punycode.c test-corpus.c
+  INCLUDE[punycode-test]=../include
+  DEPEND[punycode-test]=../libcrypto.a
+
   SOURCE[server-test]=server.c test-corpus.c fuzz_rand.c
   INCLUDE[server-test]=../include
   DEPEND[server-test]=../libcrypto ../libssl
diff --git a/fuzz/corpora/punycode/0000000000000000000000000000000000000000 b/fuzz/corpora/punycode/0000000000000000000000000000000000000000
new file mode 100644
index 0000000000000000000000000000000000000000..36f766173434f4a11eaffce7edaf7d7cb6cabc10
GIT binary patch
literal 132
Rcmb=()74GXs~AX<0RU)tC!GKQ

literal 0
HcmV?d00001

diff --git a/fuzz/corpora/punycode/0000000000000000000000000000000000000001 b/fuzz/corpora/punycode/0000000000000000000000000000000000000001
new file mode 100644
index 0000000000000000000000000000000000000000..33abaeb3aa53e378813a96fd2a5b5f09c91ea8fe
GIT binary patch
literal 18
Qcmb=()74GXt3Z$p05#PGKmY&$

literal 0
HcmV?d00001

diff --git a/fuzz/fuzzer.h b/fuzz/fuzzer.h
index cd460dea8d..4d8b7b9a51 100644
--- a/fuzz/fuzzer.h
+++ b/fuzz/fuzzer.h
@@ -8,6 +8,9 @@
  * or in the file LICENSE in the source distribution.
  */
 
+#include <stdint.h>     /* for uint8_t */
+#include <stddef.h>     /* for size_t */
+
 int FuzzerTestOneInput(const uint8_t *buf, size_t len);
 int FuzzerInitialize(int *argc, char ***argv);
 void FuzzerCleanup(void);
diff --git a/fuzz/punycode.c b/fuzz/punycode.c
new file mode 100644
index 0000000000..76ae3dea0e
--- /dev/null
+++ b/fuzz/punycode.c
@@ -0,0 +1,42 @@
+/*
+ * Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include "crypto/punycode.h"
+#include "internal/nelem.h"
+#include <openssl/crypto.h>
+#include "fuzzer.h"
+
+#include <stdio.h>
+#include <string.h>
+
+int FuzzerInitialize(int *argc, char ***argv)
+{
+    return 1;
+}
+
+int FuzzerTestOneInput(const uint8_t *buf, size_t len)
+{
+    char *b;
+    unsigned int out[16], outlen = OSSL_NELEM(out);
+    char outc[16];
+
+    b = OPENSSL_malloc(len + 1);
+    if (b != NULL) {
+        ossl_punycode_decode((const char *)buf, len, out, &outlen);
+        memcpy(b, buf, len);
+        b[len] = '\0';
+        ossl_a2ulabel(b, outc, sizeof(outc));
+        OPENSSL_free(b);
+    }
+    return 0;
+}
+
+void FuzzerCleanup(void)
+{
+}
diff --git a/include/crypto/punycode.h b/include/crypto/punycode.h
index 1cc52c544a..e448dadbbd 100644
--- a/include/crypto/punycode.h
+++ b/include/crypto/punycode.h
@@ -11,6 +11,8 @@
 # define OSSL_CRYPTO_PUNYCODE_H
 # pragma once
 
+# include <stddef.h>     /* for size_t */
+
 int ossl_punycode_decode (
     const char *pEncoded,
     const size_t enc_len,