GithubStar/UA-.NETStandard
1
0
Fork 0
mirror of https://github.com/OPCFoundation/UA-.NETStandard.git synced 2026-10-18 22:55:08 +08:00
Code Issues Packages Projects Releases Wiki Activity

Network.Fuzz: drop IndexOutOfRangeException from IsExpected whitelist (audit follow-up #3)

Browse Source 
The Network area's IsExpected(...) helper in
Fuzzing/Opc.Ua.Network.Fuzz/FuzzableCode.cs swallowed
IndexOutOfRangeException as an "expected" parser-rejected-input outcome.
That category of exception almost always indicates a real out-of-bounds
read in the binding being fuzzed -- it is exactly the kind of bug fuzz
is meant to surface, not hide.

Fix: drop IndexOutOfRangeException from the whitelist. The remaining
whitelist (PcapDiagnosticsException, ServiceResultException,
CryptographicException, IOException, InvalidOperationException,
ArgumentException, OverflowException, FormatException) all represent
either documented parser rejections or stack-level error channels.

Added an inline comment documenting WHY IndexOutOfRangeException is
intentionally absent, so the security-relevant choice survives future
refactors.

Verified (net10.0): Opc.Ua.Network.Fuzz.Tests baseline preserved -
330/330 passed, 0 failed. No existing seed in the corpus triggers an
IndexOutOfRangeException through any Libfuzz target; the change is
purely defensive.

Audit ref: section 7.2 #3 of the security assessment doc.
This commit is contained in:
Marc Schier
2026-06-11 12:15:05 +02:00
parent 4e91884121
commit 80832f1706
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Fuzzing/Opc.Ua.Network.Fuzz/FuzzableCode.cs
+5 -1
View File
@@ -99,8 +99,12 @@ namespace Opc.Ua.Fuzzing
internal static bool IsExpected(Exception ex)
{
// IndexOutOfRangeException is intentionally NOT in this whitelist:
// an OOB read in the binding is a real bug that fuzz should surface,
// not swallow as an "expected" parser-rejected-input outcome
// (security audit recommendation §7.2 #3).
if (ex is PcapDiagnosticsException or ServiceResultException or CryptographicException or IOException or
InvalidOperationException or ArgumentException or IndexOutOfRangeException or OverflowException or
InvalidOperationException or ArgumentException or OverflowException or
FormatException)
{
return true;