2 Commits

Author	SHA1	Message	Date
Marc Schier	f5ad124891	Additional fuzzing plus fixes for every defect the campaigns found (#4459) ... # Description Brings the stack's fuzz testing to parity with the fork (`aio-opcua-sdk`), then fixes every defect the resulting campaigns exposed. The fork's fuzzing was used as the behavioural baseline: all **28 fork-local callbacks** and **13 OneFuzz registrations** are now accounted for by an explicit mapping, not just by a larger target count. The work extends the existing SharpFuzz/NUnit infrastructure rather than introducing another framework. ### Coverage - **84 continuous libFuzzer targets** and **81 AFL adapters** across Encoders, Certificates, Network and PubSub. - **PubSub area integrated** (Corpus/Tools/Tests siblings, solution entries) — it previously had host source only and was absent from the solution and replay infrastructure. - Segmented binary adapters, binary-to-JSON and XML-to-JSON conversions, standalone certificate loading, both chain-parser variants, CRL encoding and canonical TBS round-trips. - The 12 original fork message inputs are retained byte-identically alongside richer deterministic generators; the three historical crash/slow/timeout reproducers are unchanged (verified identical by SHA-256). ### Production fixes found by fuzzing These are real robustness and data-integrity bugs, each with a retained regression input: - `UadpBinaryReader.Advance` accepted attacker-controlled lengths on the receive path. Declared payload sizes are now authoritative bounded sections, with negative-count rejection and overflow-safe reassembly arithmetic. - PubSub JSON decoding leaked `InvalidOperationException` for invalid UTF-8. - `JsonEncoder.WriteExtensionObject` leaked `System.Text.Json.JsonReaderException`. - `JsonEncoder` silently emitted a lossy `{}` for an `ExtensionObject` whose TypeId could not be represented in JSON. - `JsonDecoder` wrapped a bodyless `ExtensionObject` envelope as a raw JSON body instead of preserving `ExtensionObjectEncoding.None`. - `Node.Encode` lost the null/empty collection distinction. - Binary/XML Variant matrix dimensions are prevalidated rather than relying on a caught `ArgumentException`. - `X509CRL.ReadTime` pre-validates strict RFC 5280 whole-second Zulu time forms. - `Utils.ParseCertificateChainBlob` disposes correctly on partial-chain failure. - **`nodeid.dict` was unloadable by libFuzzer** (empty token, unescaped quote). libFuzzer rejects the whole file on one bad line, so four parser targets silently executed **zero** inputs. Fixed and now guarded by dictionary validation. ### Infrastructure - `fuzzing/fuzz-targets.json` manifest recording adapters, corpora, dictionaries, oracles and fork-behaviour mappings, with `validate-fuzz-manifest.ps1` and **27 negative controls**. - Strict host/tools discovery and replay: `--list`, `--replay`, non-zero exits on unknown targets, missing or empty corpora, and failed callbacks (playback previously logged failures and returned success). - A real process watchdog for the timeout/slow regressions — NUnit `CancelAfter` cannot interrupt a synchronous fuzz callback. - Runner scripts made non-destructive (unique work directories, no generic `bin`/findings deletion) and corrected to the native driver's single-`--target_arg` apphost contract. - Opt-in `OneFuzz=true` class-library publication producing a relocatable, **uninstrumented** drop, validated by exact callback discovery, dependency closure, corpora and dictionaries. - CI: fuzz replay matrix plus a public drop gate, triggered by corpus-, dictionary- and script-only changes. ### Verification | Gate | Result | |---|---| | Bounded campaigns, all 84 targets (1,000 inputs, seed 1) | 84/84, 84,000 executions, zero findings | | OneFuzz drop | 84/84 published callbacks replayed, zero skips | | Fuzz replay net10.0 / net8.0 / net9.0 | 9,470 passed each, 0 failed | | Fuzz replay net48 | 8,996 passed, 0 failed (Network/PubSub are modern-only) | | `Opc.Ua.Types.Tests` / `Opc.Ua.Core.Tests` | 9,800 and 4,442 passed, 0 failed | | Retained regression assets | 132 `crash-*` inputs replayed by every target each run | ### Known gaps (deliberately not closed) - **Fidelity is not enforced against the pipeline crash corpus.** The differential binary-to-JSON targets assert both robustness (no unhandled exception, expected of arbitrary bytes) and fidelity (a decoded value re-encodes equivalently, a property of well formed values). The pipeline supplies 22,293 blobs collected for the targets that existed before this PR, none of which asserted fidelity; 522 of them violate it, and that count did not move across two rounds of genuine fixes because each fix only lets the mutator reach the next representability gap. Rather than weaken the assertion, the two contracts are separated: fidelity failures raise `EncodingFidelityException`; curated assets under `Assets/Repo`, the curated `Testcases` corpus and every continuous libFuzzer campaign stay strictly enforced, while externally supplied assets are gated on robustness only and their fidelity findings are reported with counts and bounded base64 reproducers. - **Internal MSFT OneFuzz canary has not been run.** It needs an owner-supplied ownership profile, pipeline authorisation and corpus snapshot; none were available. The drop builds and validates locally and records `serviceCanaryPerformed: false`. A build or upload is not a successful worker run. - **Legacy JSON wire forms are a partial mapping.** The fork accepts its four original `TypeId`/`Body` messages; this stack rejects that retired envelope (measured JSON-only control: fork `JsonEncoder` 630/1356 lines vs 0/1007 here). Recorded as an explicit unresolved mapping rather than an exemption. `LegacyNonReversible` is a RawData-derived profile and is not counted as independent coverage. ## Related Issues _No tracking issue was supplied for this work; happy to open one and link it if maintainers prefer._ - Fixes #github-issue-number, ... ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [x] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [ ] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [ ] I have addressed **all** PR feedback received. > Note on the checklist: the fuzz replay matrix, `Opc.Ua.Types.Tests` and `Opc.Ua.Core.Tests` were run locally on **net48** and **net10.0** (plus net8.0/net9.0) and all passed. CI and CodeQL results are not yet available for this branch, so those boxes are left unchecked. The CLA box is for the author to confirm.	2026-09-10 05:56:31 +02:00
Marc Schier	7cec2d614d	Move repository files to the consolidated layout	2026-07-16 06:25:54 +02:00