/* ========================================================================
* Copyright (c) 2005-2025 The OPC Foundation, Inc. All rights reserved.
*
* OPC Foundation MIT License 1.00
*
* Permission is hereby granted, free of charge, to any person
* obtaining a copy of this software and associated documentation
* files (the "Software"), to deal in the Software without
* restriction, including without limitation the rights to use,
* copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the
* Software is furnished to do so, subject to the following
* conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
* OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
* HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
* OTHER DEALINGS IN THE SOFTWARE.
*
* The complete license agreement can be found here:
* http://opcfoundation.org/License/MIT/1.00/
* ======================================================================*/
using System;
using System.IO;
using System.Text.Json;
using System.Xml;
using Microsoft.Extensions.Logging.Abstractions;
using Opc.Ua.Bindings;
namespace Opc.Ua.Fuzzing
{
public static partial class FuzzableCode
{
public static ServiceMessageContext MessageContext { get; } =
CreateMessageContext();
///
/// Print information about the fuzzer target.
///
public static void FuzzInfo()
{
Console.WriteLine("OPC UA Core Encoder Fuzzer for afl-fuzz and libfuzzer.");
Console.WriteLine("Fuzzing targets for various aspects of the Binary, Json and Xml encoders.");
}
internal static MemoryStream PrepareArraySegmentStream(ReadOnlySpan input, int segmentSize = 0x40)
{
if (segmentSize <= 0)
{
throw new ArgumentOutOfRangeException(nameof(segmentSize));
}
var buffers = new BufferCollection();
while (!input.IsEmpty)
{
int length = Math.Min(input.Length, segmentSize);
buffers.Add(new ArraySegment(input[..length].ToArray()));
input = input[length..];
}
if (buffers.Count == 0)
{
buffers.Add(new ArraySegment(Array.Empty()));
}
return new ArraySegmentStream(buffers);
}
internal static ServiceMessageContext CreateMessageContext()
{
ServiceMessageContext context = ServiceMessageContext.Create(new FuzzTelemetryContext());
context.NamespaceUris.Append("urn:opcfoundation:fuzzing:application");
context.NamespaceUris.Append("urn:opcfoundation:fuzzing:devices");
context.NamespaceUris.Append("urn:opcfoundation:fuzzing:diagnostics");
context.NamespaceUris.Append("urn:opcfoundation:fuzzing:types");
context.ServerUris.Append("urn:opcfoundation:fuzzing:server");
// Limits a mutated input of a few KB can exceed, so the limit oracle can observe a
// decoder that does not enforce them (the defaults need 64 KB strings). Every seed
// stays well within them.
context.MaxStringLength = FuzzMaxStringLength;
context.MaxByteStringLength = FuzzMaxByteStringLength;
context.MaxArrayLength = FuzzMaxArrayLength;
// Decimal is not in the default factory, so an ExtensionObject Decimal body is kept
// raw and never decoded. Register it so the targets exercise Decimal.Decode, which
// the T1-3 octet cap guards (OPC 10000-6 5.1.10).
context.Factory.AddEncodeableType(typeof(Decimal));
return context;
}
internal const int FuzzMaxStringLength = 4096;
internal const int FuzzMaxByteStringLength = 8192;
internal const int FuzzMaxArrayLength = 4096;
///
/// Runs a decode under the allocation oracle and checks the decoded value against the
/// limits of .
///
internal static T DecodeWithOracles(string decoder, long inputLength, Func decode)
{
T value = FuzzOracles.MeasureAllocation(decoder, inputLength, decode);
FuzzOracles.CheckDecodedLimits(value!, MessageContext, decoder);
return value;
}
private static long GetRemainingLength(Stream stream)
{
return stream.CanSeek ? stream.Length - stream.Position : -1;
}
///
/// Prepare a seekable memory stream from the input stream.
///
private static MemoryStream PrepareArraySegmentStream(Stream stream)
{
const int segmentSize = 0x40;
// AFL stdin is non-seekable; separate buffers also exercise chunk boundaries.
MemoryStream memoryStream;
using (var binaryStream = new BinaryReader(stream))
{
var bufferCollection = new BufferCollection();
byte[] buffer;
do
{
buffer = binaryStream.ReadBytes(segmentSize);
bufferCollection.Add(new ArraySegment(buffer));
} while (buffer.Length == segmentSize);
memoryStream = new ArraySegmentStream(bufferCollection);
}
return memoryStream;
}
private static bool IsExpectedDecodingError(ServiceResultException exception)
{
if (exception.StatusCode != StatusCodes.BadDecodingError &&
exception.StatusCode != StatusCodes.BadEncodingLimitsExceeded)
{
return false;
}
return exception.InnerException switch
{
null or EndOfStreamException or XmlException or JsonException or FormatException => true,
ServiceResultException inner => IsExpectedDecodingError(inner),
_ => false
};
}
private sealed class FuzzTelemetryContext : TelemetryContextBase
{
public FuzzTelemetryContext()
: base(NullLoggerFactory.Instance)
{
}
}
}
}