/* ======================================================================== * Copyright (c) 2005-2025 The OPC Foundation, Inc. All rights reserved. * * OPC Foundation MIT License 1.00 * * Permission is hereby granted, free of charge, to any person * obtaining a copy of this software and associated documentation * files (the "Software"), to deal in the Software without * restriction, including without limitation the rights to use, * copy, modify, merge, publish, distribute, sublicense, and/or sell * copies of the Software, and to permit persons to whom the * Software is furnished to do so, subject to the following * conditions: * * The above copyright notice and this permission notice shall be * included in all copies or substantial portions of the Software. * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR * OTHER DEALINGS IN THE SOFTWARE. * * The complete license agreement can be found here: * http://opcfoundation.org/License/MIT/1.00/ * ======================================================================*/ using System; using System.IO; using System.Text.Json; using System.Xml; using Microsoft.Extensions.Logging.Abstractions; using Opc.Ua.Bindings; namespace Opc.Ua.Fuzzing { public static partial class FuzzableCode { public static ServiceMessageContext MessageContext { get; } = CreateMessageContext(); /// /// Print information about the fuzzer target. /// public static void FuzzInfo() { Console.WriteLine("OPC UA Core Encoder Fuzzer for afl-fuzz and libfuzzer."); Console.WriteLine("Fuzzing targets for various aspects of the Binary, Json and Xml encoders."); } internal static MemoryStream PrepareArraySegmentStream(ReadOnlySpan input, int segmentSize = 0x40) { if (segmentSize <= 0) { throw new ArgumentOutOfRangeException(nameof(segmentSize)); } var buffers = new BufferCollection(); while (!input.IsEmpty) { int length = Math.Min(input.Length, segmentSize); buffers.Add(new ArraySegment(input[..length].ToArray())); input = input[length..]; } if (buffers.Count == 0) { buffers.Add(new ArraySegment(Array.Empty())); } return new ArraySegmentStream(buffers); } internal static ServiceMessageContext CreateMessageContext() { ServiceMessageContext context = ServiceMessageContext.Create(new FuzzTelemetryContext()); context.NamespaceUris.Append("urn:opcfoundation:fuzzing:application"); context.NamespaceUris.Append("urn:opcfoundation:fuzzing:devices"); context.NamespaceUris.Append("urn:opcfoundation:fuzzing:diagnostics"); context.NamespaceUris.Append("urn:opcfoundation:fuzzing:types"); context.ServerUris.Append("urn:opcfoundation:fuzzing:server"); // Limits a mutated input of a few KB can exceed, so the limit oracle can observe a // decoder that does not enforce them (the defaults need 64 KB strings). Every seed // stays well within them. context.MaxStringLength = FuzzMaxStringLength; context.MaxByteStringLength = FuzzMaxByteStringLength; context.MaxArrayLength = FuzzMaxArrayLength; // Decimal is not in the default factory, so an ExtensionObject Decimal body is kept // raw and never decoded. Register it so the targets exercise Decimal.Decode, which // the T1-3 octet cap guards (OPC 10000-6 5.1.10). context.Factory.AddEncodeableType(typeof(Decimal)); return context; } internal const int FuzzMaxStringLength = 4096; internal const int FuzzMaxByteStringLength = 8192; internal const int FuzzMaxArrayLength = 4096; /// /// Runs a decode under the allocation oracle and checks the decoded value against the /// limits of . /// internal static T DecodeWithOracles(string decoder, long inputLength, Func decode) { T value = FuzzOracles.MeasureAllocation(decoder, inputLength, decode); FuzzOracles.CheckDecodedLimits(value!, MessageContext, decoder); return value; } private static long GetRemainingLength(Stream stream) { return stream.CanSeek ? stream.Length - stream.Position : -1; } /// /// Prepare a seekable memory stream from the input stream. /// private static MemoryStream PrepareArraySegmentStream(Stream stream) { const int segmentSize = 0x40; // AFL stdin is non-seekable; separate buffers also exercise chunk boundaries. MemoryStream memoryStream; using (var binaryStream = new BinaryReader(stream)) { var bufferCollection = new BufferCollection(); byte[] buffer; do { buffer = binaryStream.ReadBytes(segmentSize); bufferCollection.Add(new ArraySegment(buffer)); } while (buffer.Length == segmentSize); memoryStream = new ArraySegmentStream(bufferCollection); } return memoryStream; } private static bool IsExpectedDecodingError(ServiceResultException exception) { if (exception.StatusCode != StatusCodes.BadDecodingError && exception.StatusCode != StatusCodes.BadEncodingLimitsExceeded) { return false; } return exception.InnerException switch { null or EndOfStreamException or XmlException or JsonException or FormatException => true, ServiceResultException inner => IsExpectedDecodingError(inner), _ => false }; } private sealed class FuzzTelemetryContext : TelemetryContextBase { public FuzzTelemetryContext() : base(NullLoggerFactory.Instance) { } } } }