mirror of
https://github.com/OPCFoundation/UA-.NETStandard.git
synced 2026-10-18 14:43:08 +08:00
ae34b02938
# Description
Broadens fuzz coverage across the highest-value untrusted-input surfaces
in the stack, refactors the per-area scaffolding so adding a new fuzz
area is a copy-paste-replace operation, and integrates everything into
`UA.slnx`, `Fuzzing/Fuzzing.md`, and `Docs/README.md`.
**Totals**: 143 files, +4961 / −289. Source plan:
`plans/27-fuzzing-coverage-expansion.md` (added in this PR).
### Shared scaffolding (refactor, no behaviour change)
* Extract generic NUnit replay harness from
`Encoders/Fuzz.Tests/EncoderTests.cs` into
`Fuzzing/common/Fuzz.Tests/{FuzzTargetTestsBase,FuzzTargetFunction,TestcaseAsset,TestAssetUtils}.cs`.
* Each area's `Fuzz.Tests` becomes a thin subclass binding its own
`FuzzableCode` type.
* Hardcoded testcase-suffix arrays replaced with `Testcases.*` directory
discovery at runtime.
* New `Fuzzing/scripts/fuzz-menu.ps1`: dynamic target menu enumerating
`FuzzableCode` statics via reflection — no more hardcoded target lists
in `libfuzz.bat` / `aflfuzz.sh`.
### Encoders area hardening
* **Bug fix**: `AflfuzzXmlEncoder` was re-encoding via `JsonEncoder`;
now uses `XmlEncoder` (the `LibfuzzXmlEncoder` variant was already
correct).
* Add idempotent JSON / XML targets mirroring the existing Binary
idempotent pattern.
* Add compact-JSON encoder option coverage (`JsonEncoderOptions.None`
alongside `Verbose`).
* New `FuzzableCode.BuiltInTypes.cs` (48 targets): `NodeId`,
`ExpandedNodeId`, `Variant`, `ExtensionObject`, `DataValue`,
`DiagnosticInfo`, `QualifiedName`, `LocalizedText` × Binary/JSON/XML
decoders.
* Enrich `Encoders.Testcases.cs` seed corpus with `BrowseRequest` +
`WriteRequest`.
* New `Fuzzing/dictionaries/binary.dict`.
### String parsers (folded into Encoders area)
* New `FuzzableCode.Parsers.cs` (12 targets): `NodeId.Parse`,
`ExpandedNodeId.Parse`, `RelativePathFormatter.Parse`,
`QualifiedName.Parse`, `NumericRange.Parse`, `Uuid` round-trip (both
afl-string and libFuzzer-span signatures).
* New `Fuzzing/dictionaries/nodeid.dict`.
### Certificates / CRL / ASN.1 (NEW area)
* New `Fuzzing/Certificates/{Fuzz,Fuzz.Tests,Fuzz.Tools}` referencing
`Opc.Ua.Security.Certificates` + `Opc.Ua.Core`.
* Targets (20 total): `X509CRL(byte[])` → `EnsureDecoded`,
`X509SubjectAltNameExtension` / `X509AuthorityKeyIdentifierExtension` /
`X509CrlNumberExtension` raw-ASN.1 decoders,
`PEMReader.ImportPublicKeysFromPEM` / `ImportRsaPrivateKeyFromPEM`,
`Pkcs10CertificationRequest`, `AsnUtils.ParseX509Blob` + `AsnReader`
sequence/integer helpers.
* `Certificates.Testcases.cs` builds an RSA cert / CRL / CSR with the
existing builders and emits raw DER + PEM seeds.
* New `Fuzzing/dictionaries/asn1.dict` (DER tags, context-class tags,
length-form sentinels, OID prefixes).
### Network area via `Opc.Ua.Bindings.Pcap` (NO Core changes, NEW area)
* New `Fuzzing/Network/{Fuzz,Fuzz.Tests,Fuzz.Tools}`, multi-targeted
`net8.0;net9.0;net10.0` to match the pcap binding matrix (excluded from
net48/net472).
* **Stateless targets**: `OpcUaFrameParser.Process` (TCP segment → UA-SC
chunk splitter), `TcpStreamReassembler.Process` (raw TCP reassembly),
`OfflineSecureChannel.ReadChunk` (UA-SC symmetric decrypt + verify via
`UaSCUaBinaryChannel.ReadSymmetricMessage` → every security profile
covered through the binding), `ServiceCallReassembler.Push` (chunk →
decoded service call).
* **Stateful libFuzzer-only targets**: `MockServerReplay` /
`MockClientReplay` drivers in a separate target list so cheap stateless
targets dominate throughput.
* Deterministic test-only `ChannelKeyMaterial` via
`SecurityPolicies.None`.
* `Network.Testcases.cs` emits synthetic Hello/Ack/Err/Rhe/MSG seeds via
`LoopbackFrameBuilder`. Live handshake recorder is out of scope for this
PR (degraded mode documented).
* `Network.Fuzz` host does **not** instantiate `NicCaptureSource` — the
AFL/libFuzzer process never opens raw sockets.
* New `Fuzzing/dictionaries/uasc.dict` (MSG/OPN/CLO/HEL/ACK/ERR/RHE
magic + chunk-type bytes + security-policy URI prefixes) and `tcp.dict`
(Ethernet/IPv4/TCP framing markers).
### `Opc.Ua.Core` UA-SC parse seam (complements 4a)
* New `Stack/Opc.Ua.Core/Stack/Tcp/TcpMessageParsers.cs` — `internal
static` helpers for the pre-crypto, pre-auth chunk surface NOT covered
by the pcap binding: `TryParseChunkHeader`, `ReadHelloMessage`,
`ReadAcknowledgeMessage`, `ReadErrorMessage`, `ReadReverseHelloMessage`,
`ReadAsymmetricMessageHeader`.
* **No production-code refactor** (Strategy B): the new internal helpers
are an independent parse seam, not a refactor of the entangled private
channel methods. Existing `ProcessHelloMessage` /
`ProcessReverseHelloMessage` / asym-header decode paths are untouched.
Behaviour is byte-identical (verified — Opc.Ua.Core.Tests Tcp subset 7/7
passing).
* Surface via `<InternalsVisibleTo Include="Network.Fuzz" />` (+
matching Tools and Tests entries because the linked
`FuzzableCode.Transport.cs` compiles from all three host projects).
* New `Fuzzing/Network/Fuzz/FuzzableCode.Transport.cs` (12 targets) +
`Fuzzing/Network/Fuzz.Tools/Transport.Testcases.cs` (seeds under
`Testcases.Tcp.*`).
### Integration
* `UA.slnx`: add the 6 new fuzz projects, 4 new shared harness `.cs`
files, 5 new dictionaries, and the new `fuzz-menu.ps1` script — all
under the right `/Fuzzing/<Area>/` solution folders.
* Rewrite `Fuzzing/Fuzzing.md`: areas table, per-area dictionaries,
dynamic target-menu, step-by-step "how to add a new fuzz area" recipe,
Network area's replay-driven seed pipeline + key-material discipline,
pcap binding dependency note.
* Cross-link from `Docs/README.md` to `Fuzzing/Fuzzing.md`.
* Fix `.Order()` → `.OrderBy()` in shared scaffolding
(`.Order(IComparer)` is net7+; the harness compiles on net48/net472 for
the Encoders + Certificates test matrices).
## Verification
| Project | TFM | Tests | Result |
|---|---|---|---|
| `Encoders.Fuzz.Tests` | net10.0 | 4131 | ✅ 0 failed |
| `Certificates.Fuzz.Tests` | net10.0 | 220 | ✅ 0 failed |
| `Network.Fuzz.Tests` | net10.0 | 330 | ✅ 0 failed |
| **Total** | | **4681** | **✅ 0 failed** |
* Full `dotnet build UA.slnx` (all TFMs, including
net48/net472/net8/net9/net10): **0 errors**, warning count unchanged
from baseline.
* `Network.Fuzz` multi-TFM build: **net8.0 + net9.0 + net10.0** all
green.
* `Opc.Ua.Core` build: **0 errors, 0 warnings** after Phase 4b seam
addition.
## Notes for reviewers
* **Base branch**: `channelrefinements2`, not `master`. The pcap binding
(`Stack/Opc.Ua.Bindings.Pcap`) only exists on the channelrefinements
line.
* **Real keylog / key material**: never committed. All Network seed
corpora use deterministic material generated from fixture test
certificates via the binding's own replay helpers.
* **`.der` test assets**: force-added with `git add -f` (consistent with
the existing intentional exception at
`Tests/Opc.Ua.Security.Certificates.Tests/Assets/OPC Foundation Root CA
[...].der`); the repo-wide `*.der` gitignore otherwise excludes them.
* **Out of scope** (documented as fold-ins for future work):
`PcapFileReader` / `PcapNgFileWriter` / `UaKeyLogTextReader` /
`UaKeyLogJsonReader` defensive parser fuzzing; live handshake recorder
for `Network.Testcases.cs`; real loopback replay drivers (current
implementation uses synthetic replay).
## Checklist
- [ ] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed. _(Fuzz
suites verified on net10.0: 4681/4681 passing. Full UA.slnx build green
on all TFMs. Full repo-wide test run not yet executed on net48 —
pre-existing tests unaffected by these changes; only
`Stack/Opc.Ua.Core/Stack/Tcp/TcpMessageParsers.cs` is new and is gated
behind `<InternalsVisibleTo>`.)_
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.
544 lines
21 KiB
C#
544 lines
21 KiB
C#
/* ========================================================================
|
|
* Copyright (c) 2005-2026 The OPC Foundation, Inc. All rights reserved.
|
|
*
|
|
* OPC Foundation MIT License 1.00
|
|
*
|
|
* Permission is hereby granted, free of charge, to any person
|
|
* obtaining a copy of this software and associated documentation
|
|
* files (the "Software"), to deal in the Software without
|
|
* restriction, including without limitation the rights to use,
|
|
* copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
* copies of the Software, and to permit persons to whom the
|
|
* Software is furnished to do so, subject to the following
|
|
* conditions:
|
|
*
|
|
* The above copyright notice and this permission notice shall be
|
|
* included in all copies or substantial portions of the Software.
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
|
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
|
|
* OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
|
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
|
|
* HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
|
|
* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
|
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
|
|
* OTHER DEALINGS IN THE SOFTWARE.
|
|
*
|
|
* The complete license agreement can be found here:
|
|
* http://opcfoundation.org/License/MIT/1.00/
|
|
* ======================================================================*/
|
|
|
|
using System;
|
|
using System.IO;
|
|
using System.Text;
|
|
using System.Xml;
|
|
|
|
namespace Opc.Ua.Fuzzing
|
|
{
|
|
/// <summary>
|
|
/// Fuzzing code for individual built-in type decoders.
|
|
/// </summary>
|
|
public static partial class FuzzableCode
|
|
{
|
|
private const string BuiltInFieldName = "Value";
|
|
|
|
/// <summary>
|
|
/// The NodeId binary decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzNodeIdBinary(Stream stream)
|
|
{
|
|
using MemoryStream memoryStream = PrepareArraySegmentStream(stream);
|
|
FuzzBinaryBuiltInType(memoryStream, decoder => _ = decoder.ReadNodeId(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The NodeId binary decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzNodeIdBinary(ReadOnlySpan<byte> input)
|
|
{
|
|
using var memoryStream = new MemoryStream(input.ToArray());
|
|
FuzzBinaryBuiltInType(memoryStream, decoder => _ = decoder.ReadNodeId(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The NodeId JSON decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzNodeIdJson(string input)
|
|
{
|
|
FuzzJsonBuiltInType(input, decoder => _ = decoder.ReadNodeId(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The NodeId JSON decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzNodeIdJson(ReadOnlySpan<byte> input)
|
|
{
|
|
#if NETFRAMEWORK
|
|
string json = Encoding.UTF8.GetString(input.ToArray());
|
|
#else
|
|
string json = Encoding.UTF8.GetString(input);
|
|
#endif
|
|
FuzzJsonBuiltInType(json, decoder => _ = decoder.ReadNodeId(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The NodeId XML decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzNodeIdXml(Stream stream)
|
|
{
|
|
FuzzXmlBuiltInType(stream, decoder => _ = decoder.ReadNodeId(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The NodeId XML decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzNodeIdXml(ReadOnlySpan<byte> input)
|
|
{
|
|
using var memoryStream = new MemoryStream(input.ToArray());
|
|
FuzzXmlBuiltInType(memoryStream, decoder => _ = decoder.ReadNodeId(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The ExpandedNodeId binary decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzExpandedNodeIdBinary(Stream stream)
|
|
{
|
|
using MemoryStream memoryStream = PrepareArraySegmentStream(stream);
|
|
FuzzBinaryBuiltInType(memoryStream, decoder => _ = decoder.ReadExpandedNodeId(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The ExpandedNodeId binary decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzExpandedNodeIdBinary(ReadOnlySpan<byte> input)
|
|
{
|
|
using var memoryStream = new MemoryStream(input.ToArray());
|
|
FuzzBinaryBuiltInType(memoryStream, decoder => _ = decoder.ReadExpandedNodeId(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The ExpandedNodeId JSON decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzExpandedNodeIdJson(string input)
|
|
{
|
|
FuzzJsonBuiltInType(input, decoder => _ = decoder.ReadExpandedNodeId(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The ExpandedNodeId JSON decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzExpandedNodeIdJson(ReadOnlySpan<byte> input)
|
|
{
|
|
#if NETFRAMEWORK
|
|
string json = Encoding.UTF8.GetString(input.ToArray());
|
|
#else
|
|
string json = Encoding.UTF8.GetString(input);
|
|
#endif
|
|
FuzzJsonBuiltInType(json, decoder => _ = decoder.ReadExpandedNodeId(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The ExpandedNodeId XML decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzExpandedNodeIdXml(Stream stream)
|
|
{
|
|
FuzzXmlBuiltInType(stream, decoder => _ = decoder.ReadExpandedNodeId(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The ExpandedNodeId XML decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzExpandedNodeIdXml(ReadOnlySpan<byte> input)
|
|
{
|
|
using var memoryStream = new MemoryStream(input.ToArray());
|
|
FuzzXmlBuiltInType(memoryStream, decoder => _ = decoder.ReadExpandedNodeId(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The Variant binary decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzVariantBinary(Stream stream)
|
|
{
|
|
using MemoryStream memoryStream = PrepareArraySegmentStream(stream);
|
|
FuzzBinaryBuiltInType(memoryStream, decoder => _ = decoder.ReadVariant(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The Variant binary decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzVariantBinary(ReadOnlySpan<byte> input)
|
|
{
|
|
using var memoryStream = new MemoryStream(input.ToArray());
|
|
FuzzBinaryBuiltInType(memoryStream, decoder => _ = decoder.ReadVariant(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The Variant JSON decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzVariantJson(string input)
|
|
{
|
|
FuzzJsonBuiltInType(input, decoder => _ = decoder.ReadVariant(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The Variant JSON decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzVariantJson(ReadOnlySpan<byte> input)
|
|
{
|
|
#if NETFRAMEWORK
|
|
string json = Encoding.UTF8.GetString(input.ToArray());
|
|
#else
|
|
string json = Encoding.UTF8.GetString(input);
|
|
#endif
|
|
FuzzJsonBuiltInType(json, decoder => _ = decoder.ReadVariant(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The Variant XML decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzVariantXml(Stream stream)
|
|
{
|
|
FuzzXmlBuiltInType(stream, decoder => _ = decoder.ReadVariant(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The Variant XML decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzVariantXml(ReadOnlySpan<byte> input)
|
|
{
|
|
using var memoryStream = new MemoryStream(input.ToArray());
|
|
FuzzXmlBuiltInType(memoryStream, decoder => _ = decoder.ReadVariant(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The ExtensionObject binary decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzExtensionObjectBinary(Stream stream)
|
|
{
|
|
using MemoryStream memoryStream = PrepareArraySegmentStream(stream);
|
|
FuzzBinaryBuiltInType(memoryStream, decoder => _ = decoder.ReadExtensionObject(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The ExtensionObject binary decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzExtensionObjectBinary(ReadOnlySpan<byte> input)
|
|
{
|
|
using var memoryStream = new MemoryStream(input.ToArray());
|
|
FuzzBinaryBuiltInType(memoryStream, decoder => _ = decoder.ReadExtensionObject(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The ExtensionObject JSON decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzExtensionObjectJson(string input)
|
|
{
|
|
FuzzJsonBuiltInType(input, decoder => _ = decoder.ReadExtensionObject(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The ExtensionObject JSON decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzExtensionObjectJson(ReadOnlySpan<byte> input)
|
|
{
|
|
#if NETFRAMEWORK
|
|
string json = Encoding.UTF8.GetString(input.ToArray());
|
|
#else
|
|
string json = Encoding.UTF8.GetString(input);
|
|
#endif
|
|
FuzzJsonBuiltInType(json, decoder => _ = decoder.ReadExtensionObject(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The ExtensionObject XML decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzExtensionObjectXml(Stream stream)
|
|
{
|
|
FuzzXmlBuiltInType(stream, decoder => _ = decoder.ReadExtensionObject(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The ExtensionObject XML decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzExtensionObjectXml(ReadOnlySpan<byte> input)
|
|
{
|
|
using var memoryStream = new MemoryStream(input.ToArray());
|
|
FuzzXmlBuiltInType(memoryStream, decoder => _ = decoder.ReadExtensionObject(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The DataValue binary decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzDataValueBinary(Stream stream)
|
|
{
|
|
using MemoryStream memoryStream = PrepareArraySegmentStream(stream);
|
|
FuzzBinaryBuiltInType(memoryStream, decoder => _ = decoder.ReadDataValue(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The DataValue binary decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzDataValueBinary(ReadOnlySpan<byte> input)
|
|
{
|
|
using var memoryStream = new MemoryStream(input.ToArray());
|
|
FuzzBinaryBuiltInType(memoryStream, decoder => _ = decoder.ReadDataValue(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The DataValue JSON decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzDataValueJson(string input)
|
|
{
|
|
FuzzJsonBuiltInType(input, decoder => _ = decoder.ReadDataValue(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The DataValue JSON decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzDataValueJson(ReadOnlySpan<byte> input)
|
|
{
|
|
#if NETFRAMEWORK
|
|
string json = Encoding.UTF8.GetString(input.ToArray());
|
|
#else
|
|
string json = Encoding.UTF8.GetString(input);
|
|
#endif
|
|
FuzzJsonBuiltInType(json, decoder => _ = decoder.ReadDataValue(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The DataValue XML decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzDataValueXml(Stream stream)
|
|
{
|
|
FuzzXmlBuiltInType(stream, decoder => _ = decoder.ReadDataValue(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The DataValue XML decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzDataValueXml(ReadOnlySpan<byte> input)
|
|
{
|
|
using var memoryStream = new MemoryStream(input.ToArray());
|
|
FuzzXmlBuiltInType(memoryStream, decoder => _ = decoder.ReadDataValue(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The DiagnosticInfo binary decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzDiagnosticInfoBinary(Stream stream)
|
|
{
|
|
using MemoryStream memoryStream = PrepareArraySegmentStream(stream);
|
|
FuzzBinaryBuiltInType(memoryStream, decoder => _ = decoder.ReadDiagnosticInfo(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The DiagnosticInfo binary decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzDiagnosticInfoBinary(ReadOnlySpan<byte> input)
|
|
{
|
|
using var memoryStream = new MemoryStream(input.ToArray());
|
|
FuzzBinaryBuiltInType(memoryStream, decoder => _ = decoder.ReadDiagnosticInfo(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The DiagnosticInfo JSON decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzDiagnosticInfoJson(string input)
|
|
{
|
|
FuzzJsonBuiltInType(input, decoder => _ = decoder.ReadDiagnosticInfo(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The DiagnosticInfo JSON decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzDiagnosticInfoJson(ReadOnlySpan<byte> input)
|
|
{
|
|
#if NETFRAMEWORK
|
|
string json = Encoding.UTF8.GetString(input.ToArray());
|
|
#else
|
|
string json = Encoding.UTF8.GetString(input);
|
|
#endif
|
|
FuzzJsonBuiltInType(json, decoder => _ = decoder.ReadDiagnosticInfo(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The DiagnosticInfo XML decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzDiagnosticInfoXml(Stream stream)
|
|
{
|
|
FuzzXmlBuiltInType(stream, decoder => _ = decoder.ReadDiagnosticInfo(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The DiagnosticInfo XML decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzDiagnosticInfoXml(ReadOnlySpan<byte> input)
|
|
{
|
|
using var memoryStream = new MemoryStream(input.ToArray());
|
|
FuzzXmlBuiltInType(memoryStream, decoder => _ = decoder.ReadDiagnosticInfo(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The QualifiedName binary decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzQualifiedNameBinary(Stream stream)
|
|
{
|
|
using MemoryStream memoryStream = PrepareArraySegmentStream(stream);
|
|
FuzzBinaryBuiltInType(memoryStream, decoder => _ = decoder.ReadQualifiedName(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The QualifiedName binary decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzQualifiedNameBinary(ReadOnlySpan<byte> input)
|
|
{
|
|
using var memoryStream = new MemoryStream(input.ToArray());
|
|
FuzzBinaryBuiltInType(memoryStream, decoder => _ = decoder.ReadQualifiedName(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The QualifiedName JSON decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzQualifiedNameJson(string input)
|
|
{
|
|
FuzzJsonBuiltInType(input, decoder => _ = decoder.ReadQualifiedName(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The QualifiedName JSON decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzQualifiedNameJson(ReadOnlySpan<byte> input)
|
|
{
|
|
#if NETFRAMEWORK
|
|
string json = Encoding.UTF8.GetString(input.ToArray());
|
|
#else
|
|
string json = Encoding.UTF8.GetString(input);
|
|
#endif
|
|
FuzzJsonBuiltInType(json, decoder => _ = decoder.ReadQualifiedName(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The QualifiedName XML decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzQualifiedNameXml(Stream stream)
|
|
{
|
|
FuzzXmlBuiltInType(stream, decoder => _ = decoder.ReadQualifiedName(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The QualifiedName XML decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzQualifiedNameXml(ReadOnlySpan<byte> input)
|
|
{
|
|
using var memoryStream = new MemoryStream(input.ToArray());
|
|
FuzzXmlBuiltInType(memoryStream, decoder => _ = decoder.ReadQualifiedName(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The LocalizedText binary decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzLocalizedTextBinary(Stream stream)
|
|
{
|
|
using MemoryStream memoryStream = PrepareArraySegmentStream(stream);
|
|
FuzzBinaryBuiltInType(memoryStream, decoder => _ = decoder.ReadLocalizedText(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The LocalizedText binary decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzLocalizedTextBinary(ReadOnlySpan<byte> input)
|
|
{
|
|
using var memoryStream = new MemoryStream(input.ToArray());
|
|
FuzzBinaryBuiltInType(memoryStream, decoder => _ = decoder.ReadLocalizedText(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The LocalizedText JSON decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzLocalizedTextJson(string input)
|
|
{
|
|
FuzzJsonBuiltInType(input, decoder => _ = decoder.ReadLocalizedText(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The LocalizedText JSON decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzLocalizedTextJson(ReadOnlySpan<byte> input)
|
|
{
|
|
#if NETFRAMEWORK
|
|
string json = Encoding.UTF8.GetString(input.ToArray());
|
|
#else
|
|
string json = Encoding.UTF8.GetString(input);
|
|
#endif
|
|
FuzzJsonBuiltInType(json, decoder => _ = decoder.ReadLocalizedText(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The LocalizedText XML decoder fuzz target for afl-fuzz.
|
|
/// </summary>
|
|
public static void AflfuzzLocalizedTextXml(Stream stream)
|
|
{
|
|
FuzzXmlBuiltInType(stream, decoder => _ = decoder.ReadLocalizedText(BuiltInFieldName));
|
|
}
|
|
|
|
/// <summary>
|
|
/// The LocalizedText XML decoder fuzz target for libfuzzer.
|
|
/// </summary>
|
|
public static void LibfuzzLocalizedTextXml(ReadOnlySpan<byte> input)
|
|
{
|
|
using var memoryStream = new MemoryStream(input.ToArray());
|
|
FuzzXmlBuiltInType(memoryStream, decoder => _ = decoder.ReadLocalizedText(BuiltInFieldName));
|
|
}
|
|
|
|
private static void FuzzBinaryBuiltInType(MemoryStream stream, Action<IDecoder> decode)
|
|
{
|
|
try
|
|
{
|
|
using var decoder = new BinaryDecoder(stream, MessageContext);
|
|
decode(decoder);
|
|
}
|
|
catch (ServiceResultException sre) when (IsExpectedDecodingException(sre))
|
|
{
|
|
}
|
|
}
|
|
|
|
private static void FuzzJsonBuiltInType(string json, Action<IDecoder> decode)
|
|
{
|
|
try
|
|
{
|
|
using var decoder = new JsonDecoder(json, MessageContext);
|
|
decode(decoder);
|
|
}
|
|
catch (ServiceResultException sre) when (IsExpectedDecodingException(sre))
|
|
{
|
|
}
|
|
}
|
|
|
|
private static void FuzzXmlBuiltInType(Stream stream, Action<IDecoder> decode)
|
|
{
|
|
try
|
|
{
|
|
using XmlReader reader = XmlReader.Create(stream, Utils.DefaultXmlReaderSettings());
|
|
reader.MoveToContent();
|
|
using var decoder = new XmlDecoder(reader, MessageContext);
|
|
decode(decoder);
|
|
}
|
|
catch (XmlException)
|
|
{
|
|
}
|
|
catch (InvalidOperationException ex) when (ex.Message == "Stack empty.")
|
|
{
|
|
}
|
|
catch (ServiceResultException sre) when (IsExpectedDecodingException(sre))
|
|
{
|
|
}
|
|
}
|
|
|
|
private static bool IsExpectedDecodingException(ServiceResultException sre)
|
|
{
|
|
return sre.StatusCode == StatusCodes.BadDecodingError ||
|
|
sre.StatusCode == StatusCodes.BadEncodingLimitsExceeded ||
|
|
sre.StatusCode == StatusCodes.BadNodeIdInvalid;
|
|
}
|
|
}
|
|
}
|