lib/fuzzing/fuzz_sddl_parse.c

   1 /*
   2   Fuzz sddl decoding and encoding
   3   Copyright (C) Catalyst IT 2023
   4
   5   This program is free software; you can redistribute it and/or modify
   6   it under the terms of the GNU General Public License as published by
   7   the Free Software Foundation; either version 3 of the License, or
   8   (at your option) any later version.
   9
  10   This program is distributed in the hope that it will be useful,
  11   but WITHOUT ANY WARRANTY; without even the implied warranty of
  12   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13   GNU General Public License for more details.
  14
  15   You should have received a copy of the GNU General Public License
  16   along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 */
  18
  19 #include "includes.h"
  20 #include "libcli/security/security.h"
  21 #include "librpc/gen_ndr/conditional_ace.h"
  22 #include "fuzzing/fuzzing.h"
  23 #include "util/charset/charset.h"
  24
  25 #define MAX_LENGTH (100 * 1024 - 1)
  26 static char sddl_string[MAX_LENGTH + 1] = {0};
  27 static struct dom_sid dom_sid = {0};
  28
  29 int LLVMFuzzerInitialize(int *argc, char ***argv)
  30 {
  31         string_to_sid(&dom_sid,
  32                       "S-1-5-21-2470180966-3899876309-2637894779");
  33         return 0;
  34 }
  35
  36
  37 int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len)
  38 {
  39         TALLOC_CTX *mem_ctx = NULL;
  40         struct security_descriptor *sd1 = NULL;
  41         struct security_descriptor *sd2 = NULL;
  42         char *result = NULL;
  43         bool ok;
  44
  45         if (len > MAX_LENGTH) {
  46                 return 0;
  47         }
  48
  49         memcpy(sddl_string, input, len);
  50         sddl_string[len] = '\0';
  51
  52         mem_ctx = talloc_new(NULL);
  53
  54         sd1 = sddl_decode(mem_ctx, sddl_string, &dom_sid);
  55         if (sd1 == NULL) {
  56                 goto end;
  57         }
  58         result = sddl_encode(mem_ctx, sd1, &dom_sid);
  59         if (result == NULL) {
  60                 /*
  61                  * Because Samba currently doesn't enforce strict
  62                  * utf-8 parsing, illegal utf-8 sequences in
  63                  * sddl_string could have ferried bad characters
  64                  * through into the security descriptor conditions
  65                  * that we then find we can't encode.
  66                  *
  67                  * The proper solution is strict UTF-8 enforcement in
  68                  * sddl_decode, but for now we forgive unencodable
  69                  * security descriptors made from bad utf-8.
  70                  */
  71                 size_t byte_len, char_len, utf16_len;
  72                 ok = utf8_check(sddl_string, len,
  73                                 &byte_len, &char_len, &utf16_len);
  74                 if (!ok) {
  75                         goto end;
  76                 }
  77                 /* utf-8 was fine, but we couldn't encode! */
  78                 abort();
  79         }
  80
  81         sd2 = sddl_decode(mem_ctx, result, &dom_sid);
  82         if (sd2 == NULL) {
  83                 if (strlen(result) > CONDITIONAL_ACE_MAX_LENGTH) {
  84                         /*
  85                          * This could fail if a unicode string or
  86                          * attribute name that contains escapable
  87                          * bytes (e.g '\x0b') in an unescaped form in
  88                          * the original string ends up with them in
  89                          * the escaped form ("%000b") in the result
  90                          * string, making the entire attribute name
  91                          * too long for the arbitrary limit we set for
  92                          * SDDL attribute names.
  93                          *
  94                          * We could increase that arbitrary limit (to,
  95                          * say, CONDITIONAL_ACE_MAX_LENGTH * 5), but
  96                          * that is getting very far from real world
  97                          * needs.
  98                          */
  99                         goto end;
 100                 }
 101                 abort();
 102         }
 103         ok = security_descriptor_equal(sd1, sd2);
 104         if (!ok) {
 105                 abort();
 106         }
 107 end:
 108         talloc_free(mem_ctx);
 109         return 0;
 110 }