Skip to content

Commit 80cea44

Browse files
abensoabenso
committed
fuzzer fixes
1 parent 59e2fcf commit 80cea44

6 files changed

Lines changed: 49 additions & 17 deletions

File tree

‎app/src/borsh.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ void print_string(const char *str) {
105105
MEMCPY(print, str, strlen(str));
106106
ZEMU_LOGF(100, "%s\n", print);
107107
#else
108-
printf("%s\n", str);
108+
// printf("%s\n", str);
109109
#endif
110110
}
111111

‎app/src/schema_proof.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,11 @@ static parser_error_t hash_index_leaf(merkle_leaves_data_t *leaves, uint64_t ind
112112
uint32_t data_length = 0;
113113
CHECK_ERROR(read_u32(&leaves->data, &data_length));
114114

115+
// Bounds check to prevent buffer overflow
116+
if (leaves->data.offset + data_length > leaves->data.buffer.len) {
117+
return parser_unexpected_buffer_end;
118+
}
119+
115120
// Compute hash from entry and store it in proof->hash
116121
crypto_sha256_init();
117122
crypto_sha256_update(&LEAF_PREFIX, 1);

‎app/src/schema_reader.c‎

Lines changed: 28 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -115,14 +115,17 @@ parser_error_t read_structured_display_overrides(parser_context_t *ctx, structur
115115
CHECK_INPUT(ctx);
116116

117117
// read has_title_elements
118-
CHECK_ERROR(read_u8(ctx, (uint8_t *)&display->has_title_elements));
118+
uint8_t tmp = 0;
119+
CHECK_ERROR(read_u8(ctx, &tmp));
120+
display->has_title_elements = (tmp != 0);
119121
if (display->has_title_elements) {
120122
// read title_elements
121123
CHECK_ERROR(read_u64(ctx, (uint64_t *)&display->title_elements));
122124
}
123125

124126
// read has_title_lines
125-
CHECK_ERROR(read_u8(ctx, (uint8_t *)&display->has_title_lines));
127+
CHECK_ERROR(read_u8(ctx, &tmp));
128+
display->has_title_lines = (tmp != 0);
126129
if (display->has_title_lines) {
127130
// read title_lines
128131
CHECK_ERROR(read_u64(ctx, (uint64_t *)&display->title_lines));
@@ -155,7 +158,9 @@ parser_error_t read_primitive_byte_array(parser_context_t *ctx, primitive_byte_a
155158
CHECK_ERROR(read_byte_display(ctx, &primitive->display));
156159

157160
// read has_name_registry
158-
CHECK_ERROR(read_u8(ctx, (uint8_t *)&primitive->has_name_registry));
161+
uint8_t tmp = 0;
162+
CHECK_ERROR(read_u8(ctx, &tmp));
163+
primitive->has_name_registry = (tmp != 0);
159164

160165
// read name_registry
161166
if (primitive->has_name_registry) {
@@ -177,7 +182,9 @@ parser_error_t read_primitive_byte_vec(parser_context_t *ctx, primitive_byte_vec
177182
CHECK_ERROR(read_byte_display(ctx, &primitive->display));
178183

179184
// read has_name_registry
180-
CHECK_ERROR(read_u8(ctx, (uint8_t *)&primitive->has_name_registry));
185+
uint8_t tmp = 0;
186+
CHECK_ERROR(read_u8(ctx, &tmp));
187+
primitive->has_name_registry = (tmp != 0);
181188

182189
// read name_registry
183190
if (primitive->has_name_registry) {
@@ -269,7 +276,9 @@ parser_error_t read_enum_variant(parser_context_t *ctx, enum_variant_t *variant)
269276
CHECK_ERROR(read_u8(ctx, (uint8_t *)&variant->hide_tag));
270277

271278
// read has_value
272-
CHECK_ERROR(read_u8(ctx, (uint8_t *)&variant->has_value));
279+
uint8_t tmp = 0;
280+
CHECK_ERROR(read_u8(ctx, &tmp));
281+
variant->has_value = (tmp != 0);
273282
if (variant->has_value) {
274283
// read value
275284
CHECK_ERROR(read_link(ctx, &variant->value));
@@ -374,7 +383,9 @@ parser_error_t read_struct(parser_context_t *ctx, schema_struct_t *schema_struct
374383
}
375384

376385
// read has_show_as
377-
CHECK_ERROR(read_u8(ctx, (uint8_t *)&schema_struct->has_show_as));
386+
uint8_t tmp = 0;
387+
CHECK_ERROR(read_u8(ctx, &tmp));
388+
schema_struct->has_show_as = (tmp != 0);
378389
if (schema_struct->has_show_as) {
379390
CHECK_ERROR(read_u32(ctx, (uint32_t *)&schema_struct->show_as.len));
380391
if (schema_struct->show_as.len == 0) {
@@ -387,7 +398,8 @@ parser_error_t read_struct(parser_context_t *ctx, schema_struct_t *schema_struct
387398
}
388399

389400
// read has_structured_show_as
390-
CHECK_ERROR(read_u8(ctx, (uint8_t *)&schema_struct->has_structured_show_as));
401+
CHECK_ERROR(read_u8(ctx, &tmp));
402+
schema_struct->has_structured_show_as = (tmp != 0);
391403
if (schema_struct->has_structured_show_as) {
392404
CHECK_ERROR(read_u32(ctx, (uint32_t *)&schema_struct->structured_show_as.len));
393405
if (schema_struct->structured_show_as.len == 0) {
@@ -424,7 +436,9 @@ parser_error_t read_tuple(parser_context_t *ctx, schema_tuple_t *schema_tuple) {
424436
CHECK_INPUT(ctx);
425437

426438
// read has_show_as
427-
CHECK_ERROR(read_u8(ctx, (uint8_t *)&schema_tuple->has_show_as));
439+
uint8_t tmp = 0;
440+
CHECK_ERROR(read_u8(ctx, &tmp));
441+
schema_tuple->has_show_as = (tmp != 0);
428442
if (schema_tuple->has_show_as) {
429443
CHECK_ERROR(read_u32(ctx, (uint32_t *)&schema_tuple->show_as.len));
430444
if (schema_tuple->show_as.len == 0) {
@@ -437,7 +451,8 @@ parser_error_t read_tuple(parser_context_t *ctx, schema_tuple_t *schema_tuple) {
437451
}
438452

439453
// read has_structured_show_as
440-
CHECK_ERROR(read_u8(ctx, (uint8_t *)&schema_tuple->has_structured_show_as));
454+
CHECK_ERROR(read_u8(ctx, &tmp));
455+
schema_tuple->has_structured_show_as = (tmp != 0);
441456
if (schema_tuple->has_structured_show_as) {
442457
CHECK_ERROR(read_u32(ctx, (uint32_t *)&schema_tuple->structured_show_as.len));
443458
if (schema_tuple->structured_show_as.len == 0) {
@@ -762,6 +777,10 @@ parser_error_t schema_merkle_proofs_read(parser_context_t *ctx, parser_tx_t *txO
762777
CHECK_INPUT(ctx);
763778
CHECK_INPUT(txObj);
764779

780+
if (ctx->buffer.len < 4) {
781+
return parser_no_data;
782+
}
783+
765784
// read leaf data
766785
CHECK_ERROR(read_u32(ctx, &txObj->merkle_proof.leaves.entries));
767786
const uint8_t *ptr_mem = ctx->buffer.ptr + ctx->offset;

‎app/src/ui_item_manager.c‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -149,11 +149,5 @@ parser_error_t push_item(parser_tx_t *txObj, primitive_t *primitive, parser_cont
149149
txObj->ui_items_new.items[txObj->ui_items_new.qty].data_context = *data_context;
150150
txObj->ui_items_new.qty++;
151151

152-
for (uint16_t i = 0; i < txObj->ui_items_new.qty; i++) {
153-
print_string("Push item NEW: ");
154-
print_string(txObj->ui_items_new.items[i].title);
155-
print_buffer(&txObj->ui_items_new.items[i].data_context.buffer, "data context");
156-
}
157-
158152
return parser_ok;
159153
}

‎fuzz/run-fuzzers.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@
3030
env['UBSAN_OPTIONS'] = 'halt_on_error=1:print_stacktrace=1'
3131

3232
cmd = [fuzz_path, f'-max_total_time={max_time}',
33-
f'-jobs=2'
33+
f'-jobs=1'
3434
f'-max_len={max_len}',
3535
f'-mutate_depth={MUTATE_DEPTH}',
3636
f'-artifact_prefix={artifact_dir}/',

‎tests/parser_impl.cpp‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -282,3 +282,17 @@ TEST(SCALE, MultiProofTest) {
282282

283283
EXPECT_EQ(memcmp(tx_obj.schema.chain_hash.ptr, expected_hash, CX_SHA256_SIZE), 0) << "Chain hash mismatch";
284284
}
285+
286+
TEST(SCALE, Fuzzer) {
287+
parser_context_t ctx = {0};
288+
parser_tx_t tx_obj = {0};
289+
parser_error_t err;
290+
uint8_t buffer[12000];
291+
auto bufferLen = parseHexString(buffer, sizeof(buffer), "0a");
292+
293+
ctx.buffer.ptr = buffer;
294+
ctx.buffer.len = bufferLen;
295+
296+
// err = parser_parse(&ctx, ctx.buffer.ptr, ctx.buffer.len, &tx_obj);
297+
// EXPECT_EQ(err, parser_ok) << parser_getErrorDescription(err);
298+
}

0 commit comments

Comments
 (0)