fuzzing/orphans/libffi/fuzz_ffi.cc - platform/tools/security - Git at Google

 /*
  * Copyright 2020 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */

 // Don't lint the next line, as cpplint will suggest adding
 // /tools/security as an include_dir
 // NOLINTNEXTLINE
 #include "fuzz_ffi.h"

 #include <vector>
 #include "include/ffi_common.h"

 // Empty functions we can use for our function targets
 void fn(int num_args, ...) {}
 void closure_fn(ffi_cif* cif __UNUSED__,
         void* resp, void** args, void* userdata) {}
 void raw_closure_fn(ffi_cif* cif __UNUSED__,
         void* resp, ffi_raw* args, void* userdata) {}
 void java_raw_closure_fn(ffi_cif* cif __UNUSED__,
         void* resp, ffi_java_raw* args, void* userdata) {}

 ffi_type* generateCustomType(FuzzedDataProvider* dataProvider) {
     // Set our flag so we don't call a java-related function (triggers an abort)
     args_contain_struct = true;

     ffi_type* new_type = reinterpret_cast<ffi_type*>(malloc(sizeof(ffi_type)));
     ffi_alloc_vector.push_back(new_type);

     new_type->size = 0;
     new_type->alignment = 0;
     new_type->type = FFI_TYPE_STRUCT;

     // Generate our subobjects
     size_t num_elements = dataProvider->ConsumeIntegralInRange<size_t>(0,
             MAX_NUM_ELEMENTS);
     new_type->elements = reinterpret_cast<ffi_type**>(
             malloc(sizeof(ffi_type*)*(num_elements+1)));

     // Nested custom structs will cause an assert, so disable them
     // TODO(michael.ensing@leviathansecurity.com):
     //     change the 'false' here to true once libffi supports nested structs.
     //     It'll just throw an assert currently.
     for (size_t i=0; i < num_elements; i++) {
         new_type->elements[i] = getRandomType(dataProvider, false);
     }

     // The final element must be a nullptr
     new_type->elements[num_elements] = NULL;

     // Get our size/alignment
     ffi_get_struct_offsets(abi, new_type, NULL);

     return new_type;
 }

 size_t getTotalSize(ffi_type* type) {
     if (type == NULL) {
         return 0;
     }

     // Start the total as the size of the object itself
     size_t total_size = type->size > WORDSIZE_BYTES ?
             type->size : WORDSIZE_BYTES;

     // Recursively add the size of the subelements
     if (type->elements != NULL) {
         for (size_t i=0; type->elements[i] != NULL; i++) {
             total_size += getTotalSize(type->elements[i]);
         }
     }

     return total_size;
 }

 ffi_type* getRandomType(FuzzedDataProvider* dataProvider,
         bool allowCustomTypes) {
     // Which type? Let type==NUM_TYPES be our custom struct case
     size_t type_index = dataProvider->ConsumeIntegralInRange<size_t>(0,
             NUM_TYPES);
     ffi_type* type;
     if (type_index == NUM_TYPES) {
         if (allowCustomTypes) {
             type = generateCustomType(dataProvider);
         } else {
             return NULL;
         }
     } else {
         type = ffi_types[type_index];
     }

     return type;
 }

 void* genArg(ffi_type* type, FuzzedDataProvider* dataProvider) {
     // Allocate the space for our arg
     // TODO(michael.ensing@leviathansecurity.com):
     //    Properly allocate the correct amount of aligned-space,
     //    don't just double (which should contain any alignment)
     size_t type_size = getTotalSize(type)*2;

     if (type_size == 0) {
         return NULL;
     }

     void* ret = malloc(type_size);

     std::vector<uint8_t> bytes = dataProvider->ConsumeBytes<uint8_t>(type_size);
     memcpy(ret, bytes.data(), bytes.size());

     return ret;
 }

 bool buildArgArrays(ffi_type* arg_types[], void* arg_array[], size_t num_args,
         FuzzedDataProvider* dataProvider) {
     // The first value in our array should be the number of arguments
     arg_types[0] = &ffi_type_sint;
     size_t* size_ptr = reinterpret_cast<size_t*>(malloc(sizeof(size_t)));
     *size_ptr = num_args;
     arg_array[0] = size_ptr;

     // Grab our arguments
     for (size_t i = 1; i <= num_args; i++) {
         // Determine what type we're using
         ffi_type* type = getRandomType(dataProvider, true);
         if (type == NULL) {
             return false;
         }
         arg_types[i] = type;

         // Generate a value for it and add to our arguments array
         arg_array[i] = genArg(type, dataProvider);
     }

     // Our arrays of pointers need to be nullptr-terminated
     arg_types[num_args+1] = NULL;
     arg_array[num_args+1] = NULL;

     return true;
 }

 void runMainFunctions(ffi_cif* cif, void* resp_buf, void** arg_array,
         FuzzedDataProvider* dataProvider) {
     // Call function
     ffi_call(cif, FFI_FN(fn), resp_buf, arg_array);

     // Prep Closure
     ffi_closure* pcl = NULL;
     void* code;
     ffi_status ret;

     pcl = reinterpret_cast<ffi_closure*>(
             ffi_closure_alloc(sizeof(ffi_closure), &code));
     if (pcl == NULL) {
         return;
     }

     size_t buf_size = dataProvider->ConsumeIntegralInRange<size_t>(0,
             MAX_RESP_SIZE);
     std::vector<uint8_t> data_vector =
             dataProvider->ConsumeBytes<uint8_t>(buf_size);
     ret = ffi_prep_closure_loc(
             pcl,
             cif,
             closure_fn,
             data_vector.data(),
             code);
     if (ret != FFI_OK) {
         ffi_closure_free(pcl);
     }
 }

 void runRawFunctions(ffi_cif* cif, void* resp_buf, void** arg_array,
         FuzzedDataProvider* dataProvider) {
     #if !FFI_NO_RAW_API && !FFI_NATIVE_RAW_API
     // Allocate our ffi_raw and put our args there
     size_t rsize = ffi_raw_size(cif);
     ffi_raw* raw_args = reinterpret_cast<ffi_raw*>(malloc(rsize));
     raw_alloc_vector.push_back(raw_args);
     ffi_ptrarray_to_raw(cif, arg_array, raw_args);

     // Call
     ffi_raw_call(cif, FFI_FN(fn), resp_buf, raw_args);

     // Prep Closure
     #if FFI_CLOSURES
     ffi_raw_closure* pcl = NULL;
     void* code;
     ffi_status ret;

     pcl = static_cast<ffi_raw_closure*>(
             ffi_closure_alloc(sizeof(ffi_raw_closure), &code));
     if (pcl == NULL) {
         return;
     }
     size_t buf_size = dataProvider->ConsumeIntegralInRange<size_t>(0,
             MAX_RESP_SIZE);
     std::vector<uint8_t> data_vector =
             dataProvider->ConsumeBytes<uint8_t>(buf_size);
     ret = ffi_prep_raw_closure_loc(
             pcl,
             cif,
             raw_closure_fn,
             data_vector.data(),
             code);
     if (ret != FFI_OK) {
         ffi_closure_free(pcl);
     }

     #endif  // FFI_CLOSURES
     #endif  // !FFI_NO_RAW_API && !FFI_NATIVE_RAW_API
 }

 void runJavaFunctions(ffi_cif* cif, void* resp_buf, void** arg_array,
         FuzzedDataProvider* dataProvider) {
     #if !defined(NO_JAVA_RAW_API)
     #if  !FFI_NO_RAW_API && !FFI_NATIVE_RAW_API

     // Allocate our ffi_java_raw and put our args there
     size_t rsize = ffi_java_raw_size(cif);
     // NOTE: a buffer overread will occasionally happen if we don't
     //       increase rsize.
     ffi_java_raw* raw_args = reinterpret_cast<ffi_raw*>(malloc(rsize*2));
     raw_alloc_vector.push_back(raw_args);
     ffi_ptrarray_to_raw(cif, arg_array, raw_args);

     // Call
     ffi_java_raw_call(cif, FFI_FN(fn), resp_buf, raw_args);

     // Prep Closure
     #if FFI_CLOSURES
     ffi_java_raw_closure* pcl = NULL;
     void* code;
     ffi_status ret;

     pcl = static_cast<ffi_java_raw_closure*>(
             ffi_closure_alloc(sizeof(ffi_java_raw_closure), &code));
     if (pcl == NULL) {
         return;
     }
     size_t buf_size = dataProvider->ConsumeIntegralInRange<size_t>(0,
             MAX_RESP_SIZE);
     std::vector<uint8_t> data_vector =
             dataProvider->ConsumeBytes<uint8_t>(buf_size);
     ret = ffi_prep_java_raw_closure_loc(
             pcl,
             cif,
             raw_closure_fn,
             data_vector.data(),
             code);
     if (ret != FFI_OK) {
         ffi_closure_free(pcl);
     }

     #endif  // FFI_CLOSURES
     #endif  // !FFI_NATIVE_RAW_API
     #endif  // !NO_JAVA_RAW_API
 }

 void freeFFI(ffi_type* ffi_type) {
     // Make sure it's one of our structs
     if (ffi_type == NULL || ffi_type->type != FFI_TYPE_STRUCT) {
         return;
     }

     if (ffi_type->elements != NULL) {
         free(ffi_type->elements);
     }

     // Finally, free our object
     free(ffi_type);
 }

 void freeAll(void* arg_array[], size_t num_args, void* resp_buf) {
     // Free our custom struct objects
     for (const auto& ffi : ffi_alloc_vector) {
         freeFFI(ffi);
     }
     ffi_alloc_vector.clear();
     for (const auto& raw : raw_alloc_vector) {
         free(raw);
     }
     raw_alloc_vector.clear();

     for (size_t i=0; i <= num_args; i++) {
         free(arg_array[i]);
     }

     if (resp_buf) {
         free(resp_buf);
     }
 }

 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
     // Init our wrapper
     FuzzedDataProvider dataProvider(Data, Size);
     ffi_cif cif;
     ffi_status ret;
     void* resp_buf = NULL;
     args_contain_struct = false;
     ffi_type* rtype;

     // How many args are we sending?
     size_t num_args = dataProvider.ConsumeIntegralInRange<size_t>(0,
             MAX_NUM_ARGS);

     // Build our array of args (+2 for leading arg_count and trailing nullptr)
     ffi_type* arg_types[num_args+2];
     void* arg_array[num_args+2];
     bool success = buildArgArrays(arg_types, arg_array, num_args,
             &dataProvider);
     if (!success) {
         goto free;
     }

     // Get return type
     rtype = dataProvider.PickValueInArray<ffi_type*, NUM_TYPES>(ffi_types);

     // Create a buffer for our return value
     resp_buf = malloc(MAX_RESP_SIZE);
     if (resp_buf == NULL) {
         goto free;
     }

     // Set up our ABI
     // NOTE: fuzzing abi triggers an abort on linux-x86_64,
     //       so only fuzz it on ARM
     #if MAX_ABI > 0 && defined(ARM)
     abi = static_cast<ffi_abi>(
            dataProvider.ConsumeIntegralInRange<uint32_t>(0, MAX_ABI));
     #endif
     #if HAVE_LONG_DOUBLE_VARIANT
     ffi_prep_types(abi);
     #endif

     // ============= Call Functions =============
     ret = ffi_prep_cif_var(&cif, abi, 1, num_args, rtype,
             arg_types);
     if (ret != FFI_OK) {
         goto free;
     }

     runMainFunctions(&cif, resp_buf, arg_array, &dataProvider);
     runRawFunctions(&cif, resp_buf, arg_array, &dataProvider);
     if (!args_contain_struct) {
         runJavaFunctions(&cif, resp_buf, arg_array, &dataProvider);
     }

 free:
     freeAll(arg_array, num_args, resp_buf);
     return 0;
 }
	/*
	* Copyright 2020 The Android Open Source Project
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	// Don't lint the next line, as cpplint will suggest adding
	// /tools/security as an include_dir
	// NOLINTNEXTLINE
	#include "fuzz_ffi.h"

	#include <vector>
	#include "include/ffi_common.h"

	// Empty functions we can use for our function targets
	void fn(int num_args, ...) {}
	void closure_fn(ffi_cif* cif __UNUSED__,
	void* resp, void** args, void* userdata) {}
	void raw_closure_fn(ffi_cif* cif __UNUSED__,
	void* resp, ffi_raw* args, void* userdata) {}
	void java_raw_closure_fn(ffi_cif* cif __UNUSED__,
	void* resp, ffi_java_raw* args, void* userdata) {}

	ffi_type* generateCustomType(FuzzedDataProvider* dataProvider) {
	// Set our flag so we don't call a java-related function (triggers an abort)
	args_contain_struct = true;

	ffi_type* new_type = reinterpret_cast<ffi_type*>(malloc(sizeof(ffi_type)));
	ffi_alloc_vector.push_back(new_type);

	new_type->size = 0;
	new_type->alignment = 0;
	new_type->type = FFI_TYPE_STRUCT;

	// Generate our subobjects
	size_t num_elements = dataProvider->ConsumeIntegralInRange<size_t>(0,
	MAX_NUM_ELEMENTS);
	new_type->elements = reinterpret_cast<ffi_type**>(
	malloc(sizeof(ffi_type)(num_elements+1)));

	// Nested custom structs will cause an assert, so disable them
	// TODO(michael.ensing@leviathansecurity.com):
	// change the 'false' here to true once libffi supports nested structs.
	// It'll just throw an assert currently.
	for (size_t i=0; i < num_elements; i++) {
	new_type->elements[i] = getRandomType(dataProvider, false);
	}

	// The final element must be a nullptr
	new_type->elements[num_elements] = NULL;

	// Get our size/alignment
	ffi_get_struct_offsets(abi, new_type, NULL);

	return new_type;
	}

	size_t getTotalSize(ffi_type* type) {
	if (type == NULL) {
	return 0;
	}

	// Start the total as the size of the object itself
	size_t total_size = type->size > WORDSIZE_BYTES ?
	type->size : WORDSIZE_BYTES;

	// Recursively add the size of the subelements
	if (type->elements != NULL) {
	for (size_t i=0; type->elements[i] != NULL; i++) {
	total_size += getTotalSize(type->elements[i]);
	}
	}

	return total_size;
	}

	ffi_type* getRandomType(FuzzedDataProvider* dataProvider,
	bool allowCustomTypes) {
	// Which type? Let type==NUM_TYPES be our custom struct case
	size_t type_index = dataProvider->ConsumeIntegralInRange<size_t>(0,
	NUM_TYPES);
	ffi_type* type;
	if (type_index == NUM_TYPES) {
	if (allowCustomTypes) {
	type = generateCustomType(dataProvider);
	} else {
	return NULL;
	}
	} else {
	type = ffi_types[type_index];
	}

	return type;
	}

	void* genArg(ffi_type* type, FuzzedDataProvider* dataProvider) {
	// Allocate the space for our arg
	// TODO(michael.ensing@leviathansecurity.com):
	// Properly allocate the correct amount of aligned-space,
	// don't just double (which should contain any alignment)
	size_t type_size = getTotalSize(type)*2;

	if (type_size == 0) {
	return NULL;
	}

	void* ret = malloc(type_size);

	std::vector<uint8_t> bytes = dataProvider->ConsumeBytes<uint8_t>(type_size);
	memcpy(ret, bytes.data(), bytes.size());

	return ret;
	}

	bool buildArgArrays(ffi_type* arg_types[], void* arg_array[], size_t num_args,
	FuzzedDataProvider* dataProvider) {
	// The first value in our array should be the number of arguments
	arg_types[0] = &ffi_type_sint;
	size_t* size_ptr = reinterpret_cast<size_t*>(malloc(sizeof(size_t)));
	*size_ptr = num_args;
	arg_array[0] = size_ptr;

	// Grab our arguments
	for (size_t i = 1; i <= num_args; i++) {
	// Determine what type we're using
	ffi_type* type = getRandomType(dataProvider, true);
	if (type == NULL) {
	return false;
	}
	arg_types[i] = type;

	// Generate a value for it and add to our arguments array
	arg_array[i] = genArg(type, dataProvider);
	}

	// Our arrays of pointers need to be nullptr-terminated
	arg_types[num_args+1] = NULL;
	arg_array[num_args+1] = NULL;

	return true;
	}

	void runMainFunctions(ffi_cif* cif, void* resp_buf, void** arg_array,
	FuzzedDataProvider* dataProvider) {
	// Call function
	ffi_call(cif, FFI_FN(fn), resp_buf, arg_array);

	// Prep Closure
	ffi_closure* pcl = NULL;
	void* code;
	ffi_status ret;

	pcl = reinterpret_cast<ffi_closure*>(
	ffi_closure_alloc(sizeof(ffi_closure), &code));
	if (pcl == NULL) {
	return;
	}

	size_t buf_size = dataProvider->ConsumeIntegralInRange<size_t>(0,
	MAX_RESP_SIZE);
	std::vector<uint8_t> data_vector =
	dataProvider->ConsumeBytes<uint8_t>(buf_size);
	ret = ffi_prep_closure_loc(
	pcl,
	cif,
	closure_fn,
	data_vector.data(),
	code);
	if (ret != FFI_OK) {
	ffi_closure_free(pcl);
	}
	}

	void runRawFunctions(ffi_cif* cif, void* resp_buf, void** arg_array,
	FuzzedDataProvider* dataProvider) {
	#if !FFI_NO_RAW_API && !FFI_NATIVE_RAW_API
	// Allocate our ffi_raw and put our args there
	size_t rsize = ffi_raw_size(cif);
	ffi_raw* raw_args = reinterpret_cast<ffi_raw*>(malloc(rsize));
	raw_alloc_vector.push_back(raw_args);
	ffi_ptrarray_to_raw(cif, arg_array, raw_args);

	// Call
	ffi_raw_call(cif, FFI_FN(fn), resp_buf, raw_args);

	// Prep Closure
	#if FFI_CLOSURES
	ffi_raw_closure* pcl = NULL;
	void* code;
	ffi_status ret;

	pcl = static_cast<ffi_raw_closure*>(
	ffi_closure_alloc(sizeof(ffi_raw_closure), &code));
	if (pcl == NULL) {
	return;
	}
	size_t buf_size = dataProvider->ConsumeIntegralInRange<size_t>(0,
	MAX_RESP_SIZE);
	std::vector<uint8_t> data_vector =
	dataProvider->ConsumeBytes<uint8_t>(buf_size);
	ret = ffi_prep_raw_closure_loc(
	pcl,
	cif,
	raw_closure_fn,
	data_vector.data(),
	code);
	if (ret != FFI_OK) {
	ffi_closure_free(pcl);
	}

	#endif // FFI_CLOSURES
	#endif // !FFI_NO_RAW_API && !FFI_NATIVE_RAW_API
	}

	void runJavaFunctions(ffi_cif* cif, void* resp_buf, void** arg_array,
	FuzzedDataProvider* dataProvider) {
	#if !defined(NO_JAVA_RAW_API)
	#if !FFI_NO_RAW_API && !FFI_NATIVE_RAW_API

	// Allocate our ffi_java_raw and put our args there
	size_t rsize = ffi_java_raw_size(cif);
	// NOTE: a buffer overread will occasionally happen if we don't
	// increase rsize.
	ffi_java_raw* raw_args = reinterpret_cast<ffi_raw>(malloc(rsize2));
	raw_alloc_vector.push_back(raw_args);
	ffi_ptrarray_to_raw(cif, arg_array, raw_args);

	// Call
	ffi_java_raw_call(cif, FFI_FN(fn), resp_buf, raw_args);

	// Prep Closure
	#if FFI_CLOSURES
	ffi_java_raw_closure* pcl = NULL;
	void* code;
	ffi_status ret;

	pcl = static_cast<ffi_java_raw_closure*>(
	ffi_closure_alloc(sizeof(ffi_java_raw_closure), &code));
	if (pcl == NULL) {
	return;
	}
	size_t buf_size = dataProvider->ConsumeIntegralInRange<size_t>(0,
	MAX_RESP_SIZE);
	std::vector<uint8_t> data_vector =
	dataProvider->ConsumeBytes<uint8_t>(buf_size);
	ret = ffi_prep_java_raw_closure_loc(
	pcl,
	cif,
	raw_closure_fn,
	data_vector.data(),
	code);
	if (ret != FFI_OK) {
	ffi_closure_free(pcl);
	}

	#endif // FFI_CLOSURES
	#endif // !FFI_NATIVE_RAW_API
	#endif // !NO_JAVA_RAW_API
	}

	void freeFFI(ffi_type* ffi_type) {
	// Make sure it's one of our structs
	if (ffi_type == NULL \|\| ffi_type->type != FFI_TYPE_STRUCT) {
	return;
	}

	if (ffi_type->elements != NULL) {
	free(ffi_type->elements);
	}

	// Finally, free our object
	free(ffi_type);
	}

	void freeAll(void* arg_array[], size_t num_args, void* resp_buf) {
	// Free our custom struct objects
	for (const auto& ffi : ffi_alloc_vector) {
	freeFFI(ffi);
	}
	ffi_alloc_vector.clear();
	for (const auto& raw : raw_alloc_vector) {
	free(raw);
	}
	raw_alloc_vector.clear();

	for (size_t i=0; i <= num_args; i++) {
	free(arg_array[i]);
	}

	if (resp_buf) {
	free(resp_buf);
	}
	}

	extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
	// Init our wrapper
	FuzzedDataProvider dataProvider(Data, Size);
	ffi_cif cif;
	ffi_status ret;
	void* resp_buf = NULL;
	args_contain_struct = false;
	ffi_type* rtype;

	// How many args are we sending?
	size_t num_args = dataProvider.ConsumeIntegralInRange<size_t>(0,
	MAX_NUM_ARGS);

	// Build our array of args (+2 for leading arg_count and trailing nullptr)
	ffi_type* arg_types[num_args+2];
	void* arg_array[num_args+2];
	bool success = buildArgArrays(arg_types, arg_array, num_args,
	&dataProvider);
	if (!success) {
	goto free;
	}

	// Get return type
	rtype = dataProvider.PickValueInArray<ffi_type*, NUM_TYPES>(ffi_types);

	// Create a buffer for our return value
	resp_buf = malloc(MAX_RESP_SIZE);
	if (resp_buf == NULL) {
	goto free;
	}

	// Set up our ABI
	// NOTE: fuzzing abi triggers an abort on linux-x86_64,
	// so only fuzz it on ARM
	#if MAX_ABI > 0 && defined(ARM)
	abi = static_cast<ffi_abi>(
	dataProvider.ConsumeIntegralInRange<uint32_t>(0, MAX_ABI));
	#endif
	#if HAVE_LONG_DOUBLE_VARIANT
	ffi_prep_types(abi);
	#endif

	// ============= Call Functions =============
	ret = ffi_prep_cif_var(&cif, abi, 1, num_args, rtype,
	arg_types);
	if (ret != FFI_OK) {
	goto free;
	}

	runMainFunctions(&cif, resp_buf, arg_array, &dataProvider);
	runRawFunctions(&cif, resp_buf, arg_array, &dataProvider);
	if (!args_contain_struct) {
	runJavaFunctions(&cif, resp_buf, arg_array, &dataProvider);
	}

	free:
	freeAll(arg_array, num_args, resp_buf);
	return 0;
	}