consumer.go 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914
  1. // Copyright 2023 The go-fuzz-headers Authors.
  2. //
  3. // Licensed under the Apache License, Version 2.0 (the "License");
  4. // you may not use this file except in compliance with the License.
  5. // You may obtain a copy of the License at
  6. //
  7. // http://www.apache.org/licenses/LICENSE-2.0
  8. //
  9. // Unless required by applicable law or agreed to in writing, software
  10. // distributed under the License is distributed on an "AS IS" BASIS,
  11. // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12. // See the License for the specific language governing permissions and
  13. // limitations under the License.
  14. package gofuzzheaders
  15. import (
  16. "archive/tar"
  17. "bytes"
  18. "encoding/binary"
  19. "errors"
  20. "fmt"
  21. "io"
  22. "math"
  23. "os"
  24. "path/filepath"
  25. "reflect"
  26. "strconv"
  27. "strings"
  28. "time"
  29. "unsafe"
  30. )
  31. var (
  32. MaxTotalLen uint32 = 2000000
  33. maxDepth = 100
  34. )
  35. func SetMaxTotalLen(newLen uint32) {
  36. MaxTotalLen = newLen
  37. }
  38. type ConsumeFuzzer struct {
  39. data []byte
  40. dataTotal uint32
  41. CommandPart []byte
  42. RestOfArray []byte
  43. NumberOfCalls int
  44. position uint32
  45. fuzzUnexportedFields bool
  46. curDepth int
  47. Funcs map[reflect.Type]reflect.Value
  48. }
  49. func IsDivisibleBy(n int, divisibleby int) bool {
  50. return (n % divisibleby) == 0
  51. }
  52. func NewConsumer(fuzzData []byte) *ConsumeFuzzer {
  53. return &ConsumeFuzzer{
  54. data: fuzzData,
  55. dataTotal: uint32(len(fuzzData)),
  56. Funcs: make(map[reflect.Type]reflect.Value),
  57. curDepth: 0,
  58. }
  59. }
  60. func (f *ConsumeFuzzer) Split(minCalls, maxCalls int) error {
  61. if f.dataTotal == 0 {
  62. return errors.New("could not split")
  63. }
  64. numberOfCalls := int(f.data[0])
  65. if numberOfCalls < minCalls || numberOfCalls > maxCalls {
  66. return errors.New("bad number of calls")
  67. }
  68. if int(f.dataTotal) < numberOfCalls+numberOfCalls+1 {
  69. return errors.New("length of data does not match required parameters")
  70. }
  71. // Define part 2 and 3 of the data array
  72. commandPart := f.data[1 : numberOfCalls+1]
  73. restOfArray := f.data[numberOfCalls+1:]
  74. // Just a small check. It is necessary
  75. if len(commandPart) != numberOfCalls {
  76. return errors.New("length of commandPart does not match number of calls")
  77. }
  78. // Check if restOfArray is divisible by numberOfCalls
  79. if !IsDivisibleBy(len(restOfArray), numberOfCalls) {
  80. return errors.New("length of commandPart does not match number of calls")
  81. }
  82. f.CommandPart = commandPart
  83. f.RestOfArray = restOfArray
  84. f.NumberOfCalls = numberOfCalls
  85. return nil
  86. }
  87. func (f *ConsumeFuzzer) AllowUnexportedFields() {
  88. f.fuzzUnexportedFields = true
  89. }
  90. func (f *ConsumeFuzzer) DisallowUnexportedFields() {
  91. f.fuzzUnexportedFields = false
  92. }
  93. func (f *ConsumeFuzzer) GenerateStruct(targetStruct interface{}) error {
  94. e := reflect.ValueOf(targetStruct).Elem()
  95. return f.fuzzStruct(e, false)
  96. }
  97. func (f *ConsumeFuzzer) setCustom(v reflect.Value) error {
  98. // First: see if we have a fuzz function for it.
  99. doCustom, ok := f.Funcs[v.Type()]
  100. if !ok {
  101. return fmt.Errorf("could not find a custom function")
  102. }
  103. switch v.Kind() {
  104. case reflect.Ptr:
  105. if v.IsNil() {
  106. if !v.CanSet() {
  107. return fmt.Errorf("could not use a custom function")
  108. }
  109. v.Set(reflect.New(v.Type().Elem()))
  110. }
  111. case reflect.Map:
  112. if v.IsNil() {
  113. if !v.CanSet() {
  114. return fmt.Errorf("could not use a custom function")
  115. }
  116. v.Set(reflect.MakeMap(v.Type()))
  117. }
  118. default:
  119. return fmt.Errorf("could not use a custom function")
  120. }
  121. verr := doCustom.Call([]reflect.Value{v, reflect.ValueOf(Continue{
  122. F: f,
  123. })})
  124. // check if we return an error
  125. if verr[0].IsNil() {
  126. return nil
  127. }
  128. return fmt.Errorf("could not use a custom function")
  129. }
  130. func (f *ConsumeFuzzer) fuzzStruct(e reflect.Value, customFunctions bool) error {
  131. if f.curDepth >= maxDepth {
  132. // return err or nil here?
  133. return nil
  134. }
  135. f.curDepth++
  136. defer func() { f.curDepth-- }()
  137. // We check if we should check for custom functions
  138. if customFunctions && e.IsValid() && e.CanAddr() {
  139. err := f.setCustom(e.Addr())
  140. if err != nil {
  141. return err
  142. }
  143. }
  144. switch e.Kind() {
  145. case reflect.Struct:
  146. for i := 0; i < e.NumField(); i++ {
  147. var v reflect.Value
  148. if !e.Field(i).CanSet() {
  149. if f.fuzzUnexportedFields {
  150. v = reflect.NewAt(e.Field(i).Type(), unsafe.Pointer(e.Field(i).UnsafeAddr())).Elem()
  151. }
  152. if err := f.fuzzStruct(v, customFunctions); err != nil {
  153. return err
  154. }
  155. } else {
  156. v = e.Field(i)
  157. if err := f.fuzzStruct(v, customFunctions); err != nil {
  158. return err
  159. }
  160. }
  161. }
  162. case reflect.String:
  163. str, err := f.GetString()
  164. if err != nil {
  165. return err
  166. }
  167. if e.CanSet() {
  168. e.SetString(str)
  169. }
  170. case reflect.Slice:
  171. var maxElements uint32
  172. // Byte slices should not be restricted
  173. if e.Type().String() == "[]uint8" {
  174. maxElements = 10000000
  175. } else {
  176. maxElements = 50
  177. }
  178. randQty, err := f.GetUint32()
  179. if err != nil {
  180. return err
  181. }
  182. numOfElements := randQty % maxElements
  183. if (f.dataTotal - f.position) < numOfElements {
  184. numOfElements = f.dataTotal - f.position
  185. }
  186. uu := reflect.MakeSlice(e.Type(), int(numOfElements), int(numOfElements))
  187. for i := 0; i < int(numOfElements); i++ {
  188. // If we have more than 10, then we can proceed with that.
  189. if err := f.fuzzStruct(uu.Index(i), customFunctions); err != nil {
  190. if i >= 10 {
  191. if e.CanSet() {
  192. e.Set(uu)
  193. }
  194. return nil
  195. } else {
  196. return err
  197. }
  198. }
  199. }
  200. if e.CanSet() {
  201. e.Set(uu)
  202. }
  203. case reflect.Uint16:
  204. newInt, err := f.GetUint16()
  205. if err != nil {
  206. return err
  207. }
  208. if e.CanSet() {
  209. e.SetUint(uint64(newInt))
  210. }
  211. case reflect.Uint32:
  212. newInt, err := f.GetUint32()
  213. if err != nil {
  214. return err
  215. }
  216. if e.CanSet() {
  217. e.SetUint(uint64(newInt))
  218. }
  219. case reflect.Uint64:
  220. newInt, err := f.GetInt()
  221. if err != nil {
  222. return err
  223. }
  224. if e.CanSet() {
  225. e.SetUint(uint64(newInt))
  226. }
  227. case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
  228. newInt, err := f.GetInt()
  229. if err != nil {
  230. return err
  231. }
  232. if e.CanSet() {
  233. e.SetInt(int64(newInt))
  234. }
  235. case reflect.Float32:
  236. newFloat, err := f.GetFloat32()
  237. if err != nil {
  238. return err
  239. }
  240. if e.CanSet() {
  241. e.SetFloat(float64(newFloat))
  242. }
  243. case reflect.Float64:
  244. newFloat, err := f.GetFloat64()
  245. if err != nil {
  246. return err
  247. }
  248. if e.CanSet() {
  249. e.SetFloat(float64(newFloat))
  250. }
  251. case reflect.Map:
  252. if e.CanSet() {
  253. e.Set(reflect.MakeMap(e.Type()))
  254. const maxElements = 50
  255. randQty, err := f.GetInt()
  256. if err != nil {
  257. return err
  258. }
  259. numOfElements := randQty % maxElements
  260. for i := 0; i < numOfElements; i++ {
  261. key := reflect.New(e.Type().Key()).Elem()
  262. if err := f.fuzzStruct(key, customFunctions); err != nil {
  263. return err
  264. }
  265. val := reflect.New(e.Type().Elem()).Elem()
  266. if err = f.fuzzStruct(val, customFunctions); err != nil {
  267. return err
  268. }
  269. e.SetMapIndex(key, val)
  270. }
  271. }
  272. case reflect.Ptr:
  273. if e.CanSet() {
  274. e.Set(reflect.New(e.Type().Elem()))
  275. if err := f.fuzzStruct(e.Elem(), customFunctions); err != nil {
  276. return err
  277. }
  278. return nil
  279. }
  280. case reflect.Uint8:
  281. b, err := f.GetByte()
  282. if err != nil {
  283. return err
  284. }
  285. if e.CanSet() {
  286. e.SetUint(uint64(b))
  287. }
  288. }
  289. return nil
  290. }
  291. func (f *ConsumeFuzzer) GetStringArray() (reflect.Value, error) {
  292. // The max size of the array:
  293. const max uint32 = 20
  294. arraySize := f.position
  295. if arraySize > max {
  296. arraySize = max
  297. }
  298. stringArray := reflect.MakeSlice(reflect.SliceOf(reflect.TypeOf("string")), int(arraySize), int(arraySize))
  299. if f.position+arraySize >= f.dataTotal {
  300. return stringArray, errors.New("could not make string array")
  301. }
  302. for i := 0; i < int(arraySize); i++ {
  303. stringSize := uint32(f.data[f.position])
  304. if f.position+stringSize >= f.dataTotal {
  305. return stringArray, nil
  306. }
  307. stringToAppend := string(f.data[f.position : f.position+stringSize])
  308. strVal := reflect.ValueOf(stringToAppend)
  309. stringArray = reflect.Append(stringArray, strVal)
  310. f.position += stringSize
  311. }
  312. return stringArray, nil
  313. }
  314. func (f *ConsumeFuzzer) GetInt() (int, error) {
  315. if f.position >= f.dataTotal {
  316. return 0, errors.New("not enough bytes to create int")
  317. }
  318. returnInt := int(f.data[f.position])
  319. f.position++
  320. return returnInt, nil
  321. }
  322. func (f *ConsumeFuzzer) GetByte() (byte, error) {
  323. if f.position >= f.dataTotal {
  324. return 0x00, errors.New("not enough bytes to get byte")
  325. }
  326. returnByte := f.data[f.position]
  327. f.position++
  328. return returnByte, nil
  329. }
  330. func (f *ConsumeFuzzer) GetNBytes(numberOfBytes int) ([]byte, error) {
  331. if f.position >= f.dataTotal {
  332. return nil, errors.New("not enough bytes to get byte")
  333. }
  334. returnBytes := make([]byte, 0, numberOfBytes)
  335. for i := 0; i < numberOfBytes; i++ {
  336. newByte, err := f.GetByte()
  337. if err != nil {
  338. return nil, err
  339. }
  340. returnBytes = append(returnBytes, newByte)
  341. }
  342. return returnBytes, nil
  343. }
  344. func (f *ConsumeFuzzer) GetUint16() (uint16, error) {
  345. u16, err := f.GetNBytes(2)
  346. if err != nil {
  347. return 0, err
  348. }
  349. littleEndian, err := f.GetBool()
  350. if err != nil {
  351. return 0, err
  352. }
  353. if littleEndian {
  354. return binary.LittleEndian.Uint16(u16), nil
  355. }
  356. return binary.BigEndian.Uint16(u16), nil
  357. }
  358. func (f *ConsumeFuzzer) GetUint32() (uint32, error) {
  359. u32, err := f.GetNBytes(4)
  360. if err != nil {
  361. return 0, err
  362. }
  363. return binary.BigEndian.Uint32(u32), nil
  364. }
  365. func (f *ConsumeFuzzer) GetUint64() (uint64, error) {
  366. u64, err := f.GetNBytes(8)
  367. if err != nil {
  368. return 0, err
  369. }
  370. littleEndian, err := f.GetBool()
  371. if err != nil {
  372. return 0, err
  373. }
  374. if littleEndian {
  375. return binary.LittleEndian.Uint64(u64), nil
  376. }
  377. return binary.BigEndian.Uint64(u64), nil
  378. }
  379. func (f *ConsumeFuzzer) GetBytes() ([]byte, error) {
  380. var length uint32
  381. var err error
  382. length, err = f.GetUint32()
  383. if err != nil {
  384. return nil, errors.New("not enough bytes to create byte array")
  385. }
  386. if length == 0 {
  387. length = 30
  388. }
  389. bytesLeft := f.dataTotal - f.position
  390. if bytesLeft <= 0 {
  391. return nil, errors.New("not enough bytes to create byte array")
  392. }
  393. // If the length is the same as bytes left, we will not overflow
  394. // the remaining bytes.
  395. if length != bytesLeft {
  396. length = length % bytesLeft
  397. }
  398. byteBegin := f.position
  399. if byteBegin+length < byteBegin {
  400. return nil, errors.New("numbers overflow")
  401. }
  402. f.position = byteBegin + length
  403. return f.data[byteBegin:f.position], nil
  404. }
  405. func (f *ConsumeFuzzer) GetString() (string, error) {
  406. if f.position >= f.dataTotal {
  407. return "nil", errors.New("not enough bytes to create string")
  408. }
  409. length, err := f.GetUint32()
  410. if err != nil {
  411. return "nil", errors.New("not enough bytes to create string")
  412. }
  413. if f.position > MaxTotalLen {
  414. return "nil", errors.New("created too large a string")
  415. }
  416. byteBegin := f.position
  417. if byteBegin >= f.dataTotal {
  418. return "nil", errors.New("not enough bytes to create string")
  419. }
  420. if byteBegin+length > f.dataTotal {
  421. return "nil", errors.New("not enough bytes to create string")
  422. }
  423. if byteBegin > byteBegin+length {
  424. return "nil", errors.New("numbers overflow")
  425. }
  426. f.position = byteBegin + length
  427. return string(f.data[byteBegin:f.position]), nil
  428. }
  429. func (f *ConsumeFuzzer) GetBool() (bool, error) {
  430. if f.position >= f.dataTotal {
  431. return false, errors.New("not enough bytes to create bool")
  432. }
  433. if IsDivisibleBy(int(f.data[f.position]), 2) {
  434. f.position++
  435. return true, nil
  436. } else {
  437. f.position++
  438. return false, nil
  439. }
  440. }
  441. func (f *ConsumeFuzzer) FuzzMap(m interface{}) error {
  442. return f.GenerateStruct(m)
  443. }
  444. func returnTarBytes(buf []byte) ([]byte, error) {
  445. return buf, nil
  446. // Count files
  447. var fileCounter int
  448. tr := tar.NewReader(bytes.NewReader(buf))
  449. for {
  450. _, err := tr.Next()
  451. if err == io.EOF {
  452. break
  453. }
  454. if err != nil {
  455. return nil, err
  456. }
  457. fileCounter++
  458. }
  459. if fileCounter >= 1 {
  460. return buf, nil
  461. }
  462. return nil, fmt.Errorf("not enough files were created\n")
  463. }
  464. func setTarHeaderFormat(hdr *tar.Header, f *ConsumeFuzzer) error {
  465. ind, err := f.GetInt()
  466. if err != nil {
  467. hdr.Format = tar.FormatGNU
  468. //return nil
  469. }
  470. switch ind % 4 {
  471. case 0:
  472. hdr.Format = tar.FormatUnknown
  473. case 1:
  474. hdr.Format = tar.FormatUSTAR
  475. case 2:
  476. hdr.Format = tar.FormatPAX
  477. case 3:
  478. hdr.Format = tar.FormatGNU
  479. }
  480. return nil
  481. }
  482. func setTarHeaderTypeflag(hdr *tar.Header, f *ConsumeFuzzer) error {
  483. ind, err := f.GetInt()
  484. if err != nil {
  485. return err
  486. }
  487. switch ind % 13 {
  488. case 0:
  489. hdr.Typeflag = tar.TypeReg
  490. case 1:
  491. hdr.Typeflag = tar.TypeLink
  492. linkname, err := f.GetString()
  493. if err != nil {
  494. return err
  495. }
  496. hdr.Linkname = linkname
  497. case 2:
  498. hdr.Typeflag = tar.TypeSymlink
  499. linkname, err := f.GetString()
  500. if err != nil {
  501. return err
  502. }
  503. hdr.Linkname = linkname
  504. case 3:
  505. hdr.Typeflag = tar.TypeChar
  506. case 4:
  507. hdr.Typeflag = tar.TypeBlock
  508. case 5:
  509. hdr.Typeflag = tar.TypeDir
  510. case 6:
  511. hdr.Typeflag = tar.TypeFifo
  512. case 7:
  513. hdr.Typeflag = tar.TypeCont
  514. case 8:
  515. hdr.Typeflag = tar.TypeXHeader
  516. case 9:
  517. hdr.Typeflag = tar.TypeXGlobalHeader
  518. case 10:
  519. hdr.Typeflag = tar.TypeGNUSparse
  520. case 11:
  521. hdr.Typeflag = tar.TypeGNULongName
  522. case 12:
  523. hdr.Typeflag = tar.TypeGNULongLink
  524. }
  525. return nil
  526. }
  527. func (f *ConsumeFuzzer) createTarFileBody() ([]byte, error) {
  528. return f.GetBytes()
  529. /*length, err := f.GetUint32()
  530. if err != nil {
  531. return nil, errors.New("not enough bytes to create byte array")
  532. }
  533. // A bit of optimization to attempt to create a file body
  534. // when we don't have as many bytes left as "length"
  535. remainingBytes := f.dataTotal - f.position
  536. if remainingBytes <= 0 {
  537. return nil, errors.New("created too large a string")
  538. }
  539. if f.position+length > MaxTotalLen {
  540. return nil, errors.New("created too large a string")
  541. }
  542. byteBegin := f.position
  543. if byteBegin >= f.dataTotal {
  544. return nil, errors.New("not enough bytes to create byte array")
  545. }
  546. if length == 0 {
  547. return nil, errors.New("zero-length is not supported")
  548. }
  549. if byteBegin+length >= f.dataTotal {
  550. return nil, errors.New("not enough bytes to create byte array")
  551. }
  552. if byteBegin+length < byteBegin {
  553. return nil, errors.New("numbers overflow")
  554. }
  555. f.position = byteBegin + length
  556. return f.data[byteBegin:f.position], nil*/
  557. }
  558. // getTarFileName is similar to GetString(), but creates string based
  559. // on the length of f.data to reduce the likelihood of overflowing
  560. // f.data.
  561. func (f *ConsumeFuzzer) getTarFilename() (string, error) {
  562. return f.GetString()
  563. /*length, err := f.GetUint32()
  564. if err != nil {
  565. return "nil", errors.New("not enough bytes to create string")
  566. }
  567. // A bit of optimization to attempt to create a file name
  568. // when we don't have as many bytes left as "length"
  569. remainingBytes := f.dataTotal - f.position
  570. if remainingBytes <= 0 {
  571. return "nil", errors.New("created too large a string")
  572. }
  573. if f.position > MaxTotalLen {
  574. return "nil", errors.New("created too large a string")
  575. }
  576. byteBegin := f.position
  577. if byteBegin >= f.dataTotal {
  578. return "nil", errors.New("not enough bytes to create string")
  579. }
  580. if byteBegin+length > f.dataTotal {
  581. return "nil", errors.New("not enough bytes to create string")
  582. }
  583. if byteBegin > byteBegin+length {
  584. return "nil", errors.New("numbers overflow")
  585. }
  586. f.position = byteBegin + length
  587. return string(f.data[byteBegin:f.position]), nil*/
  588. }
  589. type TarFile struct {
  590. Hdr *tar.Header
  591. Body []byte
  592. }
  593. // TarBytes returns valid bytes for a tar archive
  594. func (f *ConsumeFuzzer) TarBytes() ([]byte, error) {
  595. numberOfFiles, err := f.GetInt()
  596. if err != nil {
  597. return nil, err
  598. }
  599. var tarFiles []*TarFile
  600. tarFiles = make([]*TarFile, 0)
  601. const maxNoOfFiles = 100
  602. for i := 0; i < numberOfFiles%maxNoOfFiles; i++ {
  603. var filename string
  604. var filebody []byte
  605. var sec, nsec int
  606. var err error
  607. filename, err = f.getTarFilename()
  608. if err != nil {
  609. var sb strings.Builder
  610. sb.WriteString("file-")
  611. sb.WriteString(strconv.Itoa(i))
  612. filename = sb.String()
  613. }
  614. filebody, err = f.createTarFileBody()
  615. if err != nil {
  616. var sb strings.Builder
  617. sb.WriteString("filebody-")
  618. sb.WriteString(strconv.Itoa(i))
  619. filebody = []byte(sb.String())
  620. }
  621. sec, err = f.GetInt()
  622. if err != nil {
  623. sec = 1672531200 // beginning of 2023
  624. }
  625. nsec, err = f.GetInt()
  626. if err != nil {
  627. nsec = 1703980800 // end of 2023
  628. }
  629. hdr := &tar.Header{
  630. Name: filename,
  631. Size: int64(len(filebody)),
  632. Mode: 0o600,
  633. ModTime: time.Unix(int64(sec), int64(nsec)),
  634. }
  635. if err := setTarHeaderTypeflag(hdr, f); err != nil {
  636. return []byte(""), err
  637. }
  638. if err := setTarHeaderFormat(hdr, f); err != nil {
  639. return []byte(""), err
  640. }
  641. tf := &TarFile{
  642. Hdr: hdr,
  643. Body: filebody,
  644. }
  645. tarFiles = append(tarFiles, tf)
  646. }
  647. var buf bytes.Buffer
  648. tw := tar.NewWriter(&buf)
  649. defer tw.Close()
  650. for _, tf := range tarFiles {
  651. tw.WriteHeader(tf.Hdr)
  652. tw.Write(tf.Body)
  653. }
  654. return buf.Bytes(), nil
  655. }
  656. // This is similar to TarBytes, but it returns a series of
  657. // files instead of raw tar bytes. The advantage of this
  658. // api is that it is cheaper in terms of cpu power to
  659. // modify or check the files in the fuzzer with TarFiles()
  660. // because it avoids creating a tar reader.
  661. func (f *ConsumeFuzzer) TarFiles() ([]*TarFile, error) {
  662. numberOfFiles, err := f.GetInt()
  663. if err != nil {
  664. return nil, err
  665. }
  666. var tarFiles []*TarFile
  667. tarFiles = make([]*TarFile, 0)
  668. const maxNoOfFiles = 100
  669. for i := 0; i < numberOfFiles%maxNoOfFiles; i++ {
  670. filename, err := f.getTarFilename()
  671. if err != nil {
  672. return tarFiles, err
  673. }
  674. filebody, err := f.createTarFileBody()
  675. if err != nil {
  676. return tarFiles, err
  677. }
  678. sec, err := f.GetInt()
  679. if err != nil {
  680. return tarFiles, err
  681. }
  682. nsec, err := f.GetInt()
  683. if err != nil {
  684. return tarFiles, err
  685. }
  686. hdr := &tar.Header{
  687. Name: filename,
  688. Size: int64(len(filebody)),
  689. Mode: 0o600,
  690. ModTime: time.Unix(int64(sec), int64(nsec)),
  691. }
  692. if err := setTarHeaderTypeflag(hdr, f); err != nil {
  693. hdr.Typeflag = tar.TypeReg
  694. }
  695. if err := setTarHeaderFormat(hdr, f); err != nil {
  696. return tarFiles, err // should not happend
  697. }
  698. tf := &TarFile{
  699. Hdr: hdr,
  700. Body: filebody,
  701. }
  702. tarFiles = append(tarFiles, tf)
  703. }
  704. return tarFiles, nil
  705. }
  706. // CreateFiles creates pseudo-random files in rootDir.
  707. // It creates subdirs and places the files there.
  708. // It is the callers responsibility to ensure that
  709. // rootDir exists.
  710. func (f *ConsumeFuzzer) CreateFiles(rootDir string) error {
  711. numberOfFiles, err := f.GetInt()
  712. if err != nil {
  713. return err
  714. }
  715. maxNumberOfFiles := numberOfFiles % 4000 // This is completely arbitrary
  716. if maxNumberOfFiles == 0 {
  717. return errors.New("maxNumberOfFiles is nil")
  718. }
  719. var noOfCreatedFiles int
  720. for i := 0; i < maxNumberOfFiles; i++ {
  721. // The file to create:
  722. fileName, err := f.GetString()
  723. if err != nil {
  724. if noOfCreatedFiles > 0 {
  725. // If files have been created, we don't return an error.
  726. break
  727. } else {
  728. return errors.New("could not get fileName")
  729. }
  730. }
  731. if strings.Contains(fileName, "..") || (len(fileName) > 0 && fileName[0] == 47) || strings.Contains(fileName, "\\") {
  732. continue
  733. }
  734. fullFilePath := filepath.Join(rootDir, fileName)
  735. // Find the subdirectory of the file
  736. if subDir := filepath.Dir(fileName); subDir != "" && subDir != "." {
  737. // create the dir first; avoid going outside the root dir
  738. if strings.Contains(subDir, "../") || (len(subDir) > 0 && subDir[0] == 47) || strings.Contains(subDir, "\\") {
  739. continue
  740. }
  741. dirPath := filepath.Join(rootDir, subDir)
  742. if _, err := os.Stat(dirPath); os.IsNotExist(err) {
  743. err2 := os.MkdirAll(dirPath, 0o777)
  744. if err2 != nil {
  745. continue
  746. }
  747. }
  748. fullFilePath = filepath.Join(dirPath, fileName)
  749. } else {
  750. // Create symlink
  751. createSymlink, err := f.GetBool()
  752. if err != nil {
  753. if noOfCreatedFiles > 0 {
  754. break
  755. } else {
  756. return errors.New("could not create the symlink")
  757. }
  758. }
  759. if createSymlink {
  760. symlinkTarget, err := f.GetString()
  761. if err != nil {
  762. return err
  763. }
  764. err = os.Symlink(symlinkTarget, fullFilePath)
  765. if err != nil {
  766. return err
  767. }
  768. // stop loop here, since a symlink needs no further action
  769. noOfCreatedFiles++
  770. continue
  771. }
  772. // We create a normal file
  773. fileContents, err := f.GetBytes()
  774. if err != nil {
  775. if noOfCreatedFiles > 0 {
  776. break
  777. } else {
  778. return errors.New("could not create the file")
  779. }
  780. }
  781. err = os.WriteFile(fullFilePath, fileContents, 0o666)
  782. if err != nil {
  783. continue
  784. }
  785. noOfCreatedFiles++
  786. }
  787. }
  788. return nil
  789. }
  790. // GetStringFrom returns a string that can only consist of characters
  791. // included in possibleChars. It returns an error if the created string
  792. // does not have the specified length.
  793. func (f *ConsumeFuzzer) GetStringFrom(possibleChars string, length int) (string, error) {
  794. if (f.dataTotal - f.position) < uint32(length) {
  795. return "", errors.New("not enough bytes to create a string")
  796. }
  797. output := make([]byte, 0, length)
  798. for i := 0; i < length; i++ {
  799. charIndex, err := f.GetInt()
  800. if err != nil {
  801. return string(output), err
  802. }
  803. output = append(output, possibleChars[charIndex%len(possibleChars)])
  804. }
  805. return string(output), nil
  806. }
  807. func (f *ConsumeFuzzer) GetRune() ([]rune, error) {
  808. stringToConvert, err := f.GetString()
  809. if err != nil {
  810. return []rune("nil"), err
  811. }
  812. return []rune(stringToConvert), nil
  813. }
  814. func (f *ConsumeFuzzer) GetFloat32() (float32, error) {
  815. u32, err := f.GetNBytes(4)
  816. if err != nil {
  817. return 0, err
  818. }
  819. littleEndian, err := f.GetBool()
  820. if err != nil {
  821. return 0, err
  822. }
  823. if littleEndian {
  824. u32LE := binary.LittleEndian.Uint32(u32)
  825. return math.Float32frombits(u32LE), nil
  826. }
  827. u32BE := binary.BigEndian.Uint32(u32)
  828. return math.Float32frombits(u32BE), nil
  829. }
  830. func (f *ConsumeFuzzer) GetFloat64() (float64, error) {
  831. u64, err := f.GetNBytes(8)
  832. if err != nil {
  833. return 0, err
  834. }
  835. littleEndian, err := f.GetBool()
  836. if err != nil {
  837. return 0, err
  838. }
  839. if littleEndian {
  840. u64LE := binary.LittleEndian.Uint64(u64)
  841. return math.Float64frombits(u64LE), nil
  842. }
  843. u64BE := binary.BigEndian.Uint64(u64)
  844. return math.Float64frombits(u64BE), nil
  845. }
  846. func (f *ConsumeFuzzer) CreateSlice(targetSlice interface{}) error {
  847. return f.GenerateStruct(targetSlice)
  848. }