|
| 1 | +// Licensed to the .NET Foundation under one or more agreements. |
| 2 | +// The .NET Foundation licenses this file to you under the MIT license. |
| 3 | + |
| 4 | +using System.Buffers; |
| 5 | +using System.Formats.Nrbf; |
| 6 | +using System.Runtime.Serialization; |
| 7 | +using System.Text; |
| 8 | + |
| 9 | +namespace DotnetFuzzing.Fuzzers |
| 10 | +{ |
| 11 | + internal sealed class NrbfDecoderFuzzer : IFuzzer |
| 12 | + { |
| 13 | + public string[] TargetAssemblies { get; } = ["System.Formats.Nrbf"]; |
| 14 | + |
| 15 | + public string[] TargetCoreLibPrefixes => []; |
| 16 | + |
| 17 | + public string Dictionary => "nrbfdecoder.dict"; |
| 18 | + |
| 19 | + public void FuzzTarget(ReadOnlySpan<byte> bytes) |
| 20 | + { |
| 21 | + Test(bytes, PoisonPagePlacement.Before); |
| 22 | + Test(bytes, PoisonPagePlacement.After); |
| 23 | + } |
| 24 | + |
| 25 | + private static void Test(ReadOnlySpan<byte> bytes, PoisonPagePlacement poisonPagePlacement) |
| 26 | + { |
| 27 | + using PooledBoundedMemory<byte> inputPoisoned = PooledBoundedMemory<byte>.Rent(bytes, poisonPagePlacement); |
| 28 | + |
| 29 | + using MemoryStream seekableStream = new(inputPoisoned.Memory.ToArray()); |
| 30 | + Test(inputPoisoned.Span, seekableStream); |
| 31 | + |
| 32 | + // NrbfDecoder has few code paths dedicated to non-seekable streams, let's test them as well. |
| 33 | + using NonSeekableStream nonSeekableStream = new(inputPoisoned.Memory.ToArray()); |
| 34 | + Test(inputPoisoned.Span, nonSeekableStream); |
| 35 | + } |
| 36 | + |
| 37 | + private static void Test(Span<byte> testSpan, Stream stream) |
| 38 | + { |
| 39 | + if (NrbfDecoder.StartsWithPayloadHeader(testSpan)) |
| 40 | + { |
| 41 | + try |
| 42 | + { |
| 43 | + SerializationRecord record = NrbfDecoder.Decode(stream, out IReadOnlyDictionary<SerializationRecordId, SerializationRecord> recordMap); |
| 44 | + switch (record.RecordType) |
| 45 | + { |
| 46 | + case SerializationRecordType.ArraySingleObject: |
| 47 | + SZArrayRecord<object?> arrayObj = (SZArrayRecord<object?>)record; |
| 48 | + object?[] objArray = arrayObj.GetArray(); |
| 49 | + Assert.Equal(arrayObj.Length, objArray.Length); |
| 50 | + Assert.Equal(1, arrayObj.Rank); |
| 51 | + break; |
| 52 | + case SerializationRecordType.ArraySingleString: |
| 53 | + SZArrayRecord<string?> arrayString = (SZArrayRecord<string?>)record; |
| 54 | + string?[] array = arrayString.GetArray(); |
| 55 | + Assert.Equal(arrayString.Length, array.Length); |
| 56 | + Assert.Equal(1, arrayString.Rank); |
| 57 | + Assert.Equal(true, arrayString.TypeNameMatches(typeof(string[]))); |
| 58 | + break; |
| 59 | + case SerializationRecordType.ArraySinglePrimitive: |
| 60 | + case SerializationRecordType.BinaryArray: |
| 61 | + ArrayRecord arrayBinary = (ArrayRecord)record; |
| 62 | + Assert.NotNull(arrayBinary.TypeName); |
| 63 | + break; |
| 64 | + case SerializationRecordType.BinaryObjectString: |
| 65 | + _ = ((PrimitiveTypeRecord<string>)record).Value; |
| 66 | + break; |
| 67 | + case SerializationRecordType.ClassWithId: |
| 68 | + case SerializationRecordType.ClassWithMembersAndTypes: |
| 69 | + case SerializationRecordType.SystemClassWithMembersAndTypes: |
| 70 | + ClassRecord classRecord = (ClassRecord)record; |
| 71 | + Assert.NotNull(classRecord.TypeName); |
| 72 | + |
| 73 | + foreach (string name in classRecord.MemberNames) |
| 74 | + { |
| 75 | + Assert.Equal(true, classRecord.HasMember(name)); |
| 76 | + } |
| 77 | + break; |
| 78 | + case SerializationRecordType.MemberPrimitiveTyped: |
| 79 | + PrimitiveTypeRecord primitiveType = (PrimitiveTypeRecord)record; |
| 80 | + Assert.NotNull(primitiveType.Value); |
| 81 | + break; |
| 82 | + case SerializationRecordType.MemberReference: |
| 83 | + Assert.NotNull(record.TypeName); |
| 84 | + break; |
| 85 | + case SerializationRecordType.BinaryLibrary: |
| 86 | + Assert.Equal(false, record.Id.Equals(default)); |
| 87 | + break; |
| 88 | + case SerializationRecordType.ObjectNull: |
| 89 | + case SerializationRecordType.ObjectNullMultiple: |
| 90 | + case SerializationRecordType.ObjectNullMultiple256: |
| 91 | + Assert.Equal(default, record.Id); |
| 92 | + break; |
| 93 | + case SerializationRecordType.MessageEnd: |
| 94 | + case SerializationRecordType.SerializedStreamHeader: |
| 95 | + // case SerializationRecordType.ClassWithMembers: will cause NotSupportedException |
| 96 | + // case SerializationRecordType.SystemClassWithMembers: will cause NotSupportedException |
| 97 | + default: |
| 98 | + throw new Exception("Unexpected RecordType"); |
| 99 | + } |
| 100 | + } |
| 101 | + catch (SerializationException) { /* Reading from the stream encountered invalid NRBF data.*/ } |
| 102 | + catch (NotSupportedException) { /* Reading from the stream encountered unsupported records */ } |
| 103 | + catch (DecoderFallbackException) { /* Reading from the stream encountered an invalid UTF8 sequence. */ } |
| 104 | + catch (EndOfStreamException) { /* The end of the stream was reached before reading SerializationRecordType.MessageEnd record. */ } |
| 105 | + catch (IOException) { /* An I/O error occurred. */ } |
| 106 | + } |
| 107 | + else |
| 108 | + { |
| 109 | + try |
| 110 | + { |
| 111 | + NrbfDecoder.Decode(stream); |
| 112 | + throw new Exception("Decoding supposed to fail!"); |
| 113 | + } |
| 114 | + catch (SerializationException) { /* Everything has to start with a header */ } |
| 115 | + catch (NotSupportedException) { /* Reading from the stream encountered unsupported records */ } |
| 116 | + catch (EndOfStreamException) { /* The end of the stream was reached before reading SerializationRecordType.MessageEnd record. */ } |
| 117 | + } |
| 118 | + } |
| 119 | + |
| 120 | + private class NonSeekableStream : MemoryStream |
| 121 | + { |
| 122 | + public NonSeekableStream(byte[] buffer) : base(buffer) { } |
| 123 | + public override bool CanSeek => false; |
| 124 | + } |
| 125 | + } |
| 126 | +} |
0 commit comments