/** * Copyright (c) 2020-2022 Christian Reitter * * Permission is hereby granted, free of charge, to any person obtaining * a copy of this software and associated documentation files (the "Software"), * to deal in the Software without restriction, including without limitation * the rights to use, copy, modify, merge, publish, distribute, sublicense, * and/or sell copies of the Software, and to permit persons to whom the * Software is furnished to do so, subject to the following conditions: * * The above copyright notice and this permission notice shall be included * in all copies or substantial portions of the Software. * * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES * OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR * OTHER DEALINGS IN THE SOFTWARE. */ #include <math.h> #include <stdint.h> #include <stdio.h> #include <stdlib.h> #include <string.h> // includes for potential target functions // based on test_check.c #include "address.h" #include "aes/aes.h" #include "base32.h" #include "base58.h" #include "bignum.h" #include "bip32.h" #include "bip39.h" #include "blake256.h" #include "blake2b.h" #include "blake2s.h" #include "chacha_drbg.h" #include "curves.h" #include "ecdsa.h" #include "ecdsa_internal.h" #include "ed25519-donna/ed25519-donna.h" #include "ed25519-donna/ed25519-keccak.h" #include "ed25519-donna/ed25519.h" #include "hasher.h" #include "hmac_drbg.h" #include "memzero.h" #include "monero/monero.h" #include "nem.h" #include "nist256p1.h" #include "pbkdf2.h" #include "rand.h" #include "rc4.h" #include "rfc6979.h" #include "script.h" #include "secp256k1.h" #include "segwit_addr.h" #include "sha2.h" #include "sha3.h" #include "shamir.h" #include "slip39.h" #include "slip39_wordlist.h" #include "zkp_bip340.h" #include "zkp_context.h" #include "zkp_ecdsa.h" #if defined(__has_feature) #if __has_feature(memory_sanitizer) #include <sanitizer/msan_interface.h> #endif #endif #ifndef FUZZ_HONGGFUZZ // Recent libFuzzer implementations support marking inputs as non-interesting // via return -1; instead of the regular return 0; // see // https://github.com/llvm/llvm-project/commit/92fb310151d2b1e349695fc0f1c5d5d50afb3b52 #define FUZZ_MARK_UNINTERESTING -1 #else // honggfuzz does not understand the special code // use regular return code to avoid issues #define FUZZ_MARK_UNINTERESTING 0 #endif /* Code design notes * * By combining many individual function harnesses into one binary, a * collection of target functions can be fuzzed collectively without handling * dozens of individual binaries or corpus directories * As a tradeoff, the fuzzing is expected to be less efficient due to * statistically less successful input crossover or dictionary use * * If required, an exclusive target function can be picked at compile time * for more narrow testing */ /* Code performance notes * * Use #define over runtime checks for performance reasons * Avoid VLA arrays for performance reasons * Potential performance drawbacks of heap usage are accepted for better out of * bounds error detection * Some expensive functions are hidden with compile-time switches * Fuzzer harnesses are meant to exit early if the preconditions are not met */ /* Fuzzer input data handling */ const uint8_t *fuzzer_ptr; size_t fuzzer_length; const uint8_t *fuzzer_input(size_t len) { if (fuzzer_length < len) { fuzzer_length = 0; return NULL; } const uint8_t *result = fuzzer_ptr; fuzzer_length -= len; fuzzer_ptr += len; return result; } /* Fuzzer state handling */ void fuzzer_reset_state(void) { // reset the PRNGs to make individual fuzzer runs deterministic srand(0); random_reseed(0); // clear internal caches // note: this is not strictly required for all fuzzer targets #if USE_BIP32_CACHE bip32_cache_clear(); #endif #if USE_BIP39_CACHE bip39_cache_clear(); #endif } __attribute__((noreturn)) void crash(void) { // intentionally exit the program // the fuzzer framework treats this as a crash exit(1); } // IDEA are there advantages to turning this into a macro? // // check the memory area for memory information leaks if MSAN is available, // crash if problems are detected void check_msan(void *pointer, size_t length) { #if defined(__has_feature) #if __has_feature(memory_sanitizer) // check `address` for memory info leakage __msan_check_mem_is_initialized(pointer, length); #else // ignore if MSan is not enabled (void)pointer; (void)length; #endif #else // ignore if the compiler does not know __has_feature() (void)pointer; (void)length; #endif } // simplify the pointer check after a var_pointer = malloc() // the return code marks the fuzz input as uninteresting for the fuzz engine // warning: use only if no manual memory cleanup is needed #define RETURN_IF_NULL(var_pointer) \ if (var_pointer == NULL) { \ return FUZZ_MARK_UNINTERESTING; \ } void zkp_initialize_context_or_crash(void) { // The current context usage has persistent side effects // TODO switch to frequent re-initialization where necessary if (!zkp_context_is_initialized()) { if (zkp_context_init() != 0) { crash(); } } } /* Individual fuzzer harness functions */ int fuzz_bn_format(void) { bignum256 target_bignum; // we need some amount of initial data if (fuzzer_length < sizeof(target_bignum) + 1 + 1) { return FUZZ_MARK_UNINTERESTING; } #define FUZZ_BN_FORMAT_OUTPUT_BUFFER_SIZE 512 char buf[FUZZ_BN_FORMAT_OUTPUT_BUFFER_SIZE] = {0}; int ret = 0; // mutate the struct contents memcpy(&target_bignum, fuzzer_input(sizeof(target_bignum)), sizeof(target_bignum)); uint8_t prefixlen = 0; uint8_t suffixlen = 0; uint32_t decimals = 0; int32_t exponent = 0; bool trailing = false; // range 1 to 128 prefixlen = (fuzzer_input(1)[0] & 127) + 1; suffixlen = (fuzzer_input(1)[0] & 127) + 1; // check for the second half of the data if (fuzzer_length < (size_t)(prefixlen + suffixlen + 4 + 4 + 1 - 2)) { return FUZZ_MARK_UNINTERESTING; } memcpy(&decimals, fuzzer_input(4), 4); memcpy(&exponent, fuzzer_input(4), 4); trailing = (fuzzer_input(1)[0] & 1); // IDEA allow prefix == NULL char *prefix = malloc(prefixlen); RETURN_IF_NULL(prefix); // IDEA allow suffix == NULL char *suffix = malloc(suffixlen); if (suffix == NULL) { free(prefix); return FUZZ_MARK_UNINTERESTING; } memset(prefix, 0, prefixlen); memset(suffix, 0, suffixlen); // only fetch up to (length - 1) to ensure null termination together with the // memset memcpy(prefix, fuzzer_input(prefixlen - 1), prefixlen - 1); memcpy(suffix, fuzzer_input(suffixlen - 1), suffixlen - 1); ret = bn_format(&target_bignum, prefix, suffix, decimals, exponent, trailing, 0, buf, FUZZ_BN_FORMAT_OUTPUT_BUFFER_SIZE); // basic sanity checks for the return values if (ret > FUZZ_BN_FORMAT_OUTPUT_BUFFER_SIZE) { crash(); } check_msan(&buf, FUZZ_BN_FORMAT_OUTPUT_BUFFER_SIZE); free(prefix); free(suffix); return 0; } // arbitrarily chosen maximum size #define BASE32_DECODE_MAX_INPUT_LEN 512 int fuzz_base32_decode(void) { if (fuzzer_length < 2 || fuzzer_length > BASE32_DECODE_MAX_INPUT_LEN) { return FUZZ_MARK_UNINTERESTING; } char *in_buffer = malloc(fuzzer_length); RETURN_IF_NULL(in_buffer); // basic heuristic: the decoded output will always fit in less or equal space uint8_t *out_buffer = malloc(fuzzer_length); if (out_buffer == NULL) { free(in_buffer); return FUZZ_MARK_UNINTERESTING; } size_t outlen = fuzzer_length; size_t raw_inlen = fuzzer_length; memcpy(in_buffer, fuzzer_input(raw_inlen), raw_inlen); // null-terminate input buffer to prevent issues with strlen() in_buffer[raw_inlen - 1] = 0; uint8_t *ret = base32_decode(in_buffer, raw_inlen, out_buffer, outlen, BASE32_ALPHABET_RFC4648); if (ret != NULL) { check_msan(out_buffer, outlen); } free(in_buffer); free(out_buffer); return 0; } // arbitrarily chosen maximum size #define BASE32_ENCODE_MAX_INPUT_LEN 512 int fuzz_base32_encode(void) { if (fuzzer_length > BASE32_ENCODE_MAX_INPUT_LEN) { return FUZZ_MARK_UNINTERESTING; } uint8_t *in_buffer = malloc(fuzzer_length); RETURN_IF_NULL(in_buffer); // TODO: find a better heuristic for output buffer size size_t outlen = 2 * fuzzer_length; char *out_buffer = malloc(outlen); if (out_buffer == NULL) { free(in_buffer); return FUZZ_MARK_UNINTERESTING; } // mutate in_buffer size_t raw_inlen = fuzzer_length; memcpy(in_buffer, fuzzer_ptr, raw_inlen); fuzzer_input(raw_inlen); char *ret = base32_encode(in_buffer, raw_inlen, out_buffer, outlen, BASE32_ALPHABET_RFC4648); if (ret != NULL) { // the return value is a pointer to the end of the written buffer, // use it to calculate the used buffer area check_msan(out_buffer, ret - out_buffer); } free(in_buffer); free(out_buffer); return 0; } // internal limit is 128, try some extra bytes #define BASE58_ENCODE_MAX_INPUT_LEN 140 int fuzz_base58_encode_check(void) { if (fuzzer_length > BASE58_ENCODE_MAX_INPUT_LEN) { return FUZZ_MARK_UNINTERESTING; } uint8_t *in_buffer = malloc(fuzzer_length); RETURN_IF_NULL(in_buffer); // TODO: find a better heuristic for output buffer size size_t outlen = 2 * fuzzer_length; char *out_buffer = malloc(outlen); if (out_buffer == NULL) { free(in_buffer); return FUZZ_MARK_UNINTERESTING; } // mutate in_buffer size_t raw_inlen = fuzzer_length; memcpy(in_buffer, fuzzer_input(raw_inlen), raw_inlen); int ret = 0; // run multiple hasher variants for the same input base58_encode_check(in_buffer, raw_inlen, HASHER_SHA2D, out_buffer, outlen); base58_encode_check(in_buffer, raw_inlen, HASHER_BLAKED, out_buffer, outlen); base58_encode_check(in_buffer, raw_inlen, HASHER_GROESTLD_TRUNC, out_buffer, outlen); ret = base58_encode_check(in_buffer, raw_inlen, HASHER_SHA3K, out_buffer, outlen); // check one of the encode results if (ret != 0) { // the return value describes how many characters are written check_msan(out_buffer, ret); } free(in_buffer); free(out_buffer); return 0; } // internal limit is 128, try some extra bytes #define BASE58_DECODE_MAX_INPUT_LEN 140 int fuzz_base58_decode_check(void) { if (fuzzer_length > BASE58_DECODE_MAX_INPUT_LEN) { return FUZZ_MARK_UNINTERESTING; } uint8_t *in_buffer = malloc(fuzzer_length + 1); RETURN_IF_NULL(in_buffer); size_t raw_inlen = fuzzer_length; memcpy(in_buffer, fuzzer_input(raw_inlen), raw_inlen); uint8_t out_buffer[MAX_ADDR_RAW_SIZE] = {0}; // force null-termination in_buffer[raw_inlen] = 0; const char *in_char = (const char *)in_buffer; // run multiple hasher variants for the same input base58_decode_check(in_char, HASHER_SHA2D, out_buffer, MAX_ADDR_RAW_SIZE); base58_decode_check(in_char, HASHER_BLAKED, out_buffer, MAX_ADDR_RAW_SIZE); base58_decode_check(in_char, HASHER_GROESTLD_TRUNC, out_buffer, MAX_ADDR_RAW_SIZE); base58_decode_check(in_char, HASHER_SHA3K, out_buffer, MAX_ADDR_RAW_SIZE); check_msan(out_buffer, MAX_ADDR_RAW_SIZE); free(in_buffer); return 0; } // arbitrarily chosen maximum size meant to limit input complexity // there is no input size limit for the target function #define XMR_BASE58_ADDR_DECODE_MAX_INPUT_LEN 512 int fuzz_xmr_base58_addr_decode_check(void) { if (fuzzer_length > XMR_BASE58_ADDR_DECODE_MAX_INPUT_LEN) { return FUZZ_MARK_UNINTERESTING; } // TODO no null termination used !? // TODO use better size heuristic size_t outlen = fuzzer_length; char *in_buffer = malloc(fuzzer_length); RETURN_IF_NULL(in_buffer); uint8_t *out_buffer = malloc(outlen); if (out_buffer == NULL) { free(in_buffer); return FUZZ_MARK_UNINTERESTING; } // tag is only written to uint64_t tag = 0; size_t raw_inlen = fuzzer_length; // mutate in_buffer memcpy(in_buffer, fuzzer_input(raw_inlen), raw_inlen); int ret = xmr_base58_addr_decode_check(in_buffer, raw_inlen, &tag, out_buffer, outlen); // IDEA check tag for expected values? // IDEA re-encode valid decoding results to check function consistency? if (ret != 0) { check_msan(out_buffer, outlen); } free(in_buffer); free(out_buffer); return 0; } // arbitrarily chosen maximum size #define XMR_BASE58_DECODE_MAX_INPUT_LEN 512 // a more focused variant of the xmr_base58_addr_decode_check() harness int fuzz_xmr_base58_decode(void) { if (fuzzer_length > XMR_BASE58_DECODE_MAX_INPUT_LEN) { return FUZZ_MARK_UNINTERESTING; } // TODO better size heuristic size_t outlen = fuzzer_length; char *in_buffer = malloc(fuzzer_length); RETURN_IF_NULL(in_buffer); uint8_t *out_buffer = malloc(outlen); if (out_buffer == NULL) { free(in_buffer); return FUZZ_MARK_UNINTERESTING; } memset(out_buffer, 0, outlen); // mutate in_buffer size_t raw_inlen = fuzzer_length; memcpy(in_buffer, fuzzer_input(raw_inlen), raw_inlen); xmr_base58_decode(in_buffer, raw_inlen, out_buffer, &outlen); free(in_buffer); free(out_buffer); return 0; } // arbitrarily chosen maximum size #define XMR_BASE58_ADDR_ENCODE_MAX_INPUT_LEN 140 int fuzz_xmr_base58_addr_encode_check(void) { // tag_in is internally limited uint8_t tag_in; int ret1 = 0; size_t tag_size = sizeof(tag_in); if (fuzzer_length < tag_size + 1 || fuzzer_length > XMR_BASE58_ADDR_ENCODE_MAX_INPUT_LEN) { return FUZZ_MARK_UNINTERESTING; } // mutate tag_in memcpy(&tag_in, fuzzer_input(tag_size), tag_size); // TODO better size heuristic size_t outlen = fuzzer_length * 2; uint8_t *in_buffer = malloc(fuzzer_length); RETURN_IF_NULL(in_buffer); char *out_buffer = malloc(outlen); if (out_buffer == NULL) { free(in_buffer); return FUZZ_MARK_UNINTERESTING; } memset(out_buffer, 0, outlen); // mutate in_buffer size_t raw_inlen = fuzzer_length; memcpy(in_buffer, fuzzer_input(raw_inlen), raw_inlen); ret1 = xmr_base58_addr_encode_check(tag_in, in_buffer, raw_inlen, out_buffer, outlen); if (ret1 != 0) { // encoding successful uint64_t second_tag = 0; // TODO improve length uint8_t dummy_buffer[XMR_BASE58_ADDR_ENCODE_MAX_INPUT_LEN] = {0}; int ret2 = 0; // ret1 represents the actual length of the encoded string // this is important for the decode function to succeed ret2 = xmr_base58_addr_decode_check(out_buffer, ret1, &second_tag, dummy_buffer, sizeof(dummy_buffer)); // the tag comparison is between unequal types, but this is acceptable here if (ret2 == 0 || tag_in != second_tag) { crash(); } } free(in_buffer); free(out_buffer); return 0; } // arbitrarily chosen maximum size #define XMR_BASE58_ENCODE_MAX_INPUT_LEN 512 // a more focused variant of the xmr_base58_addr_encode_check() harness int fuzz_xmr_base58_encode(void) { if (fuzzer_length > XMR_BASE58_ENCODE_MAX_INPUT_LEN) { return FUZZ_MARK_UNINTERESTING; } // TODO better size heuristic size_t outlen = fuzzer_length * 2; uint8_t *in_buffer = malloc(fuzzer_length); RETURN_IF_NULL(in_buffer); char *out_buffer = malloc(outlen); if (out_buffer == NULL) { free(in_buffer); return FUZZ_MARK_UNINTERESTING; } memset(out_buffer, 0, outlen); // mutate in_buffer size_t raw_inlen = fuzzer_length; memcpy(in_buffer, fuzzer_input(raw_inlen), raw_inlen); xmr_base58_encode(out_buffer, &outlen, in_buffer, raw_inlen); free(in_buffer); free(out_buffer); return 0; } int fuzz_xmr_serialize_varint(void) { // arbitrarily chosen maximum size #define XMR_SERIALIZE_VARINT_MAX_INPUT_LEN 128 uint64_t varint_in; size_t varint_in_size = sizeof(varint_in); if (fuzzer_length <= varint_in_size || fuzzer_length > XMR_SERIALIZE_VARINT_MAX_INPUT_LEN) { return FUZZ_MARK_UNINTERESTING; } uint8_t out_buffer[XMR_SERIALIZE_VARINT_MAX_INPUT_LEN] = {0}; size_t outlen = sizeof(out_buffer); uint64_t varint_out = 0; // mutate varint_in memcpy(&varint_in, fuzzer_input(varint_in_size), varint_in_size); // mutate in_buffer size_t raw_inlen = fuzzer_length; uint8_t *in_buffer = malloc(raw_inlen); RETURN_IF_NULL(in_buffer); memcpy(in_buffer, fuzzer_input(raw_inlen), raw_inlen); // use the varint xmr_size_varint(varint_in); xmr_write_varint(out_buffer, outlen, varint_in); // use the input buffer xmr_read_varint(in_buffer, raw_inlen, &varint_out); // IDEA cross-check write/read results free(in_buffer); return 0; } // arbitrarily chosen maximum size #define NEM_VALIDATE_ADDRESS_MAX_INPUT_LEN 128 int fuzz_nem_validate_address(void) { if (fuzzer_length < 1 || fuzzer_length > NEM_VALIDATE_ADDRESS_MAX_INPUT_LEN) { return FUZZ_MARK_UNINTERESTING; } uint8_t network = fuzzer_input(1)[0]; size_t raw_inlen = fuzzer_length + 1; char *in_buffer = malloc(raw_inlen); RETURN_IF_NULL(in_buffer); // mutate the buffer memcpy(in_buffer, fuzzer_input(raw_inlen - 1), raw_inlen - 1); // force null-termination in_buffer[raw_inlen - 1] = 0; nem_validate_address(in_buffer, network); free(in_buffer); return 0; } int fuzz_nem_get_address(void) { unsigned char ed25519_public_key_fuzz[32] = {0}; uint8_t version = 0; // TODO switch to < comparison? if (fuzzer_length != (sizeof(ed25519_public_key_fuzz) + sizeof(version))) { return FUZZ_MARK_UNINTERESTING; } char address[NEM_ADDRESS_SIZE + 1] = {0}; memcpy(ed25519_public_key_fuzz, fuzzer_input(sizeof(ed25519_public_key_fuzz)), sizeof(ed25519_public_key_fuzz)); memcpy(&version, fuzzer_input(sizeof(version)), sizeof(version)); nem_get_address(ed25519_public_key_fuzz, version, address); check_msan(&address, sizeof(address)); return 0; } int fuzz_xmr_get_subaddress_secret_key(void) { bignum256modm m = {0}; uint32_t major = 0; uint32_t minor = 0; if (fuzzer_length != (sizeof(bignum256modm) + 2 * sizeof(uint32_t))) { return FUZZ_MARK_UNINTERESTING; } bignum256modm output = {0}; memcpy(m, fuzzer_input(sizeof(bignum256modm)), sizeof(bignum256modm)); memcpy(&major, fuzzer_input(sizeof(uint32_t)), sizeof(uint32_t)); memcpy(&minor, fuzzer_input(sizeof(uint32_t)), sizeof(uint32_t)); xmr_get_subaddress_secret_key(output, major, minor, m); check_msan(&output, sizeof(output)); return 0; } int fuzz_xmr_derive_private_key(void) { bignum256modm base = {0}; ge25519 deriv = {0}; uint32_t idx = 0; if (fuzzer_length != (sizeof(bignum256modm) + sizeof(ge25519) + sizeof(uint32_t))) { return FUZZ_MARK_UNINTERESTING; } memcpy(base, fuzzer_input(sizeof(bignum256modm)), sizeof(bignum256modm)); memcpy(&deriv, fuzzer_input(sizeof(ge25519)), sizeof(ge25519)); memcpy(&idx, fuzzer_input(sizeof(uint32_t)), sizeof(uint32_t)); bignum256modm output = {0}; xmr_derive_private_key(output, &deriv, idx, base); check_msan(&output, sizeof(output)); return 0; } int fuzz_xmr_derive_public_key(void) { ge25519 base = {0}; ge25519 deriv = {0}; uint32_t idx = 0; if (fuzzer_length != (2 * sizeof(ge25519) + sizeof(uint32_t))) { return FUZZ_MARK_UNINTERESTING; } memcpy(&base, fuzzer_input(sizeof(ge25519)), sizeof(ge25519)); memcpy(&deriv, fuzzer_input(sizeof(ge25519)), sizeof(ge25519)); memcpy(&idx, fuzzer_input(sizeof(uint32_t)), sizeof(uint32_t)); ge25519 output = {0}; xmr_derive_public_key(&output, &deriv, idx, &base); check_msan(&output, sizeof(output)); return 0; } #define SHAMIR_MAX_SHARE_COUNT 16 #define SHAMIR_MAX_DATA_LEN (SHAMIR_MAX_SHARE_COUNT * SHAMIR_MAX_LEN) int fuzz_shamir_interpolate(void) { if (fuzzer_length != (2 * sizeof(uint8_t) + SHAMIR_MAX_SHARE_COUNT + SHAMIR_MAX_DATA_LEN + sizeof(size_t))) { return FUZZ_MARK_UNINTERESTING; } uint8_t result[SHAMIR_MAX_LEN] = {0}; uint8_t result_index = 0; uint8_t share_indices[SHAMIR_MAX_SHARE_COUNT] = {0}; uint8_t share_values_content[SHAMIR_MAX_SHARE_COUNT][SHAMIR_MAX_LEN] = {0}; const uint8_t *share_values[SHAMIR_MAX_SHARE_COUNT] = {0}; uint8_t share_count = 0; size_t len = 0; for (size_t i = 0; i < SHAMIR_MAX_SHARE_COUNT; i++) { share_values[i] = share_values_content[i]; } memcpy(&result_index, fuzzer_input(sizeof(uint8_t)), sizeof(uint8_t)); memcpy(&share_indices, fuzzer_input(SHAMIR_MAX_SHARE_COUNT), SHAMIR_MAX_SHARE_COUNT); memcpy(&share_values_content, fuzzer_input(SHAMIR_MAX_DATA_LEN), SHAMIR_MAX_DATA_LEN); memcpy(&share_count, fuzzer_input(sizeof(uint8_t)), sizeof(uint8_t)); // note: this is platform specific via byte length of size_t memcpy(&len, fuzzer_input(sizeof(size_t)), sizeof(size_t)); // mirror a check that the real code does if (share_count < 1 || share_count > SHAMIR_MAX_SHARE_COUNT) { return 0; } // (len > SHAMIR_MAX_LEN) is handled in the target function shamir_interpolate(result, result_index, share_indices, share_values, share_count, len); check_msan(&result, sizeof(result)); return 0; } int fuzz_ecdsa_sign_digest_functions(void) { // bug result reference: https://github.com/trezor/trezor-firmware/pull/1697 uint8_t curve_decider = 0; uint8_t priv_key[32] = {0}; uint8_t digest[32] = {0}; uint8_t sig1[64] = {0}; uint8_t sig2[64] = {0}; uint8_t pby1, pby2 = 0; if (fuzzer_length < 1 + sizeof(priv_key) + sizeof(digest)) { return FUZZ_MARK_UNINTERESTING; } const ecdsa_curve *curve; memcpy(&curve_decider, fuzzer_input(1), 1); memcpy(&priv_key, fuzzer_input(sizeof(priv_key)), sizeof(priv_key)); memcpy(&digest, fuzzer_input(sizeof(digest)), sizeof(digest)); // pick one of the standard curves if ((curve_decider & 0x1) == 1) { curve = &secp256k1; } else { curve = &nist256p1; } int res = 0; // IDEA optionally set a function for is_canonical() callback int res1 = tc_ecdsa_sign_digest(curve, priv_key, digest, sig1, &pby1, NULL); // the zkp function variant is only defined for a specific curve if (curve == &secp256k1) { int res2 = zkp_ecdsa_sign_digest(curve, priv_key, digest, sig2, &pby2, NULL); if ((res1 == 0 && res2 != 0) || (res1 != 0 && res2 == 0)) { // one variant succeeded where the other did not crash(); } if (res1 == 0 && res2 == 0) { if ((pby1 != pby2) || memcmp(&sig1, &sig2, sizeof(sig1)) != 0) { // result values are different crash(); } } } // successful signing if (res1 == 0) { uint8_t pub_key[33] = {0}; res = tc_ecdsa_get_public_key33(curve, priv_key, pub_key); if (res != 0) { // pubkey derivation did not succeed crash(); } res = tc_ecdsa_verify_digest(curve, pub_key, sig1, digest); if (res != 0) { // verification did not succeed crash(); } } return 0; } int fuzz_ecdsa_verify_digest_functions(void) { uint8_t curve_decider = 0; uint8_t hash[32] = {0}; uint8_t sig[64] = {0}; uint8_t pub_key[65] = {0}; if (fuzzer_length < 1 + sizeof(hash) + sizeof(sig) + sizeof(pub_key)) { return FUZZ_MARK_UNINTERESTING; } memcpy(&curve_decider, fuzzer_input(1), 1); memcpy(&hash, fuzzer_input(sizeof(hash)), sizeof(hash)); memcpy(&sig, fuzzer_input(sizeof(sig)), sizeof(sig)); memcpy(&pub_key, fuzzer_input(sizeof(pub_key)), sizeof(pub_key)); const ecdsa_curve *curve; // pick one of the standard curves if ((curve_decider & 0x1) == 1) { curve = &secp256k1; } else { curve = &nist256p1; } int res1 = tc_ecdsa_verify_digest(curve, (const uint8_t *)&pub_key, (const uint8_t *)&sig, (const uint8_t *)&hash); // the zkp_ecdsa* function only accepts the secp256k1 curve if (curve == &secp256k1) { int res2 = zkp_ecdsa_verify_digest(curve, (const uint8_t *)&pub_key, (const uint8_t *)&sig, (const uint8_t *)&hash); // the error code behavior is different between both functions, compare only // verification state if ((res1 == 0 && res2 != 0) || (res1 != 0 && res2 == 0)) { // results differ, this is a problem crash(); } } return 0; } int fuzz_word_index(void) { #define MAX_WORD_LENGTH 12 if (fuzzer_length < MAX_WORD_LENGTH) { return FUZZ_MARK_UNINTERESTING; } char word[MAX_WORD_LENGTH + 1] = {0}; memcpy(&word, fuzzer_ptr, MAX_WORD_LENGTH); size_t word_length = strlen(word); uint16_t index = 0; word_index(&index, (const char *)&word, word_length); return 0; } int fuzz_slip39_word_completion_mask(void) { if (fuzzer_length != 2) { return FUZZ_MARK_UNINTERESTING; } uint16_t sequence = (fuzzer_ptr[0] << 8) + fuzzer_ptr[1]; fuzzer_input(2); slip39_word_completion_mask(sequence); return 0; } // regular MAX_MNEMONIC_LEN is 240, try some extra bytes #define MAX_MNEMONIC_FUZZ_LENGTH 256 int fuzz_mnemonic_check(void) { if (fuzzer_length < MAX_MNEMONIC_FUZZ_LENGTH) { return FUZZ_MARK_UNINTERESTING; } char mnemonic[MAX_MNEMONIC_FUZZ_LENGTH + 1] = {0}; memcpy(&mnemonic, fuzzer_ptr, MAX_MNEMONIC_FUZZ_LENGTH); // at the time of creation of this fuzzer harness, mnemonic_check() // internally calls mnemonic_to_bits() while checking the result int ret = mnemonic_check(mnemonic); (void)ret; /* if(ret == 1) { // correct result } */ return 0; } int fuzz_mnemonic_from_data(void) { if (fuzzer_length < 16 || fuzzer_length > 32) { return FUZZ_MARK_UNINTERESTING; } const char *mnemo_result = mnemonic_from_data(fuzzer_ptr, fuzzer_length); if (mnemo_result != NULL) { int res = mnemonic_check(mnemo_result); if (res == 0) { // TODO the mnemonic_check() function is currently incorrectly rejecting // valid 15 and 21 word seeds // remove this workaround limitation later if (fuzzer_length != 20 && fuzzer_length != 28) { // the generated mnemonic has an invalid format crash(); } } } // scrub the internal buffer to rule out persistent side effects mnemonic_clear(); return 0; } // passphrase normally has a 64 or 256 byte length maximum #define MAX_PASSPHRASE_FUZZ_LENGTH 257 int fuzz_mnemonic_to_seed(void) { if (fuzzer_length < MAX_MNEMONIC_FUZZ_LENGTH + MAX_PASSPHRASE_FUZZ_LENGTH) { return FUZZ_MARK_UNINTERESTING; } char mnemonic[MAX_PASSPHRASE_FUZZ_LENGTH + 1] = {0}; char passphrase[MAX_MNEMONIC_FUZZ_LENGTH + 1] = {0}; uint8_t seed[512 / 8] = {0}; memcpy(&mnemonic, fuzzer_input(MAX_MNEMONIC_FUZZ_LENGTH), MAX_MNEMONIC_FUZZ_LENGTH); memcpy(&passphrase, fuzzer_input(MAX_PASSPHRASE_FUZZ_LENGTH), MAX_PASSPHRASE_FUZZ_LENGTH); mnemonic_to_seed(mnemonic, passphrase, seed, NULL); return 0; } int fuzz_ethereum_address_checksum(void) { uint8_t addr[20] = {0}; char address[43] = {0}; uint64_t chain_id = 0; bool rskip60 = false; if (fuzzer_length < sizeof(addr) + sizeof(address) + sizeof(chain_id) + 1) { return FUZZ_MARK_UNINTERESTING; } memcpy(addr, fuzzer_input(sizeof(addr)), sizeof(addr)); memcpy(address, fuzzer_input(sizeof(address)), sizeof(address)); memcpy(&chain_id, fuzzer_input(sizeof(chain_id)), sizeof(chain_id)); // usually dependent on chain_id, but determined separately here rskip60 = (*fuzzer_input(1)) & 0x1; ethereum_address_checksum(addr, address, rskip60, chain_id); return 0; } int fuzz_aes(void) { if (fuzzer_length < 1 + 16 + 16 + 32) { return FUZZ_MARK_UNINTERESTING; } aes_encrypt_ctx ctxe; aes_decrypt_ctx ctxd; uint8_t ibuf[16] = {0}; uint8_t obuf[16] = {0}; uint8_t iv[16] = {0}; uint8_t cbuf[16] = {0}; const uint8_t *keylength_decider = fuzzer_input(1); // note: the unit test uses the fixed 32 byte key // 603deb1015ca71be2b73aef0857d77811f352c073b6108d72d9810a30914dff4 uint8_t keybuf[32] = {0}; memcpy(&keybuf, fuzzer_input(32), 32); #ifdef AES_VAR // try 128, 192, 256 bit key lengths size_t keylength = 32; switch (keylength_decider[0] & 0x3) { case 0: // invalid length keylength = 1; break; case 1: keylength = 16; break; case 2: keylength = 24; break; case 3: keylength = 32; break; } if (aes_encrypt_key((const unsigned char *)&keybuf, keylength, &ctxe) || aes_decrypt_key((const unsigned char *)&keybuf, keylength, &ctxd)) { // initialization problems, stop processing // we expect this to happen with the invalid key length return 0; } #else // use a 256 bit key length (void)keylength_decider; aes_encrypt_key256((const unsigned char *)&keybuf, &ctxe); aes_decrypt_key256((const unsigned char *)&keybuf, &ctxd); #endif memcpy(ibuf, fuzzer_input(16), 16); memcpy(iv, fuzzer_input(16), 16); aes_ecb_encrypt(ibuf, obuf, 16, &ctxe); aes_ecb_decrypt(ibuf, obuf, 16, &ctxd); aes_cbc_encrypt(ibuf, obuf, 16, iv, &ctxe); aes_cbc_decrypt(ibuf, obuf, 16, iv, &ctxd); aes_cfb_encrypt(ibuf, obuf, 16, iv, &ctxe); aes_cfb_decrypt(ibuf, obuf, 16, iv, &ctxe); aes_ofb_encrypt(ibuf, obuf, 16, iv, &ctxe); aes_ofb_decrypt(ibuf, obuf, 16, iv, &ctxe); aes_ctr_encrypt(ibuf, obuf, 16, cbuf, aes_ctr_cbuf_inc, &ctxe); aes_ctr_decrypt(ibuf, obuf, 16, cbuf, aes_ctr_cbuf_inc, &ctxe); return 0; } int fuzz_chacha_drbg(void) { #define CHACHA_DRBG_ENTROPY_LENGTH 32 #define CHACHA_DRBG_RESEED_LENGTH 32 #define CHACHA_DRBG_NONCE_LENGTH 16 #define CHACHA_DRBG_RESULT_LENGTH 16 if (fuzzer_length < CHACHA_DRBG_ENTROPY_LENGTH + CHACHA_DRBG_RESEED_LENGTH + CHACHA_DRBG_NONCE_LENGTH) { return FUZZ_MARK_UNINTERESTING; } uint8_t entropy[CHACHA_DRBG_ENTROPY_LENGTH] = {0}; uint8_t reseed[CHACHA_DRBG_RESEED_LENGTH] = {0}; uint8_t nonce_bytes[CHACHA_DRBG_NONCE_LENGTH] = {0}; uint8_t result[CHACHA_DRBG_RESULT_LENGTH] = {0}; CHACHA_DRBG_CTX ctx; // IDEA switch to variable input sizes memcpy(&entropy, fuzzer_input(CHACHA_DRBG_ENTROPY_LENGTH), CHACHA_DRBG_ENTROPY_LENGTH); memcpy(&reseed, fuzzer_input(CHACHA_DRBG_RESEED_LENGTH), CHACHA_DRBG_RESEED_LENGTH); memcpy(&nonce_bytes, fuzzer_input(CHACHA_DRBG_NONCE_LENGTH), CHACHA_DRBG_NONCE_LENGTH); chacha_drbg_init(&ctx, entropy, sizeof(entropy), nonce_bytes, sizeof(nonce_bytes)); chacha_drbg_reseed(&ctx, reseed, sizeof(reseed), NULL, 0); chacha_drbg_generate(&ctx, result, sizeof(result)); return 0; } int fuzz_ed25519_sign_verify(void) { ed25519_secret_key secret_key; ed25519_signature signature; ed25519_public_key public_key; // length chosen arbitrarily uint8_t message[32] = {0}; int ret = 0; if (fuzzer_length < sizeof(secret_key) + sizeof(signature) + sizeof(message)) { return FUZZ_MARK_UNINTERESTING; } memcpy(&secret_key, fuzzer_input(sizeof(secret_key)), sizeof(secret_key)); memcpy(&signature, fuzzer_input(sizeof(signature)), sizeof(signature)); memcpy(&message, fuzzer_input(sizeof(message)), sizeof(message)); ed25519_publickey(secret_key, public_key); // sign message, this should always succeed ed25519_sign(message, sizeof(message), secret_key, signature); // verify message, we expect this to work ret = ed25519_sign_open(message, sizeof(message), public_key, signature); if (ret != 0) { // verification did not succeed crash(); } return 0; } int fuzz_zkp_bip340_sign_digest(void) { uint8_t priv_key[32] = {0}; uint8_t aux_input[32] = {0}; uint8_t digest[32] = {0}; uint8_t pub_key[32] = {0}; uint8_t sig[64] = {0}; if (fuzzer_length < sizeof(priv_key) + sizeof(aux_input) + sizeof(digest) + sizeof(sig)) { return FUZZ_MARK_UNINTERESTING; } memcpy(priv_key, fuzzer_input(sizeof(priv_key)), sizeof(priv_key)); memcpy(digest, fuzzer_input(sizeof(digest)), sizeof(digest)); // TODO leave initialized to 0x0? memcpy(aux_input, fuzzer_input(sizeof(aux_input)), sizeof(aux_input)); // TODO leave initialized to 0x0? memcpy(sig, fuzzer_input(sizeof(sig)), sizeof(sig)); zkp_bip340_get_public_key(priv_key, pub_key); check_msan(&pub_key, sizeof(pub_key)); zkp_bip340_sign_digest(priv_key, digest, sig, aux_input); check_msan(&sig, sizeof(sig)); check_msan(&aux_input, sizeof(aux_input)); // IDEA test sign result? return 0; } int fuzz_zkp_bip340_verify_digest(void) { int res = 0; uint8_t pub_key[32] = {0}; uint8_t digest[32] = {0}; uint8_t sig[64] = {0}; if (fuzzer_length < sizeof(digest) + sizeof(pub_key) + sizeof(sig)) { return FUZZ_MARK_UNINTERESTING; } memcpy(pub_key, fuzzer_input(sizeof(pub_key)), sizeof(pub_key)); memcpy(digest, fuzzer_input(sizeof(digest)), sizeof(digest)); memcpy(sig, fuzzer_input(sizeof(sig)), sizeof(sig)); res = zkp_bip340_verify_digest(pub_key, sig, digest); (void)res; return 0; } int fuzz_zkp_bip340_tweak_keys(void) { uint8_t internal_priv[32] = {0}; uint8_t root_hash[32] = {0}; uint8_t internal_pub[32] = {0}; uint8_t result[32] = {0}; if (fuzzer_length < sizeof(internal_priv) + sizeof(root_hash) + sizeof(internal_pub)) { return FUZZ_MARK_UNINTERESTING; } memcpy(internal_priv, fuzzer_input(sizeof(internal_priv)), sizeof(internal_priv)); memcpy(root_hash, fuzzer_input(sizeof(root_hash)), sizeof(root_hash)); memcpy(internal_pub, fuzzer_input(sizeof(internal_pub)), sizeof(internal_pub)); // IDEA act on return values zkp_bip340_tweak_private_key(internal_priv, root_hash, result); zkp_bip340_tweak_public_key(internal_pub, root_hash, result); return 0; } int fuzz_ecdsa_get_public_key_functions(void) { uint8_t privkey[32] = {0}; uint8_t pubkey33_1[33] = {0}; uint8_t pubkey33_2[33] = {0}; uint8_t pubkey65_1[65] = {0}; uint8_t pubkey65_2[65] = {0}; // note: the zkp_ecdsa_* variants require this specific curve const ecdsa_curve *curve = &secp256k1; if (fuzzer_length < sizeof(privkey)) { return FUZZ_MARK_UNINTERESTING; } memcpy(privkey, fuzzer_input(sizeof(privkey)), sizeof(privkey)); int res_33_1 = tc_ecdsa_get_public_key33(curve, privkey, pubkey33_1); int res_33_2 = zkp_ecdsa_get_public_key33(curve, privkey, pubkey33_2); int res_65_1 = tc_ecdsa_get_public_key65(curve, privkey, pubkey65_1); int res_65_2 = zkp_ecdsa_get_public_key65(curve, privkey, pubkey65_2); // the function pairs have different return error codes for the same input // only fail if the one succeeds where the other does not if ((res_33_1 == 0 && res_33_2 != 0) || (res_33_1 != 0 && res_33_2 == 0)) { // function result mismatch crash(); } if ((res_65_1 == 0 && res_65_2 != 0) || (res_65_1 != 0 && res_65_2 == 0)) { // function result mismatch crash(); } if (res_33_1 == 0 && res_33_2 == 0 && memcmp(&pubkey33_1, &pubkey33_2, sizeof(pubkey33_1)) != 0) { // function result data mismatch crash(); } if (res_65_1 == 0 && res_65_2 == 0 && memcmp(&pubkey65_1, &pubkey65_2, sizeof(pubkey65_1)) != 0) { // function result data mismatch crash(); } return 0; } int fuzz_ecdsa_recover_pub_from_sig_functions(void) { uint8_t digest[32] = {0}; uint8_t sig[64] = {0}; const ecdsa_curve *curve = &secp256k1; uint8_t recid = 0; uint8_t pubkey1[65] = {0}; uint8_t pubkey2[65] = {0}; if (fuzzer_length < sizeof(digest) + sizeof(sig) + sizeof(recid)) { return FUZZ_MARK_UNINTERESTING; } memcpy(digest, fuzzer_input(sizeof(digest)), sizeof(digest)); memcpy(sig, fuzzer_input(sizeof(sig)), sizeof(sig)); memcpy(&recid, fuzzer_input(sizeof(recid)), sizeof(recid)); // conform to parameter requirements recid = recid & 0x03; int res1 = zkp_ecdsa_recover_pub_from_sig(curve, pubkey1, sig, digest, recid); int res2 = tc_ecdsa_recover_pub_from_sig(curve, pubkey2, sig, digest, recid); if ((res1 == 0 && res2 != 0) || (res1 != 0 && res2 == 0)) { // result mismatch // bug result reference: https://github.com/trezor/trezor-firmware/pull/2050 crash(); } if (res1 == 0 && res2 == 0 && memcmp(&pubkey1, &pubkey2, sizeof(pubkey1)) != 0) { // pubkey result mismatch crash(); } return 0; } int fuzz_ecdsa_sig_from_der(void) { // bug result reference: https://github.com/trezor/trezor-firmware/pull/2058 uint8_t der[72] = {0}; uint8_t out[72] = {0}; if (fuzzer_length < sizeof(der)) { return FUZZ_MARK_UNINTERESTING; } memcpy(der, fuzzer_input(sizeof(der)), sizeof(der)); // null-terminate der[sizeof(der) - 1] = 0; size_t der_len = strlen((const char *)der); // IDEA use different fuzzer-controlled der_len such as 1 to 73 int ret = ecdsa_sig_from_der(der, der_len, out); (void)ret; // IDEA check if back conversion works return 0; } int fuzz_ecdsa_sig_to_der(void) { uint8_t sig[64] = {0}; uint8_t der[72] = {0}; if (fuzzer_length < sizeof(sig)) { return FUZZ_MARK_UNINTERESTING; } memcpy(sig, fuzzer_input(sizeof(sig)), sizeof(sig)); int ret = ecdsa_sig_to_der((const uint8_t *)&sig, der); (void)ret; // IDEA check if back conversion works return 0; } int fuzz_button_sequence_to_word(void) { uint16_t input = 0; if (fuzzer_length < sizeof(input)) { return FUZZ_MARK_UNINTERESTING; } memcpy(&input, fuzzer_input(sizeof(input)), sizeof(input)); button_sequence_to_word(input); return 0; } int fuzz_xmr_add_keys(void) { bignum256modm a, b; ge25519 A, B; if (fuzzer_length < sizeof(bignum256modm) * 2 + sizeof(ge25519) * 2) { return FUZZ_MARK_UNINTERESTING; } memcpy(&a, fuzzer_input(sizeof(bignum256modm)), sizeof(bignum256modm)); memcpy(&b, fuzzer_input(sizeof(bignum256modm)), sizeof(bignum256modm)); memcpy(&A, fuzzer_input(sizeof(ge25519)), sizeof(ge25519)); memcpy(&B, fuzzer_input(sizeof(ge25519)), sizeof(ge25519)); ge25519 r; xmr_add_keys2(&r, a, b, &B); check_msan(&r, sizeof(r)); xmr_add_keys2_vartime(&r, a, b, &B); check_msan(&r, sizeof(r)); xmr_add_keys3(&r, a, &A, b, &B); check_msan(&r, sizeof(r)); xmr_add_keys3_vartime(&r, a, &A, b, &B); check_msan(&r, sizeof(r)); return 0; } int fuzz_ecdh_multiply(void) { uint8_t priv_key[32]; // 33 or 65 bytes content uint8_t pub_key[65]; uint8_t decider; if (fuzzer_length < sizeof(priv_key) + sizeof(pub_key) + sizeof(decider)) { return FUZZ_MARK_UNINTERESTING; } memcpy(&priv_key, fuzzer_input(sizeof(priv_key)), sizeof(priv_key)); memcpy(&pub_key, fuzzer_input(sizeof(pub_key)), sizeof(pub_key)); memcpy(&decider, fuzzer_input(sizeof(decider)), sizeof(decider)); uint8_t session_key[65] = {0}; int res1 = 0; // TODO evaluate crash with &curve == NULL, documentation / convention issue? const ecdsa_curve *curve2; // ecdh_multiply() is only called with secp256k1 and nist256p1 curve from // modtrezorcrypto code theoretically other curve parameters are also possible if ((decider & 1) == 0) { curve2 = &nist256p1; } else { curve2 = &secp256k1; } res1 = ecdh_multiply(curve2, (uint8_t *)&priv_key, (uint8_t *)&pub_key, (uint8_t *)&session_key); check_msan(&session_key, sizeof(session_key)); if (res1 != 0) { // failure case } return 0; } int fuzz_segwit_addr_encode(void) { // the current firmware code only uses witver = 0 and witver = 1 // we give more flexibility, but do not allow the full int range uint8_t chosen_witver = 0; // restrict fuzzer variations to lengths of 0 to 255 uint8_t chosen_witprog_len = 0; // in typical use, hrp is a bech32 prefix of 2 to 4 chars // TODO make this dynamic, investigate lowercase requirements // see also https://github.com/sipa/bech32/issues/38 char *hrp = "bc"; if (fuzzer_length < sizeof(chosen_witver) + sizeof(chosen_witprog_len)) { return FUZZ_MARK_UNINTERESTING; } memcpy(&chosen_witver, fuzzer_input(sizeof(chosen_witver)), sizeof(chosen_witver)); memcpy(&chosen_witprog_len, fuzzer_input(sizeof(chosen_witprog_len)), sizeof(chosen_witprog_len)); if (chosen_witprog_len > fuzzer_length) { return FUZZ_MARK_UNINTERESTING; } char output_address[MAX_ADDR_SIZE] = {0}; uint8_t *witprog = malloc(chosen_witprog_len); RETURN_IF_NULL(witprog); memcpy(witprog, fuzzer_input(chosen_witprog_len), chosen_witprog_len); int ret = segwit_addr_encode(output_address, hrp, chosen_witver, witprog, chosen_witprog_len); // IDEA act depending on ret (void)ret; free(witprog); return 0; } int fuzz_segwit_addr_decode(void) { int decoded_witver = 0; size_t decoded_witprog_len = 0; // TODO uint8_t addr_raw[MAX_ADDR_RAW_SIZE] = {0}; uint8_t chosen_addr_len = 0; if (fuzzer_length < sizeof(chosen_addr_len)) { return FUZZ_MARK_UNINTERESTING; } memcpy(&chosen_addr_len, fuzzer_input(sizeof(chosen_addr_len)), sizeof(chosen_addr_len)); if (chosen_addr_len > fuzzer_length) { return FUZZ_MARK_UNINTERESTING; } char *addr = malloc(chosen_addr_len + 1); RETURN_IF_NULL(addr); memcpy(addr, fuzzer_input(chosen_addr_len), chosen_addr_len); // null termination addr[chosen_addr_len] = 0; // TODO see comments in fuzz_segwit_addr_encode() char *hrp = "bc"; int ret = segwit_addr_decode(&decoded_witver, addr_raw, &decoded_witprog_len, hrp, addr); // IDEA act depending on ret (void)ret; free(addr); return 0; } /* Fuzzer main function */ #define META_HEADER_SIZE 3 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { // reject input that is too short if (size < META_HEADER_SIZE) { return FUZZ_MARK_UNINTERESTING; } fuzzer_reset_state(); // this controls up to 256 different test cases uint8_t target_decision = data[0]; // data[1] is reserved for explicit sub decisions // uint8_t target_sub_decision = data[1]; // data[2] is reserved for future use // assign the fuzzer payload data for the target functions fuzzer_ptr = data + META_HEADER_SIZE; fuzzer_length = size - META_HEADER_SIZE; // if active: reject all other inputs that are not the selected target // this is helpful for directing the fuzzing focus on a specific case #ifdef FUZZ_EXCLUSIVE_TARGET if (target_decision != FUZZ_EXCLUSIVE_TARGET) { return FUZZ_MARK_UNINTERESTING; } #endif int target_result = 0; // TODO reorder and regroup target functions switch (target_decision) { case 0: target_result = fuzz_bn_format(); break; case 1: target_result = fuzz_base32_decode(); break; case 2: target_result = fuzz_base32_encode(); break; case 3: target_result = fuzz_base58_encode_check(); break; case 4: target_result = fuzz_base58_decode_check(); break; case 5: target_result = fuzz_xmr_base58_addr_decode_check(); break; case 6: target_result = fuzz_xmr_base58_addr_encode_check(); break; case 7: target_result = fuzz_xmr_serialize_varint(); break; case 8: target_result = fuzz_nem_validate_address(); break; case 9: target_result = fuzz_nem_get_address(); break; case 10: target_result = fuzz_xmr_get_subaddress_secret_key(); break; case 11: target_result = fuzz_xmr_derive_private_key(); break; case 12: target_result = fuzz_xmr_derive_public_key(); break; case 13: target_result = fuzz_shamir_interpolate(); break; case 14: #ifdef FUZZ_ALLOW_SLOW zkp_initialize_context_or_crash(); // slow through expensive bignum operations target_result = fuzz_ecdsa_verify_digest_functions(); #endif break; case 15: target_result = fuzz_word_index(); break; case 16: target_result = fuzz_slip39_word_completion_mask(); break; case 17: target_result = fuzz_mnemonic_check(); break; case 18: #ifdef FUZZ_ALLOW_SLOW target_result = fuzz_aes(); #endif break; case 22: target_result = fuzz_chacha_drbg(); break; case 23: #ifdef FUZZ_ALLOW_SLOW zkp_initialize_context_or_crash(); // slow through expensive bignum operations target_result = fuzz_ecdsa_sign_digest_functions(); #endif break; case 24: target_result = fuzz_ed25519_sign_verify(); break; case 25: target_result = fuzz_mnemonic_from_data(); break; case 26: target_result = fuzz_mnemonic_to_seed(); break; case 27: target_result = fuzz_button_sequence_to_word(); break; case 28: target_result = fuzz_segwit_addr_encode(); break; case 29: target_result = fuzz_segwit_addr_decode(); break; case 30: target_result = fuzz_ethereum_address_checksum(); break; case 41: zkp_initialize_context_or_crash(); target_result = fuzz_zkp_bip340_sign_digest(); break; case 42: zkp_initialize_context_or_crash(); target_result = fuzz_zkp_bip340_verify_digest(); break; case 43: zkp_initialize_context_or_crash(); target_result = fuzz_zkp_bip340_tweak_keys(); break; case 50: zkp_initialize_context_or_crash(); target_result = fuzz_ecdsa_get_public_key_functions(); break; case 51: zkp_initialize_context_or_crash(); target_result = fuzz_ecdsa_recover_pub_from_sig_functions(); break; case 52: target_result = fuzz_ecdsa_sig_from_der(); break; case 53: target_result = fuzz_ecdsa_sig_to_der(); break; case 60: target_result = fuzz_xmr_base58_encode(); break; case 61: target_result = fuzz_xmr_base58_decode(); break; case 63: target_result = fuzz_xmr_add_keys(); break; case 64: target_result = fuzz_ecdh_multiply(); break; default: return FUZZ_MARK_UNINTERESTING; // break will never be reached break; } return target_result; }