Fix panics found due to fuzzing

Author: TimeToogo

tunshell-client/src/shell/proto.rs

@@ -55,7 +55,7 @@ impl Message for ShellClientMessage {
             Self::Error(payload) => payload.as_bytes().to_vec(),
         };
 
-        Ok(RawMessage::new(self.type_id(), buff))
+        RawMessage::new(self.type_id(), buff)
     }
 
     fn deserialise(raw_message: &RawMessage) -> Result<Self> {
@@ -97,7 +97,7 @@ impl Message for ShellServerMessage {
             Self::Error(payload) => payload.as_bytes().to_vec(),
         };
 
-        Ok(RawMessage::new(self.type_id(), buff))
+        RawMessage::new(self.type_id(), buff)
     }
 
     fn deserialise(raw_message: &RawMessage) -> Result<Self> {
@@ -137,7 +137,7 @@ mod tests {
         let message = ShellClientMessage::Key("key".to_owned());
         let serialised = message.serialise().unwrap();
 
-        assert_eq!(serialised, RawMessage::new(1, "key".as_bytes().to_vec()));
+        assert_eq!(serialised, RawMessage::new(1, "key".as_bytes().to_vec()).unwrap());
 
         let deserialised = ShellClientMessage::deserialise(&serialised).unwrap();
 
@@ -170,7 +170,7 @@ mod tests {
         let message = ShellClientMessage::Stdin(vec![1, 2, 3, 4, 5]);
         let serialised = message.serialise().unwrap();
 
-        assert_eq!(serialised, RawMessage::new(3, vec![1, 2, 3, 4, 5]));
+        assert_eq!(serialised, RawMessage::new(3, vec![1, 2, 3, 4, 5]).unwrap());
 
         let deserialised = ShellClientMessage::deserialise(&serialised).unwrap();
 
@@ -197,7 +197,7 @@ mod tests {
         let message = ShellServerMessage::KeyAccepted;
         let serialised = message.serialise().unwrap();
 
-        assert_eq!(serialised, RawMessage::new(1, vec![]));
+        assert_eq!(serialised, RawMessage::new(1, vec![]).unwrap());
 
         let deserialised = ShellServerMessage::deserialise(&serialised).unwrap();
 
@@ -209,7 +209,7 @@ mod tests {
         let message = ShellServerMessage::KeyRejected;
         let serialised = message.serialise().unwrap();
 
-        assert_eq!(serialised, RawMessage::new(2, vec![]));
+        assert_eq!(serialised, RawMessage::new(2, vec![]).unwrap());
 
         let deserialised = ShellServerMessage::deserialise(&serialised).unwrap();
 
@@ -221,7 +221,7 @@ mod tests {
         let message = ShellServerMessage::Stdout(vec![1, 2, 3, 4, 5]);
         let serialised = message.serialise().unwrap();
 
-        assert_eq!(serialised, RawMessage::new(3, vec![1, 2, 3, 4, 5]));
+        assert_eq!(serialised, RawMessage::new(3, vec![1, 2, 3, 4, 5]).unwrap());
 
         let deserialised = ShellServerMessage::deserialise(&serialised).unwrap();
 
@@ -233,7 +233,7 @@ mod tests {
         let message = ShellServerMessage::Exited(5);
         let serialised = message.serialise().unwrap();
 
-        assert_eq!(serialised, RawMessage::new(4, vec![5]));
+        assert_eq!(serialised, RawMessage::new(4, vec![5]).unwrap());
 
         let deserialised = ShellServerMessage::deserialise(&serialised).unwrap();
 
@@ -245,7 +245,7 @@ mod tests {
         let message = ShellServerMessage::Error("test".to_owned());
         let serialised = message.serialise().unwrap();
 
-        assert_eq!(serialised, RawMessage::new(255, "test".as_bytes().to_vec()));
+        assert_eq!(serialised, RawMessage::new(255, "test".as_bytes().to_vec()).unwrap());
 
         let deserialised = ShellServerMessage::deserialise(&serialised).unwrap();
 

tunshell-client/src/stream/aes_stream.rs

@@ -36,7 +36,7 @@ impl Message for EncryptedMessage {
             .unwrap();
         cursor.write(self.ciphertext.as_slice()).unwrap();
 
-        Ok(RawMessage::new(self.type_id(), cursor.into_inner()))
+        RawMessage::new(self.type_id(), cursor.into_inner())
     }
 
     fn deserialise(raw_message: &RawMessage) -> Result<Self> {

tunshell-shared/fuzz.sh

@@ -5,4 +5,4 @@ set -e
 export CARGO_TARGET_DIR="$PWD/fuzz/target"
 
 cargo afl build
-cargo afl fuzz -i fuzz/corpus -o fuzz/out $CARGO_TARGET_DIR/debug/fuzz_client
+cargo afl fuzz -i fuzz/corpus -o fuzz/out $CARGO_TARGET_DIR/debug/fuzzing

tunshell-shared/fuzz/corpus/id:000000,sig:06,src:001034,time:624166,op:havoc,rep:128

@@ -1,4 +1,4 @@
-use anyhow::{anyhow, Result};
+use anyhow::{anyhow, Error, Result};
 use serde::{Deserialize, Serialize};
 
 #[derive(Debug, PartialEq, Clone)]
@@ -65,14 +65,21 @@ pub struct RelayPayload {
 }
 
 impl RawMessage {
-    pub fn new(type_id: u8, data: Vec<u8>) -> Self {
+    pub fn new(type_id: u8, data: Vec<u8>) -> Result<Self> {
+        if data.len() > i16::MAX as usize {
+            return Err(Error::msg(format!(
+                "message length ({}) cannot be greater than {}",
+                data.len(),
+                i16::MAX
+            )));
+        }
         assert!(data.len() <= i16::MAX as usize);
 
-        Self {
+        Ok(Self {
             type_id,
             length: data.len() as u16,
             data,
-        }
+        })
     }
 
     pub fn type_id(&self) -> u8 {
@@ -125,8 +132,8 @@ impl Message for ServerMessage {
             Self::StartRelayMode => vec![],
             Self::Relay(payload) => payload.data.clone(),
         };
-
-        Ok(RawMessage::new(type_id, data))
+        
+        RawMessage::new(type_id, data)
     }
 
     fn deserialise(raw_message: &RawMessage) -> Result<Self> {
@@ -210,7 +217,7 @@ impl Message for ClientMessage {
             Self::Relay(payload) => payload.data.clone(),
         };
 
-        Ok(RawMessage::new(type_id, data))
+        RawMessage::new(type_id, data)
     }
 
     fn deserialise(raw_message: &RawMessage) -> Result<Self> {
@@ -256,7 +263,7 @@ mod tests {
 
     #[test]
     fn test_raw_message_to_vec() {
-        let raw_message = RawMessage::new(0, vec![1, 2, 3]);
+        let raw_message = RawMessage::new(0, vec![1, 2, 3]).unwrap();
 
         let vec = raw_message.to_vec();
 
@@ -407,7 +414,7 @@ mod tests {
 
     #[test]
     fn test_server_deserialise_close() {
-        let raw_message = RawMessage::new(0, vec![]);
+        let raw_message = RawMessage::new(0, vec![]).unwrap();
 
         let message = ServerMessage::deserialise(&raw_message).unwrap();
 
@@ -416,7 +423,7 @@ mod tests {
 
     #[test]
     fn test_server_deserialise_key_accepted() {
-        let raw_message = RawMessage::new(1, vec![]);
+        let raw_message = RawMessage::new(1, vec![]).unwrap();
 
         let message = ServerMessage::deserialise(&raw_message).unwrap();
 
@@ -425,7 +432,7 @@ mod tests {
 
     #[test]
     fn test_server_deserialise_key_rejected() {
-        let raw_message = RawMessage::new(2, vec![]);
+        let raw_message = RawMessage::new(2, vec![]).unwrap();
 
         let message = ServerMessage::deserialise(&raw_message).unwrap();
 
@@ -434,7 +441,7 @@ mod tests {
 
     #[test]
     fn test_server_deserialise_already_joined() {
-        let raw_message = RawMessage::new(3, vec![]);
+        let raw_message = RawMessage::new(3, vec![]).unwrap();
 
         let message = ServerMessage::deserialise(&raw_message).unwrap();
 
@@ -446,7 +453,7 @@ mod tests {
         let raw_message = RawMessage::new(
             4,
             Vec::from(r#"{"peer_key": "key", "peer_ip_address": "123.123.123.123", "session_nonce": "nonce"}"#.as_bytes()),
-        );
+        ).unwrap();
 
         let message = ServerMessage::deserialise(&raw_message).unwrap();
 
@@ -462,7 +469,7 @@ mod tests {
 
     #[test]
     fn test_server_deserialise_peer_left() {
-        let raw_message = RawMessage::new(5, vec![]);
+        let raw_message = RawMessage::new(5, vec![]).unwrap();
 
         let message = ServerMessage::deserialise(&raw_message).unwrap();
 
@@ -471,7 +478,7 @@ mod tests {
 
     #[test]
     fn test_server_deserialise_bind_for_direct_connect() {
-        let raw_message = RawMessage::new(6, vec![]);
+        let raw_message = RawMessage::new(6, vec![]).unwrap();
 
         let message = ServerMessage::deserialise(&raw_message).unwrap();
 
@@ -483,7 +490,8 @@ mod tests {
         let raw_message = RawMessage::new(
             7,
             Vec::from(r#"{"tcp_port":12345,"udp_port":123}"#.as_bytes()),
-        );
+        )
+        .unwrap();
 
         let message = ServerMessage::deserialise(&raw_message).unwrap();
 
@@ -498,7 +506,7 @@ mod tests {
 
     #[test]
     fn test_server_deserialise_start_relay_mode() {
-        let raw_message = RawMessage::new(8, vec![]);
+        let raw_message = RawMessage::new(8, vec![]).unwrap();
 
         let message = ServerMessage::deserialise(&raw_message).unwrap();
 
@@ -507,7 +515,7 @@ mod tests {
 
     #[test]
     fn test_server_deserialise_relay() {
-        let raw_message = RawMessage::new(9, vec![1, 2, 3, 4, 5, 6, 7, 8, 9]);
+        let raw_message = RawMessage::new(9, vec![1, 2, 3, 4, 5, 6, 7, 8, 9]).unwrap();
 
         let message = ServerMessage::deserialise(&raw_message).unwrap();
 
@@ -597,7 +605,7 @@ mod tests {
 
     #[test]
     fn test_client_deserialise_close() {
-        let raw_message = RawMessage::new(0, vec![]);
+        let raw_message = RawMessage::new(0, vec![]).unwrap();
 
         let message = ClientMessage::deserialise(&raw_message).unwrap();
 
@@ -606,7 +614,7 @@ mod tests {
 
     #[test]
     fn test_client_deserialise_key() {
-        let raw_message = RawMessage::new(1, Vec::from(r#"{"key":"key"}"#.as_bytes()));
+        let raw_message = RawMessage::new(1, Vec::from(r#"{"key":"key"}"#.as_bytes())).unwrap();
 
         let message = ClientMessage::deserialise(&raw_message).unwrap();
 
@@ -623,7 +631,8 @@ mod tests {
         let raw_message = RawMessage::new(
             2,
             Vec::from(r#"{"tcp_port":null,"udp_port":2222}"#.as_bytes()),
-        );
+        )
+        .unwrap();
 
         let message = ClientMessage::deserialise(&raw_message).unwrap();
 
@@ -638,7 +647,7 @@ mod tests {
 
     #[test]
     fn test_client_deserialise_direct_contact_succeeded() {
-        let raw_message = RawMessage::new(3, vec![]);
+        let raw_message = RawMessage::new(3, vec![]).unwrap();
 
         let message = ClientMessage::deserialise(&raw_message).unwrap();
 
@@ -647,7 +656,7 @@ mod tests {
 
     #[test]
     fn test_client_deserialise_direct_contact_failed() {
-        let raw_message = RawMessage::new(4, vec![]);
+        let raw_message = RawMessage::new(4, vec![]).unwrap();
 
         let message = ClientMessage::deserialise(&raw_message).unwrap();
 
@@ -656,7 +665,7 @@ mod tests {
 
     #[test]
     fn test_client_deserialise_relay() {
-        let raw_message = RawMessage::new(5, vec![1, 2, 3, 4, 5]);
+        let raw_message = RawMessage::new(5, vec![1, 2, 3, 4, 5]).unwrap();
 
         let message = ClientMessage::deserialise(&raw_message).unwrap();
 

tunshell-shared/fuzz/corpus/id:000001,sig:06,src:001045,time:638565,op:havoc,rep:64

@@ -138,15 +138,23 @@ impl<I: Message, O: Message, S: AsyncRead + AsyncWrite + Unpin> Stream for Messa
                 .collect(),
         );
 
+        if let Err(err) = raw_message {
+            debug!("Could not parse message {:?}", err);
+            self.closed = true;
+
+            return Poll::Ready(Some(Err(err)));
+        }
+
         self.read_buff.drain(..3 + message_length);
 
-        let result = match O::deserialise(&raw_message) {
+        let result = match O::deserialise(&raw_message.unwrap()) {
             Ok(message) => {
                 debug!("Received message {:?}", message);
                 Ok(message)
             }
             Err(err) => {
                 debug!("Error while deserialised received message {:?}", err);
+                self.closed = true;
                 Err(err)
             }
         };
@@ -230,6 +238,7 @@ mod tests {
     use super::*;
     use futures::executor;
     use futures::io::Cursor;
+    use std::io::Read;
 
     #[test]
     fn test_read_empty_stream() {
@@ -409,4 +418,42 @@ mod tests {
         assert_eq!(result.is_none(), true);
         assert_eq!(stream.closed, true);
     }
+
+    #[test]
+    fn test_fuzz_corpus() {
+        let corpus_dir = std::path::Path::new(&std::env::current_exe().unwrap())
+            .parent()
+            .unwrap()
+            .parent()
+            .unwrap()
+            .parent()
+            .unwrap()
+            .parent()
+            .unwrap()
+            .join("tunshell-shared/fuzz/corpus");
+
+        let files = std::fs::read_dir(corpus_dir)
+            .unwrap()
+            .map(|i| i.unwrap().path())
+            .filter(|i| i.is_file());
+
+        for path in files {
+            let mut file = std::fs::File::open(path).unwrap();
+            let mut input = Vec::<u8>::new();
+            file.read_to_end(&mut input).unwrap();
+
+            // Ensure no crashes while parsing
+            let input = Cursor::new(input);
+
+            let stream_server =
+                MessageStream::<ClientMessage, ServerMessage, Cursor<Vec<u8>>>::new(input.clone());
+            let stream_client =
+                MessageStream::<ServerMessage, ClientMessage, Cursor<Vec<u8>>>::new(input);
+
+            let _ =
+                executor::block_on_stream(stream_server).collect::<Vec<Result<ServerMessage>>>();
+            let _ =
+                executor::block_on_stream(stream_client).collect::<Vec<Result<ClientMessage>>>();
+        }
+    }
 }