Line data    Source code

       1             : // Copyright (c) 2020-2022 The Bitcoin Core developers
       2             : // Distributed under the MIT software license, see the accompanying
       3             : // file COPYING or http://www.opensource.org/licenses/mit-license.php.
       4             : 
       5             : #include <httpserver.h>
       6             : #include <netaddress.h>
       7             : #include <test/fuzz/FuzzedDataProvider.h>
       8             : #include <test/fuzz/fuzz.h>
       9             : #include <test/fuzz/util.h>
      10             : #include <util/strencodings.h>
      11             : 
      12             : #include <event2/buffer.h>
      13             : #include <event2/event.h>
      14             : #include <event2/http.h>
      15             : #include <event2/http_struct.h>
      16             : 
      17             : #include <cassert>
      18             : #include <cstdint>
      19             : #include <string>
      20             : #include <vector>
      21             : 
      22             : extern "C" int evhttp_parse_firstline_(struct evhttp_request*, struct evbuffer*);
      23             : extern "C" int evhttp_parse_headers_(struct evhttp_request*, struct evbuffer*);
      24             : 
      25           2 : std::string RequestMethodString(HTTPRequest::RequestMethod m);
      26             : 
      27           4 : FUZZ_TARGET(http_request)
      28             : {
      29           0 :     FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
      30           0 :     evhttp_request* evreq = evhttp_request_new(nullptr, nullptr);
      31           0 :     assert(evreq != nullptr);
      32           0 :     evreq->kind = EVHTTP_REQUEST;
      33           0 :     evbuffer* evbuf = evbuffer_new();
      34           0 :     assert(evbuf != nullptr);
      35           0 :     const std::vector<uint8_t> http_buffer = ConsumeRandomLengthByteVector(fuzzed_data_provider, 4096);
      36           0 :     evbuffer_add(evbuf, http_buffer.data(), http_buffer.size());
      37             :     // Avoid constructing requests that will be interpreted by libevent as PROXY requests to avoid triggering
      38             :     // a nullptr dereference. The dereference (req->evcon->http_server) takes place in evhttp_parse_request_line
      39             :     // and is a consequence of our hacky but necessary use of the internal function evhttp_parse_firstline_ in
      40             :     // this fuzzing harness. The workaround is not aesthetically pleasing, but it successfully avoids the troublesome
      41             :     // code path. " http:// HTTP/1.1\n" was a crashing input prior to this workaround.
      42           0 :     const std::string http_buffer_str = ToLower(std::string{http_buffer.begin(), http_buffer.end()});
      43           0 :     if (http_buffer_str.find(" http://") != std::string::npos || http_buffer_str.find(" https://") != std::string::npos ||
      44           0 :         evhttp_parse_firstline_(evreq, evbuf) != 1 || evhttp_parse_headers_(evreq, evbuf) != 1) {
      45           0 :         evbuffer_free(evbuf);
      46           0 :         evhttp_request_free(evreq);
      47           0 :         return;
      48             :     }
      49             : 
      50           0 :     HTTPRequest http_request{evreq, true};
      51           0 :     const HTTPRequest::RequestMethod request_method = http_request.GetRequestMethod();
      52           0 :     (void)RequestMethodString(request_method);
      53           0 :     (void)http_request.GetURI();
      54           0 :     (void)http_request.GetHeader("Host");
      55           0 :     const std::string header = fuzzed_data_provider.ConsumeRandomLengthString(16);
      56           0 :     (void)http_request.GetHeader(header);
      57           0 :     (void)http_request.WriteHeader(header, fuzzed_data_provider.ConsumeRandomLengthString(16));
      58           0 :     (void)http_request.GetHeader(header);
      59           0 :     const std::string body = http_request.ReadBody();
      60           0 :     assert(body.empty());
      61           0 :     const CService service = http_request.GetPeer();
      62           0 :     assert(service.ToStringAddrPort() == "[::]:0");
      63             : 
      64           0 :     evbuffer_free(evbuf);
      65           0 :     evhttp_request_free(evreq);
      66           0 : }