| // Copyright 2026 The Chromium Authors |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| #include "base/base_paths.h" |
| #include "base/check_op.h" |
| #include "base/containers/span.h" |
| #include "base/containers/to_vector.h" |
| #include "base/files/file_path.h" |
| #include "base/logging.h" |
| #include "base/no_destructor.h" |
| #include "base/path_service.h" |
| #include "base/strings/string_number_conversions.h" |
| #include "components/cbor/cbor_buildflags.h" |
| #include "components/cbor/reader.h" |
| #include "components/cbor/writer.h" |
| #include "testing/gmock/include/gmock/gmock.h" |
| #include "testing/gtest/include/gtest/gtest.h" |
| #include "third_party/abseil-cpp/absl/functional/overload.h" |
| #include "third_party/fuzztest/src/fuzztest/fuzztest.h" |
| |
| namespace cbor { |
| |
| namespace { |
| using ::testing::Eq; |
| |
| bool MatchCborValue(const Value& actual, |
| const Value& expected, |
| testing::MatchResultListener* listener, |
| std::string_view path = "") { |
| const auto path_prefix = [&path] { |
| return path.empty() ? "" : std::string(path) + ": "; |
| }; |
| if (actual.type() != expected.type()) { |
| *listener << path_prefix() << "type mismatch: actual is " |
| << static_cast<int>(actual.type()) << ", expected is " |
| << static_cast<int>(expected.type()); |
| return false; |
| } |
| switch (actual.type()) { |
| case Value::Type::NONE: |
| return true; |
| case Value::Type::UNSIGNED: |
| case Value::Type::NEGATIVE: |
| if (actual.GetInteger() != expected.GetInteger()) { |
| *listener << path_prefix() << "integer mismatch: actual is " |
| << actual.GetInteger() << ", expected is " |
| << expected.GetInteger(); |
| return false; |
| } |
| return true; |
| case Value::Type::BYTE_STRING: |
| if (actual.GetBytestring() != expected.GetBytestring()) { |
| *listener << path_prefix() << "bytestring mismatch: actual is " |
| << base::HexEncode(actual.GetBytestring()) << ", expected is " |
| << base::HexEncode(expected.GetBytestring()); |
| return false; |
| } |
| return true; |
| case Value::Type::STRING: |
| if (actual.GetString() != expected.GetString()) { |
| *listener << path_prefix() << "string mismatch: actual is \"" |
| << actual.GetString() << "\", expected is \"" |
| << expected.GetString() << "\""; |
| return false; |
| } |
| return true; |
| case Value::Type::INVALID_UTF8: |
| if (actual.GetInvalidUTF8() != expected.GetInvalidUTF8()) { |
| *listener << path_prefix() << "invalid UTF-8 mismatch: actual is " |
| << base::HexEncode(actual.GetInvalidUTF8()) |
| << ", expected is " |
| << base::HexEncode(expected.GetInvalidUTF8()); |
| return false; |
| } |
| return true; |
| case Value::Type::SIMPLE_VALUE: |
| if (actual.GetSimpleValue() != expected.GetSimpleValue()) { |
| *listener << path_prefix() << "simple value mismatch: actual is " |
| << static_cast<int>(actual.GetSimpleValue()) |
| << ", expected is " |
| << static_cast<int>(expected.GetSimpleValue()); |
| return false; |
| } |
| return true; |
| case Value::Type::ARRAY: { |
| const auto& actual_arr = actual.GetArray(); |
| const auto& expected_arr = expected.GetArray(); |
| if (actual_arr.size() != expected_arr.size()) { |
| *listener << path_prefix() << "array size mismatch: actual size is " |
| << actual_arr.size() << ", expected size is " |
| << expected_arr.size(); |
| return false; |
| } |
| for (size_t i = 0; i < actual_arr.size(); ++i) { |
| if (!MatchCborValue( |
| actual_arr[i], expected_arr[i], listener, |
| std::string(path) + "[" + base::NumberToString(i) + "]")) { |
| return false; |
| } |
| } |
| return true; |
| } |
| case Value::Type::MAP: { |
| const auto& actual_map = actual.GetMap(); |
| const auto& expected_map = expected.GetMap(); |
| if (actual_map.size() != expected_map.size()) { |
| *listener << path_prefix() << "map size mismatch: actual size is " |
| << actual_map.size() << ", expected size is " |
| << expected_map.size(); |
| return false; |
| } |
| auto actual_it = actual_map.begin(); |
| auto expected_it = expected_map.begin(); |
| for (size_t i = 0; actual_it != actual_map.end(); |
| ++actual_it, ++expected_it, ++i) { |
| if (!MatchCborValue( |
| actual_it->first, expected_it->first, listener, |
| std::string(path) + ".key[" + base::NumberToString(i) + "]") || |
| !MatchCborValue( |
| actual_it->second, expected_it->second, listener, |
| std::string(path) + ".val[" + base::NumberToString(i) + "]")) { |
| return false; |
| } |
| } |
| return true; |
| } |
| default: |
| *listener << path_prefix() << "unsupported major type " |
| << static_cast<int>(actual.type()) |
| << " (neither parser should have produced this)"; |
| return false; |
| } |
| } |
| |
| MATCHER_P(CborValueEqImpl, expected_ref, "") { |
| const std::optional<Value>& expected = expected_ref.get(); |
| if (arg.has_value() != expected.has_value()) { |
| *result_listener << "has_value() mismatch: actual is " |
| << (arg.has_value() ? "value" : "std::nullopt") |
| << ", expected is " |
| << (expected.has_value() ? "value" : "std::nullopt"); |
| return false; |
| } |
| if (!arg.has_value()) { |
| return true; |
| } |
| return MatchCborValue(*arg, *expected, result_listener); |
| } |
| |
| inline auto CborValueEq(const std::optional<Value>& expected) { |
| return CborValueEqImpl(std::cref(expected)); |
| } |
| |
| std::optional<Value> ParseAndCompare( |
| const base::span<const uint8_t> input, |
| const Reader::Config* config_ptr = nullptr) { |
| const auto fill_config = [&](Reader::Config& cfg, bool use_rust, |
| Reader::DecoderError* error_out) { |
| if (config_ptr) { |
| cfg.allow_invalid_utf8 = config_ptr->allow_invalid_utf8; |
| cfg.max_nesting_level = config_ptr->max_nesting_level; |
| } |
| cfg.use_rust = use_rust; |
| cfg.error_code_out = error_out; |
| }; |
| |
| Reader::Config cpp_config; |
| Reader::DecoderError cpp_error; |
| fill_config(cpp_config, false, &cpp_error); |
| std::optional<Value> cpp_cbor = Reader::Read(input, cpp_config); |
| |
| #if BUILDFLAG(USE_CBOR_RUST) |
| Reader::Config rust_config; |
| Reader::DecoderError rust_error; |
| fill_config(rust_config, true, &rust_error); |
| std::optional<Value> rust_cbor = Reader::Read(input, rust_config); |
| |
| EXPECT_THAT(rust_cbor, CborValueEq(cpp_cbor)); |
| if (cpp_cbor.has_value() && rust_cbor.has_value()) { |
| Writer::Config writer_config; |
| if (config_ptr) { |
| writer_config.allow_invalid_utf8_for_testing = |
| config_ptr->allow_invalid_utf8; |
| } |
| std::optional<std::vector<uint8_t>> cpp_out = |
| Writer::Write(*cpp_cbor, writer_config); |
| std::optional<std::vector<uint8_t>> rust_out = |
| Writer::Write(*rust_cbor, writer_config); |
| EXPECT_THAT(rust_out, Eq(cpp_out)); |
| } else { |
| // Both parsers correctly rejected the invalid input. Check that the error |
| // codes align perfectly. |
| EXPECT_EQ(rust_error, cpp_error); |
| } |
| #endif |
| |
| if (config_ptr && config_ptr->error_code_out) { |
| *config_ptr->error_code_out = cpp_error; |
| } |
| return cpp_cbor; |
| } |
| } // namespace |
| |
| std::vector<std::tuple<std::vector<uint8_t>>> GetCborCorpus() { |
| static base::NoDestructor<std::vector<std::tuple<std::vector<uint8_t>>>> |
| seeds([] { |
| base::FilePath source_root; |
| // This should always be available in Chromium tests. If it fails, |
| // we want to crash rather than silently run the fuzzer with an empty |
| // corpus. |
| CHECK( |
| base::PathService::Get(base::DIR_SRC_TEST_DATA_ROOT, &source_root)) |
| << "Failed to get DIR_SRC_TEST_DATA_ROOT."; |
| |
| const auto seeds = base::ToVector( |
| fuzztest::ReadFilesFromDirectory( |
| source_root.AppendASCII("components") |
| .AppendASCII("cbor") |
| .AppendASCII("reader_fuzzer_corpus") |
| .MaybeAsASCII()), |
| [](const auto& seed) { |
| return std::tuple{base::ToVector<uint8_t>(std::get<0>(seed))}; |
| }); |
| CHECK(!seeds.empty()) << "Seeds not found!"; |
| return seeds; |
| }()); |
| return *seeds; |
| } |
| |
| std::vector<std::tuple<std::vector<uint8_t>, bool, int>> |
| GetCborCorpusWithConfig() { |
| return base::ToVector(GetCborCorpus(), [](const auto& seed) { |
| // Provide default valid values for the config parameters alongside the |
| // seed. |
| return std::tuple(std::get<0>(seed), false, |
| int{cbor::Reader::kCBORMaxDepth}); |
| }); |
| } |
| |
| struct CborAST; |
| using CborASTArray = std::vector<CborAST>; |
| using CborASTMap = std::vector<std::pair<CborAST, CborAST>>; |
| |
| struct CborAST { |
| std::variant<int64_t, |
| std::string, |
| std::vector<uint8_t>, |
| CborASTArray, |
| CborASTMap> |
| val; |
| }; |
| |
| CborAST CborASTMapKey(std::variant<int64_t, std::string> v) { |
| return std::visit([](auto&& arg) { return CborAST{std::move(arg)}; }, |
| std::move(v)); |
| } |
| |
| // Generates a CborAST which represents a valid, randomized CBOR structure. |
| // This is used by ParseStructuredCBORDoesNotCrash to test the parser against |
| // deeply nested, complex, but structurally valid CBOR inputs. |
| // Constraints: |
| // - Strings are limited to printable ASCII to avoid generating invalid UTF-8 |
| // which would intentionally fail a DCHECK inside cbor::Value. |
| // - Sizes for arrays and maps are constrained to min_size=1 and max_size=3. |
| // In testing various numbers, this was the best configuration to achieve a |
| // good distribution of both deep and shallow trees, natively hitting |
| // depths > 16 around 0.5% of the time without overflowing the C++ stack |
| // or getting stuck in very deep trees. |
| fuzztest::Domain<CborAST> ArbitraryCborAST() { |
| fuzztest::DomainBuilder builder; |
| builder.Set<CborAST>( |
| "value", |
| fuzztest::Map( |
| [](auto v) { return CborAST{std::move(v)}; }, |
| fuzztest::VariantOf( |
| fuzztest::Arbitrary<int64_t>(), fuzztest::PrintableAsciiString(), |
| fuzztest::Arbitrary<std::vector<uint8_t>>(), |
| fuzztest::ContainerOf<CborASTArray>(builder.Get<CborAST>("value")) |
| .WithMinSize(1) |
| .WithMaxSize(3), |
| fuzztest::ContainerOf<CborASTMap>( |
| fuzztest::PairOf( |
| fuzztest::Map(&CborASTMapKey, |
| fuzztest::VariantOf( |
| fuzztest::Arbitrary<int64_t>(), |
| fuzztest::PrintableAsciiString())), |
| builder.Get<CborAST>("value"))) |
| .WithMinSize(1) |
| .WithMaxSize(3)))); |
| return std::move(builder).Finalize<CborAST>("value"); |
| } |
| |
| cbor::Value ASTToCborValue(const CborAST& ast) { |
| return std::visit( |
| absl::Overload{[](const CborASTArray& v) { |
| return cbor::Value(base::ToVector(v, ASTToCborValue)); |
| }, |
| [](const CborASTMap& v) { |
| return cbor::Value(cbor::Value::MapValue( |
| base::ToVector(v, [](const auto& pair) { |
| return std::pair(ASTToCborValue(pair.first), |
| ASTToCborValue(pair.second)); |
| }))); |
| }, |
| [](const auto& v) { return cbor::Value(v); }}, |
| ast.val); |
| } |
| |
| std::vector<uint8_t> SerializeCborAST(const CborAST& ast) { |
| // Pass a large max_nesting_level (999) to ensure Writer doesn't arbitrarily |
| // reject deep trees generated by the fuzzer that exceed the default 16. |
| std::optional<std::vector<uint8_t>> serialized_cbor = |
| Writer::Write(ASTToCborValue(ast), 999); |
| CHECK(serialized_cbor); |
| return *std::move(serialized_cbor); |
| } |
| |
| fuzztest::Domain<std::vector<uint8_t>> ArbitrarySerializedCbor() { |
| return fuzztest::Map(&SerializeCborAST, ArbitraryCborAST()); |
| } |
| |
| void ReadAndWriteIsIdempotentAndDoesNotCrash( |
| const std::vector<uint8_t>& input) { |
| std::optional<Value> cbor = ParseAndCompare(input); |
| if (cbor) { |
| std::optional<std::vector<uint8_t>> serialized_cbor = Writer::Write(*cbor); |
| ASSERT_TRUE(serialized_cbor.has_value()); |
| // This can only be reached if the input was canonical, which means that it |
| // must exactly match the re-serialized output. |
| EXPECT_THAT(*serialized_cbor, Eq(input)); |
| } |
| } |
| |
| // Tests that the CBOR reader handles valid, canonical inputs correctly and |
| // safely rejects invalid/random bytes without crashing. This is fed by random |
| // (but seeded) binary data. |
| FUZZ_TEST(CBORReaderFuzzTest, ReadAndWriteIsIdempotentAndDoesNotCrash) |
| .WithDomains(fuzztest::Arbitrary<std::vector<uint8_t>>()) |
| .WithSeeds(GetCborCorpus); |
| |
| void ReadWithConfigDoesNotCrash(const std::vector<uint8_t>& input, |
| bool allow_invalid_utf8, |
| int max_nesting_level) { |
| Reader::Config config; |
| config.allow_invalid_utf8 = allow_invalid_utf8; |
| config.max_nesting_level = max_nesting_level; |
| |
| ParseAndCompare(input, &config); |
| } |
| |
| // Similar to ParseDoesNotCrash, but explores the parser's resilience when |
| // non-default configuration is set. |
| FUZZ_TEST(CBORReaderFuzzTest, ReadWithConfigDoesNotCrash) |
| .WithDomains(fuzztest::Arbitrary<std::vector<uint8_t>>(), |
| fuzztest::Arbitrary<bool>(), |
| fuzztest::InRange(0, int{cbor::Reader::kCBORMaxDepth})) |
| .WithSeeds(GetCborCorpusWithConfig); |
| |
| void ReadValidCBORWithConfigDoesNotCrash(const std::vector<uint8_t>& input, |
| bool allow_invalid_utf8, |
| int max_nesting_level) { |
| ReadWithConfigDoesNotCrash(input, allow_invalid_utf8, max_nesting_level); |
| } |
| |
| // Similar to ParseWithConfigDoesNotCrash, but instead of mutating predefined |
| // seeds feeds always valid CBOR. |
| FUZZ_TEST(CBORReaderFuzzTest, ReadValidCBORWithConfigDoesNotCrash) |
| .WithDomains(ArbitrarySerializedCbor(), |
| fuzztest::Arbitrary<bool>(), |
| fuzztest::InRange(0, int{cbor::Reader::kCBORMaxDepth})); |
| |
| void ReadValidAndTruncatedCBORDoesNotCrash(const std::vector<uint8_t>& input, |
| size_t truncate_amount) { |
| Reader::Config config; |
| Reader::DecoderError error; |
| config.error_code_out = &error; |
| std::optional<Value> cbor = ParseAndCompare(input, &config); |
| |
| ASSERT_TRUE(cbor.has_value() || |
| error == Reader::DecoderError::TOO_MUCH_NESTING); |
| |
| // Also test truncation resilience with varying amounts. |
| size_t split_point = truncate_amount % input.size(); |
| if (split_point > 0) { |
| auto [first, rest] = base::span(input).split_at(split_point); |
| Reader::Config truncate_config; |
| Reader::DecoderError truncate_error; |
| truncate_config.error_code_out = &truncate_error; |
| ParseAndCompare(first, &truncate_config); |
| ParseAndCompare(rest, &truncate_config); |
| } |
| } |
| |
| // Specifically tests the parser's robustness when parsing complex CBOR data |
| // that has been abruptly truncated. This simulates transmission errors or |
| // cut-off streams on valid payloads. |
| FUZZ_TEST(CBORReaderFuzzTest, ReadValidAndTruncatedCBORDoesNotCrash) |
| .WithDomains(ArbitrarySerializedCbor(), fuzztest::Arbitrary<size_t>()); |
| |
| } // namespace cbor |
