2
0

bndiv.c 3.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131
  1. /*
  2. * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the OpenSSL licenses, (the "License");
  5. * you may not use this file except in compliance with the License.
  6. * You may obtain a copy of the License at
  7. * https://www.openssl.org/source/license.html
  8. * or in the file LICENSE in the source distribution.
  9. */
  10. /*
  11. * Confirm that if (d, r) = a / b, then b * d + r == a, and that sign(d) ==
  12. * sign(a), and 0 <= r <= b
  13. */
  14. #include <stdio.h>
  15. #include <openssl/bn.h>
  16. #include <openssl/err.h>
  17. #include "fuzzer.h"
  18. /* 256 kB */
  19. #define MAX_LEN (256 * 1000)
  20. static BN_CTX *ctx;
  21. static BIGNUM *b1;
  22. static BIGNUM *b2;
  23. static BIGNUM *b3;
  24. static BIGNUM *b4;
  25. static BIGNUM *b5;
  26. int FuzzerInitialize(int *argc, char ***argv)
  27. {
  28. b1 = BN_new();
  29. b2 = BN_new();
  30. b3 = BN_new();
  31. b4 = BN_new();
  32. b5 = BN_new();
  33. ctx = BN_CTX_new();
  34. OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
  35. ERR_get_state();
  36. return 1;
  37. }
  38. int FuzzerTestOneInput(const uint8_t *buf, size_t len)
  39. {
  40. int success = 0;
  41. size_t l1 = 0, l2 = 0;
  42. /* s1 and s2 will be the signs for b1 and b2. */
  43. int s1 = 0, s2 = 0;
  44. /* limit the size of the input to avoid timeout */
  45. if (len > MAX_LEN)
  46. len = MAX_LEN;
  47. /* We are going to split the buffer in two, sizes l1 and l2, giving b1 and
  48. * b2.
  49. */
  50. if (len > 0) {
  51. --len;
  52. /* Use first byte to divide the remaining buffer into 3Fths. I admit
  53. * this disallows some number sizes. If it matters, better ideas are
  54. * welcome (Ben).
  55. */
  56. l1 = ((buf[0] & 0x3f) * len) / 0x3f;
  57. s1 = buf[0] & 0x40;
  58. s2 = buf[0] & 0x80;
  59. ++buf;
  60. l2 = len - l1;
  61. }
  62. OPENSSL_assert(BN_bin2bn(buf, l1, b1) == b1);
  63. BN_set_negative(b1, s1);
  64. OPENSSL_assert(BN_bin2bn(buf + l1, l2, b2) == b2);
  65. BN_set_negative(b2, s2);
  66. /* divide by 0 is an error */
  67. if (BN_is_zero(b2)) {
  68. success = 1;
  69. goto done;
  70. }
  71. OPENSSL_assert(BN_div(b3, b4, b1, b2, ctx));
  72. if (BN_is_zero(b1))
  73. success = BN_is_zero(b3) && BN_is_zero(b4);
  74. else if (BN_is_negative(b1))
  75. success = (BN_is_negative(b3) != BN_is_negative(b2) || BN_is_zero(b3))
  76. && (BN_is_negative(b4) || BN_is_zero(b4));
  77. else
  78. success = (BN_is_negative(b3) == BN_is_negative(b2) || BN_is_zero(b3))
  79. && (!BN_is_negative(b4) || BN_is_zero(b4));
  80. OPENSSL_assert(BN_mul(b5, b3, b2, ctx));
  81. OPENSSL_assert(BN_add(b5, b5, b4));
  82. success = success && BN_cmp(b5, b1) == 0;
  83. if (!success) {
  84. BN_print_fp(stdout, b1);
  85. putchar('\n');
  86. BN_print_fp(stdout, b2);
  87. putchar('\n');
  88. BN_print_fp(stdout, b3);
  89. putchar('\n');
  90. BN_print_fp(stdout, b4);
  91. putchar('\n');
  92. BN_print_fp(stdout, b5);
  93. putchar('\n');
  94. printf("%d %d %d %d %d %d %d\n", BN_is_negative(b1),
  95. BN_is_negative(b2),
  96. BN_is_negative(b3), BN_is_negative(b4), BN_is_zero(b4),
  97. BN_is_negative(b3) != BN_is_negative(b2)
  98. && (BN_is_negative(b4) || BN_is_zero(b4)),
  99. BN_cmp(b5, b1));
  100. puts("----\n");
  101. }
  102. done:
  103. OPENSSL_assert(success);
  104. ERR_clear_error();
  105. return 0;
  106. }
  107. void FuzzerCleanup(void)
  108. {
  109. BN_free(b1);
  110. BN_free(b2);
  111. BN_free(b3);
  112. BN_free(b4);
  113. BN_free(b5);
  114. BN_CTX_free(ctx);
  115. }