aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--Makefile2
-rw-r--r--fuzzers/fuzz_decrypt.cpp1
-rw-r--r--fuzzers/fuzz_group_decrypt.cpp71
-rw-r--r--fuzzers/include/fuzzing.hh16
-rw-r--r--include/olm/message.h7
-rw-r--r--src/inbound_group_session.c4
-rw-r--r--src/message.cpp18
-rw-r--r--src/outbound_group_session.c3
-rw-r--r--tests/test_message.cpp23
9 files changed, 96 insertions, 49 deletions
diff --git a/Makefile b/Makefile
index 08238c9..0d5ddd6 100644
--- a/Makefile
+++ b/Makefile
@@ -7,7 +7,7 @@ JS_OPTIMIZE_FLAGS ?= -O3
FUZZING_OPTIMIZE_FLAGS ?= -O3
CC = gcc
EMCC = emcc
-AFL_CC = afl_gcc
+AFL_CC = afl-gcc
AFL_CXX = afl-g++
RELEASE_TARGET := $(BUILD_DIR)/libolm.so
DEBUG_TARGET := $(BUILD_DIR)/libolm_debug.so
diff --git a/fuzzers/fuzz_decrypt.cpp b/fuzzers/fuzz_decrypt.cpp
index 6116934..0b48060 100644
--- a/fuzzers/fuzz_decrypt.cpp
+++ b/fuzzers/fuzz_decrypt.cpp
@@ -61,4 +61,5 @@ int main(int argc, const char *argv[]) {
ignored = write(STDOUT_FILENO, plaintext, length);
ignored = write(STDOUT_FILENO, "\n", 1);
+ return ignored;
}
diff --git a/fuzzers/fuzz_group_decrypt.cpp b/fuzzers/fuzz_group_decrypt.cpp
new file mode 100644
index 0000000..1fc99d7
--- /dev/null
+++ b/fuzzers/fuzz_group_decrypt.cpp
@@ -0,0 +1,71 @@
+#include "olm/olm.hh"
+
+#include "fuzzing.hh"
+
+int main(int argc, const char *argv[]) {
+ size_t ignored;
+ if (argc <= 2) {
+ const char * message = "Usage: decrypt <pickle_key> <group_session>\n";
+ ignored = write(STDERR_FILENO, message, strlen(message));
+ exit(3);
+ }
+
+ const char * key = argv[1];
+ size_t key_length = strlen(key);
+
+
+ int session_fd = check_errno(
+ "Error opening session file", open(argv[2], O_RDONLY)
+ );
+
+ uint8_t *session_buffer;
+ ssize_t session_length = check_errno(
+ "Error reading session file", read_file(session_fd, &session_buffer)
+ );
+
+ int message_fd = STDIN_FILENO;
+ uint8_t * message_buffer;
+ ssize_t message_length = check_errno(
+ "Error reading message file", read_file(message_fd, &message_buffer)
+ );
+
+ uint8_t * tmp_buffer = (uint8_t *) malloc(message_length);
+ memcpy(tmp_buffer, message_buffer, message_length);
+
+ uint8_t session_memory[olm_inbound_group_session_size()];
+ OlmInboundGroupSession * session = olm_inbound_group_session(session_memory);
+ check_error(
+ olm_inbound_group_session_last_error,
+ session,
+ "Error unpickling session",
+ olm_unpickle_inbound_group_session(
+ session, key, key_length, session_buffer, session_length
+ )
+ );
+
+ size_t max_length = check_error(
+ olm_inbound_group_session_last_error,
+ session,
+ "Error getting plaintext length",
+ olm_group_decrypt_max_plaintext_length(
+ session, tmp_buffer, message_length
+ )
+ );
+
+ uint8_t plaintext[max_length];
+
+ size_t length = check_error(
+ olm_inbound_group_session_last_error,
+ session,
+ "Error decrypting message",
+ olm_group_decrypt(
+ session,
+ message_buffer, message_length,
+ plaintext, max_length
+ )
+ );
+
+ ignored = write(STDOUT_FILENO, plaintext, length);
+ ignored = write(STDOUT_FILENO, "\n", 1);
+ return ignored;
+}
diff --git a/fuzzers/include/fuzzing.hh b/fuzzers/include/fuzzing.hh
index e4f5eb9..b27c396 100644
--- a/fuzzers/include/fuzzing.hh
+++ b/fuzzers/include/fuzzing.hh
@@ -53,13 +53,15 @@ T check_errno(
return value;
}
-size_t check_session(
- OlmSession * session,
+template<typename T, typename F>
+size_t check_error(
+ F f,
+ T * object,
const char * message,
size_t value
) {
if (value == olm_error()) {
- const char * olm_message = olm_session_last_error(session);
+ const char * olm_message = f(object);
ssize_t ignored;
ignored = write(STDERR_FILENO, message, strlen(message));
ignored = write(STDERR_FILENO, ": ", 2);
@@ -70,3 +72,11 @@ size_t check_session(
}
return value;
}
+
+size_t check_session(
+ OlmSession * session,
+ const char * message,
+ size_t value
+) {
+ return check_error(olm_session_last_error, session, message, value);
+}
diff --git a/include/olm/message.h b/include/olm/message.h
index e80d54c..5eb504d 100644
--- a/include/olm/message.h
+++ b/include/olm/message.h
@@ -35,7 +35,6 @@ extern "C" {
* The length of the buffer needed to hold a group message.
*/
size_t _olm_encode_group_message_length(
- size_t group_session_id_length,
uint32_t chain_index,
size_t ciphertext_length,
size_t mac_length
@@ -45,8 +44,6 @@ size_t _olm_encode_group_message_length(
* Writes the message headers into the output buffer.
*
* version: version number of the olm protocol
- * session_id: group session identifier
- * session_id_length: length of session_id
* message_index: message index
* ciphertext_length: length of the ciphertext
* output: where to write the output. Should be at least
@@ -58,8 +55,6 @@ size_t _olm_encode_group_message_length(
*/
size_t _olm_encode_group_message(
uint8_t version,
- const uint8_t *session_id,
- size_t session_id_length,
uint32_t message_index,
size_t ciphertext_length,
uint8_t *output,
@@ -69,8 +64,6 @@ size_t _olm_encode_group_message(
struct _OlmDecodeGroupMessageResults {
uint8_t version;
- const uint8_t *session_id;
- size_t session_id_length;
uint32_t message_index;
int has_message_index;
const uint8_t *ciphertext;
diff --git a/src/inbound_group_session.c b/src/inbound_group_session.c
index e171205..ce26033 100644
--- a/src/inbound_group_session.c
+++ b/src/inbound_group_session.c
@@ -231,9 +231,7 @@ static size_t _decrypt(
return (size_t)-1;
}
- if (!decoded_results.has_message_index || !decoded_results.session_id
- || !decoded_results.ciphertext
- ) {
+ if (!decoded_results.has_message_index || !decoded_results.ciphertext ) {
session->last_error = OLM_BAD_MESSAGE_FORMAT;
return (size_t)-1;
}
diff --git a/src/message.cpp b/src/message.cpp
index 2e841e5..ad26cb9 100644
--- a/src/message.cpp
+++ b/src/message.cpp
@@ -328,18 +328,15 @@ void olm::decode_one_time_key_message(
-static const std::uint8_t GROUP_SESSION_ID_TAG = 012;
-static const std::uint8_t GROUP_MESSAGE_INDEX_TAG = 020;
-static const std::uint8_t GROUP_CIPHERTEXT_TAG = 032;
+static const std::uint8_t GROUP_MESSAGE_INDEX_TAG = 010;
+static const std::uint8_t GROUP_CIPHERTEXT_TAG = 022;
size_t _olm_encode_group_message_length(
- size_t group_session_id_length,
uint32_t message_index,
size_t ciphertext_length,
size_t mac_length
) {
size_t length = VERSION_LENGTH;
- length += 1 + varstring_length(group_session_id_length);
length += 1 + varint_length(message_index);
length += 1 + varstring_length(ciphertext_length);
length += mac_length;
@@ -349,19 +346,14 @@ size_t _olm_encode_group_message_length(
size_t _olm_encode_group_message(
uint8_t version,
- const uint8_t *session_id,
- size_t session_id_length,
uint32_t message_index,
size_t ciphertext_length,
uint8_t *output,
uint8_t **ciphertext_ptr
) {
std::uint8_t * pos = output;
- std::uint8_t * session_id_pos;
*(pos++) = version;
- pos = encode(pos, GROUP_SESSION_ID_TAG, session_id_pos, session_id_length);
- std::memcpy(session_id_pos, session_id, session_id_length);
pos = encode(pos, GROUP_MESSAGE_INDEX_TAG, message_index);
pos = encode(pos, GROUP_CIPHERTEXT_TAG, *ciphertext_ptr, ciphertext_length);
return pos-output;
@@ -376,8 +368,6 @@ void _olm_decode_group_message(
std::uint8_t const * end = input + input_length - mac_length;
std::uint8_t const * unknown = nullptr;
- results->session_id = nullptr;
- results->session_id_length = 0;
bool has_message_index = false;
results->message_index = 0;
results->ciphertext = nullptr;
@@ -389,10 +379,6 @@ void _olm_decode_group_message(
while (pos != end) {
pos = decode(
- pos, end, GROUP_SESSION_ID_TAG,
- results->session_id, results->session_id_length
- );
- pos = decode(
pos, end, GROUP_MESSAGE_INDEX_TAG,
results->message_index, has_message_index
);
diff --git a/src/outbound_group_session.c b/src/outbound_group_session.c
index 9b2298a..2a6c220 100644
--- a/src/outbound_group_session.c
+++ b/src/outbound_group_session.c
@@ -187,7 +187,7 @@ static size_t raw_message_length(
mac_length = megolm_cipher->ops->mac_length(megolm_cipher);
return _olm_encode_group_message_length(
- GROUP_SESSION_ID_LENGTH, session->ratchet.counter,
+ session->ratchet.counter,
ciphertext_length, mac_length);
}
@@ -220,7 +220,6 @@ static size_t _encrypt(
*/
message_length = _olm_encode_group_message(
OLM_PROTOCOL_VERSION,
- session->session_id, GROUP_SESSION_ID_LENGTH,
session->ratchet.counter,
ciphertext_length,
buffer,
diff --git a/tests/test_message.cpp b/tests/test_message.cpp
index 30c10a0..06b36dc 100644
--- a/tests/test_message.cpp
+++ b/tests/test_message.cpp
@@ -67,12 +67,8 @@ assert_equals(message2, output, 35);
TestCase test_case("Group message encode test");
- const uint8_t session_id[] = "sessionid";
- size_t session_id_len = 9;
-
- size_t length = _olm_encode_group_message_length(
- session_id_len, 200, 10, 8);
- size_t expected_length = 1 + (2+session_id_len) + (1+2) + (2+10) + 8;
+ size_t length = _olm_encode_group_message_length(200, 10, 8);
+ size_t expected_length = 1 + (1+2) + (2+10) + 8;
assert_equals(expected_length, length);
uint8_t output[50];
@@ -80,7 +76,6 @@ assert_equals(message2, output, 35);
_olm_encode_group_message(
3,
- session_id, session_id_len,
200, // counter
10, // ciphertext length
output,
@@ -89,9 +84,8 @@ assert_equals(message2, output, 35);
uint8_t expected[] =
"\x03"
- "\x0A\x09sessionid"
- "\x10\xC8\x01"
- "\x1A\x0A";
+ "\x08\xC8\x01"
+ "\x12\x0A";
assert_equals(expected, output, sizeof(expected)-1);
assert_equals(output+sizeof(expected)-1, ciphertext_ptr);
@@ -103,17 +97,12 @@ assert_equals(message2, output, 35);
struct _OlmDecodeGroupMessageResults results;
std::uint8_t message[] =
"\x03"
- "\x0A\x09sessionid"
- "\x10\xC8\x01"
- "\x1A\x0A" "ciphertext"
+ "\x08\xC8\x01"
+ "\x12\x0A" "ciphertext"
"hmacsha2";
- const uint8_t expected_session_id[] = "sessionid";
-
_olm_decode_group_message(message, sizeof(message)-1, 8, &results);
assert_equals(std::uint8_t(3), results.version);
- assert_equals(std::size_t(9), results.session_id_length);
- assert_equals(expected_session_id, results.session_id, 9);
assert_equals(1, results.has_message_index);
assert_equals(std::uint32_t(200), results.message_index);
assert_equals(std::size_t(10), results.ciphertext_length);
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-09 08:32:31 +0000