loader_fuzz_tests.cpp

/*
 * Copyright (c) 2024 The Khronos Group Inc.
 * Copyright (c) 2024 Valve Corporation
 * Copyright (c) 2024 LunarG, Inc.
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and/or associated documentation files (the "Materials"), to
 * deal in the Materials without restriction, including without limitation the
 * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
 * sell copies of the Materials, and to permit persons to whom the Materials are
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice(s) and this permission notice shall be included in
 * all copies or substantial portions of the Materials.
 *
 * THE MATERIALS ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
 *
 * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
 * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
 * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE MATERIALS OR THE
 * USE OR OTHER DEALINGS IN THE MATERIALS.
 *
 * Author: Charles Giessen <charles@lunarg.com>
 */

#include "framework/test_environment.h"

#include <fstream>
#include <vector>

extern "C" {
#include "loader.h"
#include "loader_json.h"
#include "settings.h"
}

void execute_instance_enumerate_fuzzer(std::filesystem::path const& filename) {
 FrameworkEnvironment env{};
 env.write_file_from_source((std::filesystem::path(CLUSTERFUZZ_TESTCASE_DIRECTORY) / filename).string().c_str(),
 ManifestCategory::implicit_layer, ManifestLocation::implicit_layer, "complex_layer.json");
 env.write_file_from_source((std::filesystem::path(CLUSTERFUZZ_TESTCASE_DIRECTORY) / filename).string().c_str(),
 ManifestCategory::settings, ManifestLocation::settings_location, "vk_loader_settings.json");

 uint32_t pPropertyCount = 1;
 VkExtensionProperties pProperties = {0};

 env.vulkan_functions.vkEnumerateInstanceExtensionProperties("test_auto", &pPropertyCount, &pProperties);
}
// Common code for execute_instance_create_fuzzer and execute_instance_create_fuzzer_advanced
void execute_instance_create_fuzzer_logic(FrameworkEnvironment& env) {
 EnvVarWrapper enable_all_layers("VK_LOADER_LAYERS_ENABLE", "all");

 VkInstance inst = {0};
 const char* instance_layers[] = {"VK_LAYER_KHRONOS_validation", "VK_LAYER_test_layer_1", "VK_LAYER_test_layer_2"};
 VkApplicationInfo app{};
 app.sType = VK_STRUCTURE_TYPE_APPLICATION_INFO;
 app.pNext = NULL;
 app.pApplicationName = "TEST_APP";
 app.applicationVersion = 0;
 app.pEngineName = "TEST_ENGINE";
 app.engineVersion = 0;
 app.apiVersion = VK_API_VERSION_1_0;

 VkInstanceCreateInfo inst_info{};
 inst_info.sType = VK_STRUCTURE_TYPE_INSTANCE_CREATE_INFO;
 inst_info.pNext = NULL;
 inst_info.pApplicationInfo = &app;
 inst_info.enabledLayerCount = 1;
 inst_info.ppEnabledLayerNames = (const char* const*)instance_layers;
 inst_info.enabledExtensionCount = 0;
 inst_info.ppEnabledExtensionNames = NULL;

 VkResult err = env.vulkan_functions.vkCreateInstance(&inst_info, NULL, &inst);
 if (err != VK_SUCCESS) {
 return;
 }

 env.vulkan_functions.vkDestroyInstance(inst, NULL);
}

void execute_instance_create_fuzzer(std::filesystem::path const& filename) {
 FrameworkEnvironment env{};
 env.write_file_from_source((std::filesystem::path(CLUSTERFUZZ_TESTCASE_DIRECTORY) / filename).string().c_str(),
 ManifestCategory::implicit_layer, ManifestLocation::unsecured_implicit_layer, "complex_layer.json");
 env.write_file_from_source((std::filesystem::path(CLUSTERFUZZ_TESTCASE_DIRECTORY) / filename).string().c_str(),
 ManifestCategory::settings, ManifestLocation::unsecured_settings, "vk_loader_settings.json");
 env.write_file_from_source((std::filesystem::path(CLUSTERFUZZ_TESTCASE_DIRECTORY) / filename).string().c_str(),
 ManifestCategory::icd, ManifestLocation::unsecured_driver, "icd_test.json");

 execute_instance_create_fuzzer_logic(env);
}

void execute_instance_create_advanced_fuzzer(std::filesystem::path const& filename) {
 FrameworkEnvironment env{};

 // The file actually contains three subfiles with their lengths specified in the first 12 bytes of the file.
 auto source_file = std::filesystem::path(CLUSTERFUZZ_TESTCASE_DIRECTORY) / filename;
 std::fstream file{source_file.string(), std::ios_base::in | std::ios_base::binary};
 ASSERT_TRUE(file.is_open());
 std::stringstream file_stream;
 file_stream << file.rdbuf();

 auto data_string = file_stream.str();
 auto data_cstring = data_string.c_str();
 std::array<uint64_t, 3> sections;
 memcpy(sections.data(), data_cstring, sizeof(uint64_t) * 3);
 sections[0] = sections[0] % 40000;
 sections[1] = sections[1] % 40000;
 sections[2] = sections[2] % 40000;

 uint64_t data_index = 3 * sizeof(uint64_t);
 std::string first = data_string.substr(data_index, sections[0]);
 data_index += sections[0];
 std::string second = data_string.substr(data_index, sections[1]);
 data_index += sections[1];
 std::string third = data_string.substr(data_index, sections[2]);
 data_index += sections[2];

 env.platform_shim->fuzz_data.resize(data_string.size() - data_index);
 memcpy(env.platform_shim->fuzz_data.data(), data_cstring + data_index, env.platform_shim->fuzz_data.size());

 env.write_file_from_string(first, ManifestCategory::implicit_layer, ManifestLocation::implicit_layer, "complex_layer.json");
 env.write_file_from_string(second, ManifestCategory::settings, ManifestLocation::settings_location, "vk_loader_settings.json");
 env.write_file_from_string(third, ManifestCategory::settings, ManifestLocation::settings_location, "icd_test.json");

 execute_instance_create_fuzzer_logic(env);
}
void execute_json_load_fuzzer(std::string const& filename) {
 FrameworkEnvironment env{};

 cJSON* json = NULL;
 loader_get_json(NULL, filename.c_str(), &json);

 if (json == NULL) {
 return;
 }
 bool out_of_mem = false;
 char* json_data = loader_cJSON_Print(json, &out_of_mem);

 if (json_data != NULL) {
 free(json_data);
 }

 if (json != NULL) {
 loader_cJSON_Delete(json);
 }
}
void execute_setting_fuzzer(std::filesystem::path const& filename) {
 FrameworkEnvironment env{};

 env.write_file_from_source((std::filesystem::path(CLUSTERFUZZ_TESTCASE_DIRECTORY) / filename).string().c_str(),
 ManifestCategory::settings, ManifestLocation::settings_location, "vk_loader_settings.json");

 update_global_loader_settings();
 struct loader_layer_list settings_layers = {0};
 bool should_search_for_other_layers = true;
 get_settings_layers(NULL, &settings_layers, &should_search_for_other_layers);
 loader_delete_layer_list_and_properties(NULL, &settings_layers);
}

TEST(BadJsonInput, ClusterFuzzTestCase_5599244505186304) {
 // Doesn't crash with ASAN or UBSAN
 // Doesn't reproducibly crash - instance_create_fuzzer: Abrt in loader_cJSON_Delete
 execute_instance_create_fuzzer("clusterfuzz-testcase-instance_create_fuzzer-5599244505186304");
}
TEST(BadJsonInput, ClusterFuzzTestCase_5126563864051712) {
 // Doesn't crash with ASAN or UBSAN
 // Doesn't reproducibly crash - instance_enumerate_fuzzer: Abrt in loader_cJSON_Delete
 execute_instance_enumerate_fuzzer("clusterfuzz-testcase-instance_enumerate_fuzzer-5126563864051712");
}
TEST(BadJsonInput, ClusterFuzzTestCase_6308459683315712) {
 // Doesn't crash with ASAN or UBSAN
 // Doesn't reproducibly crash - instance_enumerate_fuzzer: Null-dereference READ in
 // combine_settings_layers_with_regular_layers
 execute_instance_enumerate_fuzzer("clusterfuzz-testcase-instance_enumerate_fuzzer-6308459683315712");
}
TEST(BadJsonInput, ClusterFuzzTestCase_6583684169269248) {
 // Crashes ASAN
 // Nullptr dereference in loader_copy_to_new_str
 execute_instance_enumerate_fuzzer("clusterfuzz-testcase-minimized-instance_enumerate_fuzzer-6583684169269248");
}
TEST(BadJsonInput, ClusterFuzzTestCase_6470575830925312) {
 execute_instance_enumerate_fuzzer("clusterfuzz-testcase-minimized-instance_enumerate_fuzzer-6470575830925312");
}
TEST(BadJsonInput, ClusterFuzzTestCase_5258042868105216) {
 // Doesn't crash with ASAN or UBSAN
 // Doesn't reproducibly crash - json_load_fuzzer: Abrt in loader_cJSON_Delete
 execute_json_load_fuzzer("clusterfuzz-testcase-json_load_fuzzer-5258042868105216");
}
TEST(BadJsonInput, ClusterFuzzTestCase_5487817455960064) {
 // Doesn't crash with ASAN or UBSAN
 // Doesn't reproducibly crash - json_load_fuzzer: Abrt in std::__Fuzzer::vector<std::__Fuzzer::pair<unsigned int, unsigned
 // short>, std::__
 execute_json_load_fuzzer("clusterfuzz-testcase-json_load_fuzzer-5487817455960064");
}
TEST(BadJsonInput, ClusterFuzzTestCase_4558978302214144) {
 // Does crash with UBSAN and ASAN
 // loader.c:287: VkResult loader_copy_to_new_str(const struct loader_instance *, const char *, char **): Assertion
 // `source_str
 // && dest_str' failed.
 // instance_create_fuzzer: Null-dereference READ in loader_copy_to_new_str
 execute_instance_create_fuzzer("clusterfuzz-testcase-minimized-instance_create_fuzzer-4558978302214144");
}
TEST(BadJsonInput, ClusterFuzzTestCase_4568454561071104) {
 // Does crash with UBSAN and ASAN
 // Causes hangs - instance_create_fuzzer: Timeout in instance_create_fuzzer
 execute_instance_create_fuzzer("clusterfuzz-testcase-minimized-instance_create_fuzzer-4568454561071104");
}
TEST(BadJsonInput, ClusterFuzzTestCase_4820577276723200) {
 // Does crash with UBSAN and ASAN
 // instance_create_fuzzer: Crash in printf_common
 execute_instance_create_fuzzer("clusterfuzz-testcase-minimized-instance_create_fuzzer-4820577276723200");
}
TEST(BadJsonInput, ClusterFuzzTestCase_5177827962454016) {
 // Does crash with UBSAN and ASAN
 // free(): invalid next size (fast)
 // instance_create_fuzzer: Abrt in instance_create_fuzzer
 execute_instance_create_fuzzer("clusterfuzz-testcase-minimized-instance_create_fuzzer-5177827962454016");
}
TEST(BadJsonInput, ClusterFuzzTestCase_5198773675425792) {
 // Does crash with UBSAN and ASAN
 // stack-overflow
 // instance_create_fuzzer: Stack-overflow with empty stacktrace
 execute_instance_create_fuzzer("clusterfuzz-testcase-minimized-instance_create_fuzzer-5198773675425792");
}
TEST(BadJsonInput, ClusterFuzzTestCase_5416197367070720) {
 // Does crash with UBSAN and ASAN
 // free(): invalid next size (fast)
 // instance_create_fuzzer: Overwrites-const-input in instance_create_fuzzer
 execute_instance_create_fuzzer("clusterfuzz-testcase-minimized-instance_create_fuzzer-5416197367070720");
}
TEST(BadJsonInput, ClusterFuzzTestCase_5494771615137792) {
 // Does crash with UBSAN and ASAN
 // stack-overflow
 // instance_create_fuzzer: Stack-overflow in verify_meta_layer_component_layers
 execute_instance_create_fuzzer("clusterfuzz-testcase-minimized-instance_create_fuzzer-5494771615137792");
}
TEST(BadJsonInput, ClusterFuzzTestCase_5801855065915392) {
 // Does crash with ASAN
 // Doesn't crash with UBSAN
 // Causes a leak - instance_create_fuzzer: Direct-leak in print_string_ptr
 execute_instance_create_fuzzer("clusterfuzz-testcase-minimized-instance_create_fuzzer-5801855065915392");
}
TEST(BadJsonInput, ClusterFuzzTestCase_6353004288081920) {
 // Does crash with ASAN and UBSAN
 // Stack overflow due to recursive meta layers
 execute_instance_create_fuzzer("clusterfuzz-testcase-minimized-instance_create_fuzzer-6353004288081920");
}
TEST(BadJsonInput, ClusterFuzzTestCase_5817896795701248) {
 execute_instance_create_fuzzer("clusterfuzz-testcase-instance_create_fuzzer-5817896795701248");
}
TEST(BadJsonInput, ClusterFuzzTestCase_6541440380895232) {
 execute_instance_create_fuzzer("clusterfuzz-testcase-instance_create_fuzzer-6541440380895232");
}
TEST(BadJsonInput, ClusterFuzzTestCase_5612556809207808) {
 execute_instance_create_advanced_fuzzer("clusterfuzz-testcase-minimized-instance_create_advanced_fuzzer-5612556809207808");
}
TEST(BadJsonInput, ClusterFuzzTestCase_4788849181261824) {
 execute_instance_create_advanced_fuzzer("clusterfuzz-testcase-minimized-instance_create_advanced_fuzzer-4788849181261824");
}
TEST(BadJsonInput, ClusterFuzzTestCase_6465902356791296) {
 // Does crash with UBSAN
 // Doesn't crash with ASAN
 // Causes an integer overflow - instance_enumerate_fuzzer: Integer-overflow in parse_value
 execute_instance_enumerate_fuzzer("clusterfuzz-testcase-minimized-instance_enumerate_fuzzer-6465902356791296");
}
TEST(BadJsonInput, ClusterFuzzTestCase_6740380288876544) {
 // Does crash with ASAN
 execute_instance_enumerate_fuzzer("clusterfuzz-testcase-minimized-instance_enumerate_fuzzer-6740380288876544");
}
TEST(BadJsonInput, ClusterFuzzTestCase_4512865114259456) {
 // Does crash with UBSAN and ASAN
 // malloc(): invalid size (unsorted)
 // json_load_fuzzer: Heap-buffer-overflow in parse_string
 execute_json_load_fuzzer("clusterfuzz-testcase-minimized-json_load_fuzzer-4512865114259456");
}
TEST(BadJsonInput, ClusterFuzzTestCase_4552015310880768) {
 // Does crash with UBSAN
 // Doesn't crash with ASAN
 // Causes an integer overflow
 // json_load_fuzzer: Integer-overflow in parse_value
 execute_json_load_fuzzer("clusterfuzz-testcase-minimized-json_load_fuzzer-4552015310880768");
}
TEST(BadJsonInput, ClusterFuzzTestCase_5208693600747520) {
 // Does crash with UBSAN and ASAN
 // Stack overflow
 // json_load_fuzzer: Stack-overflow in print_value
 execute_json_load_fuzzer("clusterfuzz-testcase-minimized-json_load_fuzzer-5208693600747520");
}
TEST(BadJsonInput, ClusterFuzzTestCase_5347670374612992) {
 // Doesn't crash with ASAN or UBSAN
 // No reported leaks in head, crashes in 1.3.269 & 1.3.250
 // Causes a leak - json_load_fuzzer: Direct-leak in parse_array
 execute_json_load_fuzzer("clusterfuzz-testcase-minimized-json_load_fuzzer-5347670374612992");
}
TEST(BadJsonInput, ClusterFuzzTestCase_5392928643547136) {
 // Does crash with UBSAN and ASAN
 // free(): corrupted unsorted chunks
 // json_load_fuzzer: Abrt in std::__Fuzzer::basic_filebuf<char, std::__Fuzzer::char_traits<char>>::~basic_fil
 execute_json_load_fuzzer("clusterfuzz-testcase-minimized-json_load_fuzzer-5392928643547136");
}
TEST(BadJsonInput, ClusterFuzzTestCase_5636386303049728) {
 // Does crash with UBSAN and ASAN
 // terminate called after throwing an instance of 'std::bad_alloc' what(): std::bad_alloc
 // json_load_fuzzer: Abrt in json_load_fuzzer
 execute_json_load_fuzzer("clusterfuzz-testcase-minimized-json_load_fuzzer-5636386303049728");
}
TEST(BadJsonInput, ClusterFuzzTestCase_6182254813249536) {
 // Doesn't crash with ASAN or UBSAN
 // No leaks reported in main, 1.3.269, nor 1.3.250
 // Causes a leak - json_load_fuzzer: Indirect-leak in parse_object
 execute_json_load_fuzzer("clusterfuzz-testcase-minimized-json_load_fuzzer-6182254813249536");
}
TEST(BadJsonInput, ClusterFuzzTestCase_6265355951996928) {
 // Does crash with UBSAN and ASAN
 // json_load_fuzzer: Null-dereference READ in json_load_fuzzer
 execute_json_load_fuzzer("clusterfuzz-testcase-minimized-json_load_fuzzer-6265355951996928");
}
TEST(BadJsonInput, ClusterFuzzTestCase_6363106126659584) {
 // Does crash with UBSAN and ASAN
 // json_load_fuzzer: Overwrites-const-input in json_load_fuzzer
 execute_json_load_fuzzer("clusterfuzz-testcase-minimized-json_load_fuzzer-6363106126659584");
}
TEST(BadJsonInput, ClusterFuzzTestCase_6482033715838976) {
 // Does crash with UBSAN and ASAN
 // json_load_fuzzer: Stack-overflow in parse_array
 execute_json_load_fuzzer("clusterfuzz-testcase-minimized-json_load_fuzzer-6482033715838976");
}
TEST(BadJsonInput, ClusterFuzzTestCase_4857714377818112) {
 // Does crash with UBSAN and ASAN
 // settings_fuzzer: Abrt in settings_fuzzer
 execute_setting_fuzzer("clusterfuzz-testcase-minimized-settings_fuzzer-4857714377818112");
}
TEST(BadJsonInput, ClusterFuzzTestCase_5123849246867456) {
 // Doesn't crash with ASAN or UBSAN
 // No leaks reported in main, 1.3.269, nor 1.3.250
 // Causes a leak - settings_fuzzer: Direct-leak in loader_append_layer_property
 execute_setting_fuzzer("clusterfuzz-testcase-minimized-settings_fuzzer-5123849246867456");
}
TEST(BadJsonInput, ClusterFuzzTestCase_4626669072875520) {
 execute_setting_fuzzer("clusterfuzz-testcase-minimized-settings_fuzzer-4626669072875520");
}

// A string that ends in the middle of a multi-byte UTF-8 character must not make vk_string_validate read
// past the terminator. Each buffer is sized to its exact contents so ASAN flags any over-read.
TEST(StringValidation, TruncatedMultiByteDoesNotReadPastTerminator) {
 // 2-, 3- and 4-byte lead bytes, each immediately followed by the terminator.
 for (unsigned char lead : {0xC2u, 0xE2u, 0xF0u}) {
 std::vector<char> truncated = {static_cast<char>(lead), '\0'};
 EXPECT_EQ(vk_string_validate(MaxLoaderStringLength, truncated.data()), VK_STRING_ERROR_BAD_DATA);
 }
 // A lead byte with one valid continuation byte but still short of the required count.
 std::vector<char> short_seq = {static_cast<char>(0xE2), static_cast<char>(0x82), '\0'};
 EXPECT_EQ(vk_string_validate(MaxLoaderStringLength, short_seq.data()), VK_STRING_ERROR_BAD_DATA);

 // Well-formed strings still validate cleanly.
 std::vector<char> ascii = {'a', 'b', 'c', '\0'};
 EXPECT_EQ(vk_string_validate(MaxLoaderStringLength, ascii.data()), VK_STRING_ERROR_NONE);
 std::vector<char> two_byte = {static_cast<char>(0xC2), static_cast<char>(0xA9), '\0'};
 EXPECT_EQ(vk_string_validate(MaxLoaderStringLength, two_byte.data()), VK_STRING_ERROR_NONE);
}

// The loader's fork of print_string_ptr strips the escaping backslash, so it writes fewer bytes than the
// upstream escape budget it terminates at. It must terminate at the real end, otherwise the gap up to that
// larger length is read back as part of the string. PrintPreallocated hands the result to a caller-owned
// buffer that is not required to be zeroed, so any stale bytes in the gap leak out.
TEST(JsonStringPrint, PrintPreallocatedTerminatesAtRealEnd) {
 std::filesystem::path json_path = std::filesystem::temp_directory_path() / "loader_print_string_ptr_test.json";
 {
 std::ofstream f(json_path, std::ios::binary | std::ios::trunc);
 // Top-level JSON string whose decoded value needs escaping: decodes to a b <LF> c d \ e f (8 bytes).
 f << "\"ab\\ncd\\\\ef\"";
 }

 cJSON* json = NULL;
 ASSERT_EQ(loader_get_json(NULL, json_path.string().c_str(), &json), VK_SUCCESS);
 ASSERT_NE(json, nullptr);

 // Caller owns the buffer and it need not be zeroed - poison it so a short-write shows up.
 char buffer[64];
 for (char& c : buffer) c = 'X';
 ASSERT_TRUE(loader_cJSON_PrintPreallocated(json, buffer, static_cast<int>(sizeof(buffer)), false));

 const char expected[] = {'a', 'b', '\n', 'c', 'd', '\\', 'e', 'f', '\0'};
 EXPECT_STREQ(buffer, expected);

 loader_cJSON_Delete(json);
 std::filesystem::remove(json_path);
}