request_data.cc

Go to the documentation of this file.

/*
 * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.
 *
 * SPDX-License-Identifier: curl
 */

 
#include "proto_fuzzer/request_data.h"
 
#include <algorithm>
#include <cstddef>
#include <cstdio>
#include <cstring>
#include <limits>
#include <string>
 
#include "proto_fuzzer/option_apply.h"
#include "proto_fuzzer/scenario_limits.h"
 
namespace proto_fuzzer {
 
namespace {

const char* BoundedCString(const std::string& value, std::size_t limit, std::string* truncated) {
  if (value.size() <= limit) {
    return value.c_str();
  }
  truncated->assign(value.data(), limit);
  return truncated->c_str();
}

bool NeedsUploadCallbacks(const curl::fuzzer::proto::Scenario& scenario) {
  // curl's TELNET implementation polls stdin unless a READFUNCTION was
  // explicitly installed. Always provide the bounded per-scenario source,
  // even when there is no upload payload to send.
  if (scenario.scheme() == curl::fuzzer::proto::SCHEME_TELNET || scenario.has_upload()) {
    return true;
  }
  const std::size_t option_count = RuntimeOptionCount(scenario);
  for (std::size_t index = 0; index < option_count; ++index) {
    const auto& option = scenario.options(static_cast<int>(index));
    if (option.option_id() == curl::fuzzer::proto::CURLOPT_UPLOAD ||
        option.option_id() == curl::fuzzer::proto::CURLOPT_POST) {
      return true;
    }
  }
  return false;
}

const char* MimeEncoderName(curl::fuzzer::proto::MimeEncoder encoder) {
  switch (encoder) {
    case curl::fuzzer::proto::MIME_ENCODER_BINARY:
      return "binary";
    case curl::fuzzer::proto::MIME_ENCODER_8BIT:
      return "8bit";
    case curl::fuzzer::proto::MIME_ENCODER_7BIT:
      return "7bit";
    case curl::fuzzer::proto::MIME_ENCODER_BASE64:
      return "base64";
    case curl::fuzzer::proto::MIME_ENCODER_QUOTED_PRINTABLE:
      return "quoted-printable";
    case curl::fuzzer::proto::MIME_ENCODER_UNSPECIFIED:
    default:
      return nullptr;
  }
}

template <typename RepeatedBytes>
CurlSlistPtr BuildStringList(const RepeatedBytes& values, std::size_t count_limit, std::size_t value_limit,
                             std::size_t* applied) {
  CurlSlistPtr list;
  std::string truncated;
  const std::size_t count = std::min<std::size_t>(count_limit, values.size());
  for (std::size_t i = 0; i < count; ++i) {
    const std::string& value = values.Get(static_cast<int>(i));
    curl_slist* appended = curl_slist_append(list.get(), BoundedCString(value, value_limit, &truncated));
    if (appended == nullptr) {
      break;
    }
    // append retains the existing nodes and may return the same head. Release
    // before resetting so adopting the successful result cannot free them.
    (void)list.release();
    list.reset(appended);
    ++*applied;
  }
  return list;
}

template <typename ProtoPart>
void ApplyPartMetadata(curl_mimepart* part, const ProtoPart& source, RequestBuildStats* stats) {
  // Reuse the rare compatibility-path allocation across all three fields;
  // ordinary postprocessed metadata never writes this scratch string.
  std::string truncated;
  if (!source.name().empty()) {
    (void)curl_mime_name(part, BoundedCString(source.name(), scenario_limits::kMaxMetadataBytes, &truncated));
  }
  if (!source.filename().empty()) {
    (void)curl_mime_filename(part, BoundedCString(source.filename(), scenario_limits::kMaxMetadataBytes, &truncated));
  }
  if (!source.content_type().empty()) {
    (void)curl_mime_type(part, BoundedCString(source.content_type(), scenario_limits::kMaxMetadataBytes, &truncated));
  }
  if (const char* encoder = MimeEncoderName(source.encoder())) {
    (void)curl_mime_encoder(part, encoder);
  }
 
  std::size_t header_count = 0;
  CurlSlistPtr headers = BuildStringList(source.headers(), scenario_limits::kMaxMimeHeadersPerPart,
                                         scenario_limits::kMaxMetadataBytes, &header_count);
  if (headers != nullptr) {
    // take_ownership=1 is crucial: unlike the strings above, MIME retains the
    // list pointer. Once attached, the root curl_mime_free call recursively
    // releases it, including lists on nested parts.
    const CURLcode result = curl_mime_headers(part, headers.get(), 1);
    if (result == CURLE_OK) {
      (void)headers.release();
      stats->mime_headers += header_count;
    }
  }
}

void ApplyPartData(curl_mimepart* part, const std::string& data) {
  const std::size_t size = std::min(data.size(), scenario_limits::kMaxMimeDataBytes);
  const char* bytes = data.empty() ? "" : data.data();
  (void)curl_mime_data(part, bytes, size);
}

void ApplyGeneratedPartData(curl_mimepart* part, const curl::fuzzer::proto::GeneratedBytes& source,
                            std::size_t* remaining_generated_bytes, RequestBuildStats* stats) {
  const std::size_t pattern_size = std::min(source.pattern().size(), scenario_limits::kMaxGeneratedMimePatternBytes);
  if (pattern_size == 0 || *remaining_generated_bytes == 0) {
    (void)curl_mime_data(part, "", 0);
    return;
  }
 
  const std::size_t max_repeat_count = *remaining_generated_bytes / pattern_size;
  const std::size_t repeat_count =
      std::min<std::size_t>(static_cast<std::size_t>(source.repeat_count()), max_repeat_count);
  const std::size_t materialized_size = repeat_count * pattern_size;
 
  std::string materialized(materialized_size, '\0');
  for (std::size_t offset = 0; offset < materialized_size; offset += pattern_size) {
    std::copy_n(source.pattern().data(), pattern_size, materialized.data() + offset);
  }
  const char* bytes = materialized.empty() ? "" : materialized.data();
  if (curl_mime_data(part, bytes, materialized.size()) == CURLE_OK) {
    stats->generated_mime_bytes += materialized.size();
  }
  *remaining_generated_bytes -= materialized.size();
}

void PopulateSubparts(curl_mime* mime, const curl::fuzzer::proto::MimeSubparts& source, std::size_t* remaining_parts,
                      std::size_t* remaining_generated_bytes, RequestBuildStats* stats) {
  const std::size_t count = std::min<std::size_t>(scenario_limits::kMaxNestedMimeParts, source.parts_size());
  for (std::size_t i = 0; i < count && *remaining_parts != 0; ++i) {
    curl_mimepart* part = curl_mime_addpart(mime);
    if (part == nullptr) {
      break;
    }
    --*remaining_parts;
    ++stats->mime_parts;
    const auto& proto_part = source.parts(static_cast<int>(i));
    ApplyPartMetadata(part, proto_part, stats);
    if (proto_part.content_case() == curl::fuzzer::proto::MimeDataPart::kGeneratedData) {
      ApplyGeneratedPartData(part, proto_part.generated_data(), remaining_generated_bytes, stats);
    } else {
      // Preserve the historical leaf behavior: an absent source is applied as
      // empty data just like an explicitly empty field 2.
      ApplyPartData(part, proto_part.data());
    }
  }
}

CurlMimePtr BuildMimePost(CURL* easy, const curl::fuzzer::proto::MimePost& source, UploadScriptState* upload_state,
                          RequestBuildStats* stats) {
  CurlMimePtr mime(curl_mime_init(easy));
  if (mime == nullptr) {
    return nullptr;
  }
 
  std::size_t remaining_parts = scenario_limits::kMaxTotalMimeParts;
  std::size_t remaining_generated_bytes = scenario_limits::kMaxGeneratedMimeDataBytes;
  const std::size_t count = std::min<std::size_t>(scenario_limits::kMaxTopLevelMimeParts, source.parts_size());
  for (std::size_t i = 0; i < count && remaining_parts != 0; ++i) {
    curl_mimepart* part = curl_mime_addpart(mime.get());
    if (part == nullptr) {
      break;
    }
    --remaining_parts;
    ++stats->mime_parts;
    const auto& proto_part = source.parts(static_cast<int>(i));
    ApplyPartMetadata(part, proto_part, stats);
 
    switch (proto_part.content_case()) {
      case curl::fuzzer::proto::MimePart::kData:
        ApplyPartData(part, proto_part.data());
        break;
      case curl::fuzzer::proto::MimePart::kGeneratedData:
        ApplyGeneratedPartData(part, proto_part.generated_data(), &remaining_generated_bytes, stats);
        break;
      case curl::fuzzer::proto::MimePart::kUploadCallback:
        if (upload_state != nullptr && upload_state->InstallAsMimePart(part) == CURLE_OK) {
          ++stats->mime_callback_parts;
        }
        break;
      case curl::fuzzer::proto::MimePart::kSubparts: {
        CurlMimePtr subparts(curl_mime_init(easy));
        if (subparts == nullptr) {
          break;
        }
        PopulateSubparts(subparts.get(), proto_part.subparts(), &remaining_parts, &remaining_generated_bytes, stats);
        if (curl_mime_subparts(part, subparts.get()) == CURLE_OK) {
          (void)subparts.release();
        }
        break;
      }
      case curl::fuzzer::proto::MimePart::CONTENT_NOT_SET:
      default:
        break;
    }
  }
  return mime;
}
 
}  // namespace

UploadScriptState::UploadScriptState(const curl::fuzzer::proto::Scenario& scenario)
    : data_(),
      read_step_count_(0),
      total_size_(scenario.scheme() == curl::fuzzer::proto::SCHEME_TELNET ? 0 : scenario_limits::kMaxUploadBytes),
      max_read_size_(scenario.scheme() == curl::fuzzer::proto::SCHEME_TELNET ? scenario_limits::kMaxTelnetUploadReadSize
                                                                             : scenario_limits::kMaxUploadReadSize),
      offset_(0),
      next_read_size_(0),
      seek_calls_(0),
      terminal_(curl::fuzzer::proto::UPLOAD_TERMINAL_EOF),
      seek_result_(curl::fuzzer::proto::UPLOAD_SEEK_CANTSEEK),
      before_read_callback_(nullptr),
      before_read_userdata_(nullptr),
      scripted_(scenario.has_upload()) {
  if (!scripted_) {
    return;
  }
 
  const auto& upload = scenario.upload();
  const std::size_t data_limit = scenario.scheme() == curl::fuzzer::proto::SCHEME_TELNET
                                     ? scenario_limits::kMaxTelnetUploadBytes
                                     : scenario_limits::kMaxUploadBytes;
  const std::size_t data_size = std::min(upload.data().size(), data_limit);
  data_ = std::string_view(upload.data().data(), data_size);
  total_size_ = data_.size();
  terminal_ = upload.terminal();
  if (scenario.scheme() != curl::fuzzer::proto::SCHEME_TELNET &&
      terminal_ == curl::fuzzer::proto::UPLOAD_TERMINAL_PAUSE) {
    // Event-driven protocols need an external resume source. Interpret this
    // TELNET-specific outcome as EOF before curl can retain a paused transfer.
    terminal_ = curl::fuzzer::proto::UPLOAD_TERMINAL_EOF;
  }
  seek_result_ = upload.seek_result();
 
  const std::size_t read_step_limit = scenario.scheme() == curl::fuzzer::proto::SCHEME_TELNET
                                          ? scenario_limits::kMaxTelnetUploadReadSteps
                                          : scenario_limits::kMaxUploadReadSteps;
  read_step_count_ = std::min<std::size_t>(upload.read_sizes_size(), read_step_limit);
  for (std::size_t i = 0; i < read_step_count_; ++i) {
    const std::size_t requested = upload.read_sizes(static_cast<int>(i));
    // Zero-as-one ensures every retained step makes progress; see the schema
    // comment for why zero is not treated as an early EOF sentinel.
    read_sizes_[i] = std::max<std::size_t>(1, std::min(requested, max_read_size_));
  }
}

std::size_t UploadScriptState::Read(char* buffer, std::size_t capacity) {
  // TELNET can produce negotiation replies while one curl_multi_perform call
  // owns the thread. Empty them before returning more callback bytes;
  // otherwise send_telnet_data() can consume the whole bounded transfer
  // timeout while the synchronous path waits for socket capacity.
  if (before_read_callback_ != nullptr) {
    before_read_callback_(before_read_userdata_);
  }
  if (offset_ >= total_size_) {
    switch (terminal_) {
      case curl::fuzzer::proto::UPLOAD_TERMINAL_ABORT:
        return CURL_READFUNC_ABORT;
      case curl::fuzzer::proto::UPLOAD_TERMINAL_PAUSE:
        return CURL_READFUNC_PAUSE;
      case curl::fuzzer::proto::UPLOAD_TERMINAL_EOF:
      default:
        return 0;
    }
  }
  if (buffer == nullptr || capacity == 0) {
    return 0;
  }
 
  std::size_t chunk_limit = std::min(capacity, max_read_size_);
  if (next_read_size_ < read_step_count_) {
    chunk_limit = std::min(chunk_limit, read_sizes_[next_read_size_++]);
  }
  const std::size_t count = std::min(chunk_limit, total_size_ - offset_);
  if (scripted_) {
    std::memcpy(buffer, data_.data() + offset_, count);
  } else {
    std::memset(buffer, 'U', count);
  }
  offset_ += count;
  return count;
}

int UploadScriptState::Seek(curl_off_t requested_offset, int origin) {
  ++seek_calls_;
  switch (seek_result_) {
    case curl::fuzzer::proto::UPLOAD_SEEK_CANTSEEK:
      return CURL_SEEKFUNC_CANTSEEK;
    case curl::fuzzer::proto::UPLOAD_SEEK_FAIL:
      return CURL_SEEKFUNC_FAIL;
    case curl::fuzzer::proto::UPLOAD_SEEK_OK:
      break;
    default:
      return CURL_SEEKFUNC_CANTSEEK;
  }
 
  const curl_off_t current = static_cast<curl_off_t>(offset_);
  const curl_off_t end = static_cast<curl_off_t>(total_size_);
  curl_off_t base = 0;
  switch (origin) {
    case SEEK_SET:
      base = 0;
      break;
    case SEEK_CUR:
      base = current;
      break;
    case SEEK_END:
      base = end;
      break;
    default:
      return CURL_SEEKFUNC_FAIL;
  }
 
  // Both base and end are at most 16 KiB. Comparing the requested delta to
  // these small bounds before addition handles even CURL_OFF_T_MIN safely.
  if (requested_offset < -base || requested_offset > end - base) {
    return CURL_SEEKFUNC_FAIL;
  }
  offset_ = static_cast<std::size_t>(base + requested_offset);
  next_read_size_ = 0;
  return CURL_SEEKFUNC_OK;
}

std::size_t UploadScriptState::ReadCallback(char* buffer, std::size_t size, std::size_t nitems, void* userdata) {
  if (userdata == nullptr || size == 0 || nitems == 0) {
    return 0;
  }
  const std::size_t max = std::numeric_limits<std::size_t>::max();
  if (nitems > max / size) {
    return CURL_READFUNC_ABORT;
  }
  return static_cast<UploadScriptState*>(userdata)->Read(buffer, size * nitems);
}

int UploadScriptState::SeekCallback(void* userdata, curl_off_t offset, int origin) {
  if (userdata == nullptr) {
    return CURL_SEEKFUNC_FAIL;
  }
  return static_cast<UploadScriptState*>(userdata)->Seek(offset, origin);
}

std::size_t UploadScriptState::data_size() const { return total_size_; }

std::size_t UploadScriptState::read_step_count() const { return read_step_count_; }

std::size_t UploadScriptState::offset() const { return offset_; }

std::size_t UploadScriptState::seek_calls() const { return seek_calls_; }

bool UploadScriptState::scripted() const { return scripted_; }

CURLcode UploadScriptState::InstallAsMimePart(curl_mimepart* part) {
  if (part == nullptr) {
    return CURLE_BAD_FUNCTION_ARGUMENT;
  }
  return curl_mime_data_cb(part, static_cast<curl_off_t>(total_size_), &UploadScriptState::ReadCallback,
                           &UploadScriptState::SeekCallback, nullptr, this);
}

void UploadScriptState::SetBeforeReadCallback(BeforeReadCallback callback, void* userdata) {
  before_read_callback_ = callback;
  before_read_userdata_ = userdata;
}

ScenarioRequestData::ScenarioRequestData(CURL* easy, const curl::fuzzer::proto::Scenario& scenario,
                                         bool apply_resolve_entries)
    : easy_(easy),
      request_headers_(nullptr),
      resolve_entries_(nullptr),
      telnet_options_(nullptr),
      mail_rcpt_(nullptr),
      upload_state_(scenario),
      mime_post_(nullptr),
      upload_callbacks_installed_(false),
      resolve_entries_ready_(!apply_resolve_entries) {
  if (easy_ == nullptr) {
    return;
  }
 
  // Complete all allocating work before installing retained pointers. If a
  // C++ allocation throws, scoped owners unwind without leaving the easy
  // handle pointing into a partially constructed request-data object.
  bool resolve_entries_built = false;
  if (apply_resolve_entries) {
    resolve_entries_ = BuildStringList(scenario.resolve_entries(), scenario_limits::kMaxResolveEntries,
                                       scenario_limits::kMaxResolveEntryBytes, &stats_.resolve_entries);
    // This mapping is deliberately last: preceding wildcard or removal
    // mutations may exercise host-cache parsing, but cannot redirect the
    // canonical resolver-lane origin away from the in-process mock.
    curl_slist* appended = curl_slist_append(resolve_entries_.get(), "resolve.test:80:127.0.0.1");
    if (appended != nullptr) {
      (void)resolve_entries_.release();
      resolve_entries_.reset(appended);
      resolve_entries_built = true;
    }
  }
 
  // HTTP headers/MIME and TELNET options are mutually exclusive because only
  // the selected protocol can observe them. Avoid allocating protocol-inert
  // lists and trees in compatibility inputs that bypass target policy.
  if (scenario.scheme() == curl::fuzzer::proto::SCHEME_TELNET) {
    telnet_options_ = BuildStringList(scenario.telnet_options(), scenario_limits::kMaxTelnetOptions,
                                      scenario_limits::kMaxTelnetOptionBytes, &stats_.telnet_options);
  } else {
    request_headers_ = BuildStringList(scenario.request_headers(), scenario_limits::kMaxRequestHeaders,
                                       scenario_limits::kMaxMetadataBytes, &stats_.request_headers);
    if (scenario.has_mime_post()) {
      mime_post_ = BuildMimePost(easy_, scenario.mime_post(), &upload_state_, &stats_);
    }
  }
 
  if (scenario.scheme() == curl::fuzzer::proto::SCHEME_SMTP || scenario.scheme() == curl::fuzzer::proto::SCHEME_SMTPS ||
      !scenario.mail_rcpt().empty()) {
    // Recipient list entries borrow protobuf-owned storage only for the
    // duration of BuildStringList; curl_slist_append copies each address.
    mail_rcpt_ = BuildStringList(scenario.mail_rcpt(), scenario_limits::kMaxMailRecipients,
                                 scenario_limits::kMaxMailRecipientBytes, &stats_.mail_rcpt);
  }
 
  if (resolve_entries_built) {
    resolve_entries_ready_ = curl_easy_setopt(easy_, CURLOPT_RESOLVE, resolve_entries_.get()) == CURLE_OK;
  }
 
  if (NeedsUploadCallbacks(scenario)) {
    // Install a per-run memory source even when Scenario.upload is absent but
    // CURLOPT_UPLOAD or TELNET may request caller input. Non-TELNET schemes
    // retain the historical fallback bytes; TELNET returns EOF. Either result
    // replaces stdin and cannot block OSS-Fuzz. The state remains scoped to
    // the complete drive so retries cannot share a cursor across iterations.
    upload_callbacks_installed_ = true;
    (void)curl_easy_setopt(easy_, CURLOPT_READFUNCTION, &UploadScriptState::ReadCallback);
    (void)curl_easy_setopt(easy_, CURLOPT_READDATA, &upload_state_);
    (void)curl_easy_setopt(easy_, CURLOPT_SEEKFUNCTION, &UploadScriptState::SeekCallback);
    (void)curl_easy_setopt(easy_, CURLOPT_SEEKDATA, &upload_state_);
  }
 
  if (telnet_options_ != nullptr) {
    (void)curl_easy_setopt(easy_, CURLOPT_TELNETOPTIONS, telnet_options_.get());
  }
  if (mail_rcpt_ != nullptr) {
    (void)curl_easy_setopt(easy_, CURLOPT_MAIL_RCPT, mail_rcpt_.get());
  }
  if (request_headers_ != nullptr) {
    (void)curl_easy_setopt(easy_, CURLOPT_HTTPHEADER, request_headers_.get());
  }
  if (mime_post_ != nullptr) {
    (void)curl_easy_setopt(easy_, CURLOPT_MIMEPOST, mime_post_.get());
  }
}

ScenarioRequestData::~ScenarioRequestData() {
  if (easy_ != nullptr) {
    // Clear callbacks before their userdata member is destroyed. There is no
    // perform in this destructor, but making the handle non-dangling keeps the
    // ownership rule robust if cleanup later gains diagnostics or getinfo.
    if (upload_callbacks_installed_) {
      (void)curl_easy_setopt(easy_, CURLOPT_SEEKFUNCTION, nullptr);
      (void)curl_easy_setopt(easy_, CURLOPT_SEEKDATA, nullptr);
      (void)curl_easy_setopt(easy_, CURLOPT_READFUNCTION, nullptr);
      (void)curl_easy_setopt(easy_, CURLOPT_READDATA, nullptr);
    }
    if (mime_post_ != nullptr) {
      (void)curl_easy_setopt(easy_, CURLOPT_MIMEPOST, nullptr);
    }
    if (request_headers_ != nullptr) {
      (void)curl_easy_setopt(easy_, CURLOPT_HTTPHEADER, nullptr);
    }
    if (resolve_entries_ != nullptr) {
      (void)curl_easy_setopt(easy_, CURLOPT_RESOLVE, nullptr);
    }
    if (telnet_options_ != nullptr) {
      (void)curl_easy_setopt(easy_, CURLOPT_TELNETOPTIONS, nullptr);
    }
    if (mail_rcpt_ != nullptr) {
      (void)curl_easy_setopt(easy_, CURLOPT_MAIL_RCPT, nullptr);
    }
  }
  // Callback MIME parts retain upload_state_ as userdata. Release the root
  // explicitly while that state is still live instead of relying only on
  // reverse member destruction order.
  mime_post_.reset();
}

const RequestBuildStats& ScenarioRequestData::stats() const { return stats_; }

const UploadScriptState& ScenarioRequestData::upload_state() const { return upload_state_; }

bool ScenarioRequestData::upload_callbacks_installed() const { return upload_callbacks_installed_; }

bool ScenarioRequestData::resolve_entries_ready() const { return resolve_entries_ready_; }

void ScenarioRequestData::SetBeforeUploadReadCallback(UploadScriptState::BeforeReadCallback callback, void* userdata) {
  upload_state_.SetBeforeReadCallback(callback, userdata);
}
 
}  // namespace proto_fuzzer