Skip to content

Commit f26c239

Browse files
authored
[NRBF] Fuzzing non-seekable stream input (#107605)
1 parent 43f22c6 commit f26c239

File tree

1 file changed

+20
-7
lines changed

1 file changed

+20
-7
lines changed

src/libraries/Fuzzing/DotnetFuzzing/Fuzzers/NrbfDecoderFuzzer.cs

Lines changed: 20 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -18,16 +18,23 @@ internal sealed class NrbfDecoderFuzzer : IFuzzer
1818

1919
public void FuzzTarget(ReadOnlySpan<byte> bytes)
2020
{
21-
using PooledBoundedMemory<byte> inputPoisonedAfter = PooledBoundedMemory<byte>.Rent(bytes, PoisonPagePlacement.After);
22-
using PooledBoundedMemory<byte> inputPoisonedBefore = PooledBoundedMemory<byte>.Rent(bytes, PoisonPagePlacement.Before);
23-
using MemoryStream streamAfter = new MemoryStream(inputPoisonedAfter.Memory.ToArray());
24-
using MemoryStream streamBefore = new MemoryStream(inputPoisonedBefore.Memory.ToArray());
21+
Test(bytes, PoisonPagePlacement.Before);
22+
Test(bytes, PoisonPagePlacement.After);
23+
}
24+
25+
private static void Test(ReadOnlySpan<byte> bytes, PoisonPagePlacement poisonPagePlacement)
26+
{
27+
using PooledBoundedMemory<byte> inputPoisoned = PooledBoundedMemory<byte>.Rent(bytes, poisonPagePlacement);
28+
29+
using MemoryStream seekableStream = new(inputPoisoned.Memory.ToArray());
30+
Test(inputPoisoned.Span, seekableStream);
2531

26-
Test(inputPoisonedAfter.Span, streamAfter);
27-
Test(inputPoisonedBefore.Span, streamBefore);
32+
// NrbfDecoder has few code paths dedicated to non-seekable streams, let's test them as well.
33+
using NonSeekableStream nonSeekableStream = new(inputPoisoned.Memory.ToArray());
34+
Test(inputPoisoned.Span, nonSeekableStream);
2835
}
2936

30-
private static void Test(Span<byte> testSpan, MemoryStream stream)
37+
private static void Test(Span<byte> testSpan, Stream stream)
3138
{
3239
if (NrbfDecoder.StartsWithPayloadHeader(testSpan))
3340
{
@@ -109,5 +116,11 @@ private static void Test(Span<byte> testSpan, MemoryStream stream)
109116
catch (EndOfStreamException) { /* The end of the stream was reached before reading SerializationRecordType.MessageEnd record. */ }
110117
}
111118
}
119+
120+
private class NonSeekableStream : MemoryStream
121+
{
122+
public NonSeekableStream(byte[] buffer) : base(buffer) { }
123+
public override bool CanSeek => false;
124+
}
112125
}
113126
}

0 commit comments

Comments
 (0)