Initial commit

lib/openssl-1.1.0g/fuzz/README.md

@@ -0,0 +1,66 @@
+# I Can Haz Fuzz?
+
+LibFuzzer
+=========
+
+Or, how to fuzz OpenSSL with [libfuzzer](http://llvm.org/docs/LibFuzzer.html).
+
+Starting from a vanilla+OpenSSH server Ubuntu install.
+
+Use Chrome's handy recent build of clang. Older versions may also work.
+
+    $ sudo apt-get install git
+    $ mkdir git-work
+    $ git clone https://chromium.googlesource.com/chromium/src/tools/clang
+    $ clang/scripts/update.py
+
+You may want to git pull and re-run the update from time to time.
+
+Update your path:
+
+    $ PATH=~/third_party/llvm-build/Release+Asserts/bin/:$PATH
+
+Get and build libFuzzer (there is a git mirror at
+https://github.com/llvm-mirror/llvm/tree/master/lib/Fuzzer if you prefer):
+
+    $ cd
+    $ sudo apt-get install subversion
+    $ mkdir svn-work
+    $ cd svn-work
+    $ svn co http://llvm.org/svn/llvm-project/llvm/trunk/lib/Fuzzer
+    $ cd Fuzzer
+    $ clang++ -c -g -O2 -std=c++11 *.cpp
+    $ ar r libFuzzer.a *.o
+    $ ranlib libFuzzer.a
+
+Configure for fuzzing:
+
+    $ CC=clang ./config enable-fuzz-libfuzzer \
+            --with-fuzzer-include=../../svn-work/Fuzzer \
+            --with-fuzzer-lib=../../svn-work/Fuzzer/libFuzzer \
+            -DPEDANTIC enable-asan enable-ubsan no-shared
+    $ sudo apt-get install make
+    $ LDCMD=clang++ make -j
+    $ fuzz/helper.py $FUZZER
+
+Where $FUZZER is one of the executables in `fuzz/`.
+
+If you get a crash, you should find a corresponding input file in
+`fuzz/corpora/$FUZZER-crash/`. You can reproduce the crash with
+
+    $ fuzz/$FUZZER <crashfile>
+
+AFL
+===
+
+Configure for fuzzing:
+
+    $ sudo apt-get install afl-clang
+    $ CC=afl-clang-fast ./config enable-fuzz-afl no-shared
+    $ make
+
+Run one of the fuzzers:
+
+    $ afl-fuzz -i fuzz/corpora/$FUZZER -o fuzz/corpora/$FUZZER/out fuzz/$FUZZER
+
+Where $FUZZER is one of the executables in `fuzz/`.

lib/openssl-1.1.0g/fuzz/asn1.c

@@ -0,0 +1,222 @@
+/*
+ * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the OpenSSL licenses, (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * https://www.openssl.org/source/license.html
+ * or in the file LICENSE in the source distribution.
+ */
+
+/*
+ * Fuzz ASN.1 parsing for various data structures. Specify which on the
+ * command line:
+ *
+ * asn1 <data structure>
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <openssl/asn1.h>
+#include <openssl/asn1t.h>
+#include <openssl/dh.h>
+#include <openssl/ec.h>
+#include <openssl/ocsp.h>
+#include <openssl/pkcs12.h>
+#include <openssl/rsa.h>
+#include <openssl/ts.h>
+#include <openssl/x509v3.h>
+#include <openssl/cms.h>
+#include "fuzzer.h"
+
+static ASN1_ITEM_EXP *item_type[] = {
+    ASN1_ITEM_ref(ACCESS_DESCRIPTION),
+#ifndef OPENSSL_NO_RFC3779
+    ASN1_ITEM_ref(ASIdentifierChoice),
+    ASN1_ITEM_ref(ASIdentifiers),
+    ASN1_ITEM_ref(ASIdOrRange),
+#endif
+    ASN1_ITEM_ref(ASN1_ANY),
+    ASN1_ITEM_ref(ASN1_BIT_STRING),
+    ASN1_ITEM_ref(ASN1_BMPSTRING),
+    ASN1_ITEM_ref(ASN1_BOOLEAN),
+    ASN1_ITEM_ref(ASN1_ENUMERATED),
+    ASN1_ITEM_ref(ASN1_FBOOLEAN),
+    ASN1_ITEM_ref(ASN1_GENERALIZEDTIME),
+    ASN1_ITEM_ref(ASN1_GENERALSTRING),
+    ASN1_ITEM_ref(ASN1_IA5STRING),
+    ASN1_ITEM_ref(ASN1_INTEGER),
+    ASN1_ITEM_ref(ASN1_NULL),
+    ASN1_ITEM_ref(ASN1_OBJECT),
+    ASN1_ITEM_ref(ASN1_OCTET_STRING),
+    ASN1_ITEM_ref(ASN1_OCTET_STRING_NDEF),
+    ASN1_ITEM_ref(ASN1_PRINTABLE),
+    ASN1_ITEM_ref(ASN1_PRINTABLESTRING),
+    ASN1_ITEM_ref(ASN1_SEQUENCE),
+    ASN1_ITEM_ref(ASN1_SEQUENCE_ANY),
+    ASN1_ITEM_ref(ASN1_SET_ANY),
+    ASN1_ITEM_ref(ASN1_T61STRING),
+    ASN1_ITEM_ref(ASN1_TBOOLEAN),
+    ASN1_ITEM_ref(ASN1_TIME),
+    ASN1_ITEM_ref(ASN1_UNIVERSALSTRING),
+    ASN1_ITEM_ref(ASN1_UTCTIME),
+    ASN1_ITEM_ref(ASN1_UTF8STRING),
+    ASN1_ITEM_ref(ASN1_VISIBLESTRING),
+#ifndef OPENSSL_NO_RFC3779
+    ASN1_ITEM_ref(ASRange),
+#endif
+    ASN1_ITEM_ref(AUTHORITY_INFO_ACCESS),
+    ASN1_ITEM_ref(AUTHORITY_KEYID),
+    ASN1_ITEM_ref(BASIC_CONSTRAINTS),
+    ASN1_ITEM_ref(BIGNUM),
+    ASN1_ITEM_ref(CBIGNUM),
+    ASN1_ITEM_ref(CERTIFICATEPOLICIES),
+#ifndef OPENSSL_NO_CMS
+    ASN1_ITEM_ref(CMS_ContentInfo),
+    ASN1_ITEM_ref(CMS_ReceiptRequest),
+    ASN1_ITEM_ref(CRL_DIST_POINTS),
+#endif
+#ifndef OPENSSL_NO_DH
+    ASN1_ITEM_ref(DHparams),
+#endif
+    ASN1_ITEM_ref(DIRECTORYSTRING),
+    ASN1_ITEM_ref(DISPLAYTEXT),
+    ASN1_ITEM_ref(DIST_POINT),
+    ASN1_ITEM_ref(DIST_POINT_NAME),
+#ifndef OPENSSL_NO_EC
+    ASN1_ITEM_ref(ECPARAMETERS),
+    ASN1_ITEM_ref(ECPKPARAMETERS),
+#endif
+    ASN1_ITEM_ref(EDIPARTYNAME),
+    ASN1_ITEM_ref(EXTENDED_KEY_USAGE),
+    ASN1_ITEM_ref(GENERAL_NAME),
+    ASN1_ITEM_ref(GENERAL_NAMES),
+    ASN1_ITEM_ref(GENERAL_SUBTREE),
+#ifndef OPENSSL_NO_RFC3779
+    ASN1_ITEM_ref(IPAddressChoice),
+    ASN1_ITEM_ref(IPAddressFamily),
+    ASN1_ITEM_ref(IPAddressOrRange),
+    ASN1_ITEM_ref(IPAddressRange),
+#endif
+    ASN1_ITEM_ref(ISSUING_DIST_POINT),
+    ASN1_ITEM_ref(LONG),
+    ASN1_ITEM_ref(NAME_CONSTRAINTS),
+    ASN1_ITEM_ref(NETSCAPE_CERT_SEQUENCE),
+    ASN1_ITEM_ref(NETSCAPE_SPKAC),
+    ASN1_ITEM_ref(NETSCAPE_SPKI),
+    ASN1_ITEM_ref(NOTICEREF),
+#ifndef OPENSSL_NO_OCSP
+    ASN1_ITEM_ref(OCSP_BASICRESP),
+    ASN1_ITEM_ref(OCSP_CERTID),
+    ASN1_ITEM_ref(OCSP_CERTSTATUS),
+    ASN1_ITEM_ref(OCSP_CRLID),
+    ASN1_ITEM_ref(OCSP_ONEREQ),
+    ASN1_ITEM_ref(OCSP_REQINFO),
+    ASN1_ITEM_ref(OCSP_REQUEST),
+    ASN1_ITEM_ref(OCSP_RESPBYTES),
+    ASN1_ITEM_ref(OCSP_RESPDATA),
+    ASN1_ITEM_ref(OCSP_RESPID),
+    ASN1_ITEM_ref(OCSP_RESPONSE),
+    ASN1_ITEM_ref(OCSP_REVOKEDINFO),
+    ASN1_ITEM_ref(OCSP_SERVICELOC),
+    ASN1_ITEM_ref(OCSP_SIGNATURE),
+    ASN1_ITEM_ref(OCSP_SINGLERESP),
+#endif
+    ASN1_ITEM_ref(OTHERNAME),
+    ASN1_ITEM_ref(PBE2PARAM),
+    ASN1_ITEM_ref(PBEPARAM),
+    ASN1_ITEM_ref(PBKDF2PARAM),
+    ASN1_ITEM_ref(PKCS12),
+    ASN1_ITEM_ref(PKCS12_AUTHSAFES),
+    ASN1_ITEM_ref(PKCS12_BAGS),
+    ASN1_ITEM_ref(PKCS12_MAC_DATA),
+    ASN1_ITEM_ref(PKCS12_SAFEBAG),
+    ASN1_ITEM_ref(PKCS12_SAFEBAGS),
+    ASN1_ITEM_ref(PKCS7),
+    ASN1_ITEM_ref(PKCS7_ATTR_SIGN),
+    ASN1_ITEM_ref(PKCS7_ATTR_VERIFY),
+    ASN1_ITEM_ref(PKCS7_DIGEST),
+    ASN1_ITEM_ref(PKCS7_ENC_CONTENT),
+    ASN1_ITEM_ref(PKCS7_ENCRYPT),
+    ASN1_ITEM_ref(PKCS7_ENVELOPE),
+    ASN1_ITEM_ref(PKCS7_ISSUER_AND_SERIAL),
+    ASN1_ITEM_ref(PKCS7_RECIP_INFO),
+    ASN1_ITEM_ref(PKCS7_SIGNED),
+    ASN1_ITEM_ref(PKCS7_SIGN_ENVELOPE),
+    ASN1_ITEM_ref(PKCS7_SIGNER_INFO),
+    ASN1_ITEM_ref(PKCS8_PRIV_KEY_INFO),
+    ASN1_ITEM_ref(PKEY_USAGE_PERIOD),
+    ASN1_ITEM_ref(POLICY_CONSTRAINTS),
+    ASN1_ITEM_ref(POLICYINFO),
+    ASN1_ITEM_ref(POLICY_MAPPING),
+    ASN1_ITEM_ref(POLICY_MAPPINGS),
+    ASN1_ITEM_ref(POLICYQUALINFO),
+    ASN1_ITEM_ref(PROXY_CERT_INFO_EXTENSION),
+    ASN1_ITEM_ref(PROXY_POLICY),
+    ASN1_ITEM_ref(RSA_OAEP_PARAMS),
+    ASN1_ITEM_ref(RSAPrivateKey),
+    ASN1_ITEM_ref(RSA_PSS_PARAMS),
+    ASN1_ITEM_ref(RSAPublicKey),
+    ASN1_ITEM_ref(SXNET),
+    ASN1_ITEM_ref(SXNETID),
+    /*ASN1_ITEM_ref(TS_RESP),  want to do this, but type is hidden, however d2i exists... */
+    ASN1_ITEM_ref(USERNOTICE),
+    ASN1_ITEM_ref(X509),
+    ASN1_ITEM_ref(X509_ALGOR),
+    ASN1_ITEM_ref(X509_ALGORS),
+    ASN1_ITEM_ref(X509_ATTRIBUTE),
+    ASN1_ITEM_ref(X509_CERT_AUX),
+    ASN1_ITEM_ref(X509_CINF),
+    ASN1_ITEM_ref(X509_CRL),
+    ASN1_ITEM_ref(X509_CRL_INFO),
+    ASN1_ITEM_ref(X509_EXTENSION),
+    ASN1_ITEM_ref(X509_EXTENSIONS),
+    ASN1_ITEM_ref(X509_NAME),
+    ASN1_ITEM_ref(X509_NAME_ENTRY),
+    ASN1_ITEM_ref(X509_PUBKEY),
+    ASN1_ITEM_ref(X509_REQ),
+    ASN1_ITEM_ref(X509_REQ_INFO),
+    ASN1_ITEM_ref(X509_REVOKED),
+    ASN1_ITEM_ref(X509_SIG),
+    ASN1_ITEM_ref(X509_VAL),
+    ASN1_ITEM_ref(ZLONG),
+    NULL
+};
+
+int FuzzerInitialize(int *argc, char ***argv) {
+    return 1;
+}
+
+int FuzzerTestOneInput(const uint8_t *buf, size_t len) {
+    int n;
+
+    ASN1_PCTX *pctx = ASN1_PCTX_new();
+
+    ASN1_PCTX_set_flags(pctx, ASN1_PCTX_FLAGS_SHOW_ABSENT |
+        ASN1_PCTX_FLAGS_SHOW_SEQUENCE | ASN1_PCTX_FLAGS_SHOW_SSOF |
+        ASN1_PCTX_FLAGS_SHOW_TYPE | ASN1_PCTX_FLAGS_SHOW_FIELD_STRUCT_NAME);
+    ASN1_PCTX_set_str_flags(pctx, ASN1_STRFLGS_UTF8_CONVERT |
+        ASN1_STRFLGS_SHOW_TYPE | ASN1_STRFLGS_DUMP_ALL);
+
+    for (n = 0; item_type[n] != NULL; ++n) {
+        const uint8_t *b = buf;
+        unsigned char *der = NULL;
+        const ASN1_ITEM *i = ASN1_ITEM_ptr(item_type[n]);
+        ASN1_VALUE *o = ASN1_item_d2i(NULL, &b, len, i);
+
+        if (o != NULL) {
+            BIO *bio = BIO_new(BIO_s_null());
+            ASN1_item_print(bio, o, 4, i, pctx);
+            BIO_free(bio);
+
+            ASN1_item_i2d(o, &der, i);
+            OPENSSL_free(der);
+
+            ASN1_item_free(o, i);
+        }
+    }
+
+    ASN1_PCTX_free(pctx);
+
+    return 0;
+}

lib/openssl-1.1.0g/fuzz/asn1parse.c

@@ -0,0 +1,33 @@
+/*
+ * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the OpenSSL licenses, (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * https://www.openssl.org/source/license.html
+ * or in the file LICENSE in the source distribution.
+ */
+
+/*
+ * Fuzz the parser used for dumping ASN.1 using "openssl asn1parse".
+ */
+
+#include <stdio.h>
+#include <openssl/asn1.h>
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+#include "fuzzer.h"
+
+int FuzzerInitialize(int *argc, char ***argv) {
+    return 1;
+}
+
+int FuzzerTestOneInput(const uint8_t *buf, size_t len) {
+    static BIO *bio_out;
+
+    if (bio_out == NULL)
+        bio_out = BIO_new_file("/dev/null", "w");
+
+    (void)ASN1_parse_dump(bio_out, buf, len, 0, 0);
+    return 0;
+}

lib/openssl-1.1.0g/fuzz/bignum.c

@@ -0,0 +1,94 @@
+/*
+ * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the OpenSSL licenses, (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * https://www.openssl.org/source/license.html
+ * or in the file LICENSE in the source distribution.
+ */
+
+/*
+ * Confirm that a^b mod c agrees when calculated cleverly vs naively, for
+ * random a, b and c.
+ */
+
+#include <stdio.h>
+#include <openssl/bn.h>
+#include "fuzzer.h"
+
+int FuzzerInitialize(int *argc, char ***argv) {
+    return 1;
+}
+
+int FuzzerTestOneInput(const uint8_t *buf, size_t len) {
+    static BN_CTX *ctx;
+    static BIGNUM *b1;
+    static BIGNUM *b2;
+    static BIGNUM *b3;
+    static BIGNUM *b4;
+    static BIGNUM *b5;
+    int success = 0;
+    size_t l1 = 0, l2 = 0, l3 = 0;
+    int s1 = 0, s2 = 0, s3 = 0;
+
+    if (ctx == NULL) {
+        b1 = BN_new();
+        b2 = BN_new();
+        b3 = BN_new();
+        b4 = BN_new();
+        b5 = BN_new();
+        ctx = BN_CTX_new();
+    }
+    /* Divide the input into three parts, using the values of the first two
+     * bytes to choose lengths, which generate b1, b2 and b3. Use three bits
+     * of the third byte to choose signs for the three numbers.
+     */
+    if (len > 2) {
+        len -= 3;
+        l1 = (buf[0] * len) / 255;
+        ++buf;
+        l2 = (buf[0] * (len - l1)) / 255;
+        ++buf;
+        l3 = len - l1 - l2;
+
+        s1 = buf[0] & 1;
+        s2 = buf[0] & 2;
+        s3 = buf[0] & 4;
+        ++buf;
+    }
+    OPENSSL_assert(BN_bin2bn(buf, l1, b1) == b1);
+    BN_set_negative(b1, s1);
+    OPENSSL_assert(BN_bin2bn(buf + l1, l2, b2) == b2);
+    BN_set_negative(b2, s2);
+    OPENSSL_assert(BN_bin2bn(buf + l1 + l2, l3, b3) == b3);
+    BN_set_negative(b3, s3);
+
+    /* mod 0 is undefined */
+    if (BN_is_zero(b3)) {
+        success = 1;
+        goto done;
+    }
+
+    OPENSSL_assert(BN_mod_exp(b4, b1, b2, b3, ctx));
+    OPENSSL_assert(BN_mod_exp_simple(b5, b1, b2, b3, ctx));
+
+    success = BN_cmp(b4, b5) == 0;
+    if (!success) {
+        BN_print_fp(stdout, b1);
+        putchar('\n');
+        BN_print_fp(stdout, b2);
+        putchar('\n');
+        BN_print_fp(stdout, b3);
+        putchar('\n');
+        BN_print_fp(stdout, b4);
+        putchar('\n');
+        BN_print_fp(stdout, b5);
+        putchar('\n');
+    }
+
+ done:
+    OPENSSL_assert(success);
+
+    return 0;
+}

lib/openssl-1.1.0g/fuzz/bndiv.c

@@ -0,0 +1,107 @@
+/*
+ * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the OpenSSL licenses, (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * https://www.openssl.org/source/license.html
+ * or in the file LICENSE in the source distribution.
+ */
+
+/*
+ * Confirm that if (d, r) = a / b, then b * d + r == a, and that sign(d) ==
+ * sign(a), and 0 <= r <= b
+ */
+
+#include <stdio.h>
+#include <openssl/bn.h>
+#include "fuzzer.h"
+
+int FuzzerInitialize(int *argc, char ***argv) {
+    return 1;
+}
+
+int FuzzerTestOneInput(const uint8_t *buf, size_t len) {
+    static BN_CTX *ctx;
+    static BIGNUM *b1;
+    static BIGNUM *b2;
+    static BIGNUM *b3;
+    static BIGNUM *b4;
+    static BIGNUM *b5;
+    int success = 0;
+    size_t l1 = 0, l2 = 0;
+    /* s1 and s2 will be the signs for b1 and b2. */
+    int s1 = 0, s2 = 0;
+
+    if (ctx == NULL) {
+        b1 = BN_new();
+        b2 = BN_new();
+        b3 = BN_new();
+        b4 = BN_new();
+        b5 = BN_new();
+        ctx = BN_CTX_new();
+    }
+    /* We are going to split the buffer in two, sizes l1 and l2, giving b1 and
+     * b2.
+     */
+    if (len > 0) {
+        --len;
+        /* Use first byte to divide the remaining buffer into 3Fths. I admit
+         * this disallows some number sizes. If it matters, better ideas are
+         * welcome (Ben).
+         */
+        l1 = ((buf[0] & 0x3f) * len) / 0x3f;
+        s1 = buf[0] & 0x40;
+        s2 = buf[0] & 0x80;
+        ++buf;
+        l2 = len - l1;
+    }
+    OPENSSL_assert(BN_bin2bn(buf, l1, b1) == b1);
+    BN_set_negative(b1, s1);
+    OPENSSL_assert(BN_bin2bn(buf + l1, l2, b2) == b2);
+    BN_set_negative(b2, s2);
+
+    /* divide by 0 is an error */
+    if (BN_is_zero(b2)) {
+        success = 1;
+        goto done;
+    }
+
+    OPENSSL_assert(BN_div(b3, b4, b1, b2, ctx));
+    if (BN_is_zero(b1))
+        success = BN_is_zero(b3) && BN_is_zero(b4);
+    else if (BN_is_negative(b1))
+        success = (BN_is_negative(b3) != BN_is_negative(b2) || BN_is_zero(b3))
+            && (BN_is_negative(b4) || BN_is_zero(b4));
+    else
+        success = (BN_is_negative(b3) == BN_is_negative(b2)  || BN_is_zero(b3))
+            && (!BN_is_negative(b4) || BN_is_zero(b4));
+    OPENSSL_assert(BN_mul(b5, b3, b2, ctx));
+    OPENSSL_assert(BN_add(b5, b5, b4));
+
+    success = success && BN_cmp(b5, b1) == 0;
+    if (!success) {
+        BN_print_fp(stdout, b1);
+        putchar('\n');
+        BN_print_fp(stdout, b2);
+        putchar('\n');
+        BN_print_fp(stdout, b3);
+        putchar('\n');
+        BN_print_fp(stdout, b4);
+        putchar('\n');
+        BN_print_fp(stdout, b5);
+        putchar('\n');
+        printf("%d %d %d %d %d %d %d\n", BN_is_negative(b1),
+               BN_is_negative(b2),
+               BN_is_negative(b3), BN_is_negative(b4), BN_is_zero(b4),
+               BN_is_negative(b3) != BN_is_negative(b2)
+               && (BN_is_negative(b4) || BN_is_zero(b4)),
+               BN_cmp(b5, b1));
+        puts("----\n");
+    }
+
+ done:
+    OPENSSL_assert(success);
+
+    return 0;
+}

lib/openssl-1.1.0g/fuzz/build.info

@@ -0,0 +1,113 @@
+{- use File::Spec::Functions;
+   our $ex_inc = $withargs{fuzzer_include} &&
+       (file_name_is_absolute($withargs{fuzzer_include}) ?
+        $withargs{fuzzer_include} : catdir(updir(), $withargs{fuzzer_include}));
+   our $ex_lib = $withargs{fuzzer_lib} &&
+       (file_name_is_absolute($withargs{fuzzer_lib}) ?
+        $withargs{fuzzer_lib} : catfile(updir(), $withargs{fuzzer_lib}));
+   ""
+-}
+
+IF[{- !$disabled{"fuzz-afl"} || !$disabled{"fuzz-libfuzzer"} -}]
+  PROGRAMS_NO_INST=asn1 asn1parse bignum bndiv conf crl server x509
+
+  IF[{- !$disabled{"cms"} -}]
+    PROGRAMS_NO_INST=cms
+  ENDIF
+
+  IF[{- !$disabled{"ct"} -}]
+    PROGRAMS_NO_INST=ct
+  ENDIF
+
+  SOURCE[asn1]=asn1.c driver.c
+  INCLUDE[asn1]=../include {- $ex_inc -}
+  DEPEND[asn1]=../libcrypto {- $ex_lib -}
+
+  SOURCE[asn1parse]=asn1parse.c driver.c
+  INCLUDE[asn1parse]=../include {- $ex_inc -}
+  DEPEND[asn1parse]=../libcrypto {- $ex_lib -}
+
+  SOURCE[bignum]=bignum.c driver.c
+  INCLUDE[bignum]=../include {- $ex_inc -}
+  DEPEND[bignum]=../libcrypto {- $ex_lib -}
+
+  SOURCE[bndiv]=bndiv.c driver.c
+  INCLUDE[bndiv]=../include {- $ex_inc -}
+  DEPEND[bndiv]=../libcrypto {- $ex_lib -}
+
+  SOURCE[cms]=cms.c driver.c
+  INCLUDE[cms]=../include {- $ex_inc -}
+  DEPEND[cms]=../libcrypto {- $ex_lib -}
+
+  SOURCE[conf]=conf.c driver.c
+  INCLUDE[conf]=../include {- $ex_inc -}
+  DEPEND[conf]=../libcrypto {- $ex_lib -}
+
+  SOURCE[crl]=crl.c driver.c
+  INCLUDE[crl]=../include {- $ex_inc -}
+  DEPEND[crl]=../libcrypto {- $ex_lib -}
+
+  SOURCE[ct]=ct.c driver.c
+  INCLUDE[ct]=../include {- $ex_inc -}
+  DEPEND[ct]=../libcrypto {- $ex_lib -}
+
+  SOURCE[server]=server.c driver.c
+  INCLUDE[server]=../include {- $ex_inc -}
+  DEPEND[server]=../libcrypto ../libssl {- $ex_lib -}
+
+  SOURCE[x509]=x509.c driver.c
+  INCLUDE[x509]=../include {- $ex_inc -}
+  DEPEND[x509]=../libcrypto {- $ex_lib -}
+ENDIF
+
+IF[{- !$disabled{tests} -}]
+  PROGRAMS_NO_INST=asn1-test asn1parse-test bignum-test bndiv-test conf-test crl-test server-test x509-test
+
+  IF[{- !$disabled{"cms"} -}]
+    PROGRAMS_NO_INST=cms-test
+  ENDIF
+
+  IF[{- !$disabled{"ct"} -}]
+    PROGRAMS_NO_INST=ct-test
+  ENDIF
+
+  SOURCE[asn1-test]=asn1.c test-corpus.c
+  INCLUDE[asn1-test]=../include
+  DEPEND[asn1-test]=../libcrypto
+
+  SOURCE[asn1parse-test]=asn1parse.c test-corpus.c
+  INCLUDE[asn1parse-test]=../include
+  DEPEND[asn1parse-test]=../libcrypto
+
+  SOURCE[bignum-test]=bignum.c test-corpus.c
+  INCLUDE[bignum-test]=../include
+  DEPEND[bignum-test]=../libcrypto
+
+  SOURCE[bndiv-test]=bndiv.c test-corpus.c
+  INCLUDE[bndiv-test]=../include
+  DEPEND[bndiv-test]=../libcrypto
+
+  SOURCE[cms-test]=cms.c test-corpus.c
+  INCLUDE[cms-test]=../include
+  DEPEND[cms-test]=../libcrypto
+
+  SOURCE[conf-test]=conf.c test-corpus.c
+  INCLUDE[conf-test]=../include
+  DEPEND[conf-test]=../libcrypto
+
+  SOURCE[crl-test]=crl.c test-corpus.c
+  INCLUDE[crl-test]=../include
+  DEPEND[crl-test]=../libcrypto
+
+  SOURCE[ct-test]=ct.c test-corpus.c
+  INCLUDE[ct-test]=../include
+  DEPEND[ct-test]=../libcrypto
+
+  SOURCE[server-test]=server.c test-corpus.c
+  INCLUDE[server-test]=../include
+  DEPEND[server-test]=../libcrypto ../libssl
+
+  SOURCE[x509-test]=x509.c test-corpus.c
+  INCLUDE[x509-test]=../include
+  DEPEND[x509-test]=../libcrypto
+ENDIF

lib/openssl-1.1.0g/fuzz/cms.c

@@ -0,0 +1,36 @@
+/*
+ * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the OpenSSL licenses, (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * https://www.openssl.org/source/license.html
+ * or in the file LICENSE in the source distribution.
+ */
+
+/*
+ * Test CMS DER parsing.
+ */
+
+#include <openssl/bio.h>
+#include <openssl/cms.h>
+#include "fuzzer.h"
+
+int FuzzerInitialize(int *argc, char ***argv) {
+    return 1;
+}
+
+int FuzzerTestOneInput(const uint8_t *buf, size_t len) {
+    CMS_ContentInfo *i;
+    BIO *in;
+    if (!len) {
+        return 0;
+    }
+
+    in = BIO_new(BIO_s_mem());
+    OPENSSL_assert((size_t)BIO_write(in, buf, len) == len);
+    i = d2i_CMS_bio(in, NULL);
+    CMS_ContentInfo_free(i);
+    BIO_free(in);
+    return 0;
+}

lib/openssl-1.1.0g/fuzz/conf.c

@@ -0,0 +1,38 @@
+/*
+ * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the OpenSSL licenses, (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * https://www.openssl.org/source/license.html
+ * or in the file LICENSE in the source distribution.
+ */
+
+/*
+ * Test configuration parsing.
+ */
+
+#include <openssl/conf.h>
+#include "fuzzer.h"
+
+int FuzzerInitialize(int *argc, char ***argv) {
+    return 1;
+}
+
+int FuzzerTestOneInput(const uint8_t *buf, size_t len) {
+    CONF *conf;
+    BIO *in;
+    long eline;
+
+    if (len == 0)
+        return 0;
+
+    conf = NCONF_new(NULL);
+    in = BIO_new(BIO_s_mem());
+    OPENSSL_assert((size_t)BIO_write(in, buf, len) == len);
+    NCONF_load_bio(conf, in, &eline);
+    NCONF_free(conf);
+    BIO_free(in);
+
+    return 0;
+}

lib/openssl-1.1.0g/fuzz/corpora/asn1/0096661704ea09219fd9d4300a505c03184b4011

@@ -0,0 +1 @@
+�0�������������������������������������0������0��0

lib/openssl-1.1.0g/fuzz/corpora/asn1/0192d6d830049af32ed04078e8e8f2a32b2be067

@@ -0,0 +1 @@
+0��00000

lib/openssl-1.1.0g/fuzz/corpora/asn1/0270d4aa8aebf5e1d5e79e6e48b604abf9cb0329

@@ -0,0 +1 @@
+0�0

lib/openssl-1.1.0g/fuzz/corpora/asn1/040c72cb9a02a977192268757768020937cdce34

@@ -0,0 +1 @@
+00000000в00000000

lib/openssl-1.1.0g/fuzz/corpora/asn1/08ec21d7c0d4326c8e80f57d4b6bf7011ee58bd8

@@ -0,0 +1 @@
+0��

lib/openssl-1.1.0g/fuzz/corpora/asn1/0eb5037935ba1c2791f3b7e9bc8470c3c60d2aff

@@ -0,0 +1 @@
+0�

lib/openssl-1.1.0g/fuzz/corpora/asn1/1177f189a4437bb0ad8605b5404d2437a3935ea8

@@ -0,0 +1 @@
+0€�000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
מ00000000000000000000000000000000000000000000000000000000ת00�0000000000000000

lib/openssl-1.1.0g/fuzz/corpora/asn1/13b96ddb1244c7c7e3a6c00ab3cb02a4a442c4e3

@@ -0,0 +1 @@
+0�U	�0�0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000�00000000000000000000000000000000000000000000000000000

lib/openssl-1.1.0g/fuzz/corpora/asn1/1591b3792de7c151e7efb4fa33d3683ea1447fb2

@@ -0,0 +1 @@
+0�00
0000000000000�0000000000000000000000000�00000000000000000000000000000000000

lib/openssl-1.1.0g/fuzz/corpora/asn1/16643830cd1b0e08cc781e374290a94c856e1c62

@@ -0,0 +1,2 @@
+0€00000000€
+00000000000