ChainSafe / ChainSafe/gossamer
Fuzzing result for MultiaddrTryFrom target
- Dominant language
- Go
- Stars
- 454
- Forks
- 144
- PR merge metrics
- No merged PRs in 30d
Description
# Target
### ```Substrate```
```multiaddr = { version = "0.14.0" }```
```rust
fn try_from(v: Vec) -> Result {
// Check if the argument is a valid `Multiaddr` by reading its protocols.
let mut slice = &v[..];
while !slice.is_empty() {
let (_, s) = Protocol::from_bytes(slice)?;
slice = s
}
Ok(Multiaddr { bytes: Arc::new(v) })
}
```
### ```Smoldot```
```rust
fn try_from(bytes: Vec) -> Result {
// Check whether this is indeed a valid list of protocols.
if nom::combinator::all_consuming(nom::multi::fold_many0(
protocol::>,
|| (),
|(), _| (),
))(&bytes)
.is_err()
{
return Err(FromVecError {});
}
Ok(Multiaddr { bytes })
}
```
### ```Gossamer```
```"github.com/multiformats/go-multiaddr"```
```go
func NewMultiaddrBytes(b []byte) (a Multiaddr, err error) {
defer func() {
if e := recover(); e != nil {
log.Printf("Panic in NewMultiaddrBytes on input %q: %s", b, e)
err = fmt.Errorf("%v", e)
}
}()
if err := validateBytes(b); err != nil {
return nil, err
}
return &multiaddr{bytes: b}, nil
}
```
# ```MultiaddrTryFrom``` Reproducing Scripts
### ```Substrate```
```rust
pub fn substrate_multiaddr_try_from(file_name: &String) {
println!("[+] Substrate Result:");
let buf = read_bytes(file_name).unwrap();
let ret = multiaddr::Multiaddr::try_from(buf);
if let Err(_) = ret {
println!("[-] Multiaddr try_from result: {:?}", ret);
} else {
println!("[+] Multiaddr try_from result: {:?}", ret);
}
}
```
### ```Smoldot```
```rust
pub fn smoldot_multiaddr_try_from(file_name: &String) {
println!("[+] Smoldot Result:");
let buf = read_bytes(file_name).unwrap();
let ret = smoldot::libp2p::multiaddr::Multiaddr::try_from(buf);
if let Err(_) = ret {
println!("[-] Multiaddr try_from result: {:?}", ret);
} else {
println!("[+] Multiaddr try_from result: {:?}", ret);
}
}
```
### ```Gossamer```
```go
func glib_multiaddr_try_from(data_ptr unsafe.Pointer, data_size int) {
fmt.Println("[+] Gossamer Result:")
var data []byte
sh := (*reflect.SliceHeader)(unsafe.Pointer(&data))
sh.Data = uintptr(data_ptr)
sh.Len = data_size
sh.Cap = data_size
ret, err := ma.NewMultiaddrBytes(data)
if err != nil {
fmt.Println("[-] Multiaddr ma.NewMultiaddrBytes result:", err)
} else {
fmt.Println("[+] Multiaddr ma.NewMultiaddr result:", ret)
}
}
```
# Crash 1
The differential fuzzer catches a crash. The ```Substrate``` target gives an error message but The ```Smoldot``` and ```Gossamer``` targets execute the given data successfully.
### ```Reproducer``` crash report
```
./reproducer run all MultiaddrTryFrom /crash-bf171a65a9fc5a418fc961e3aac30666086a4736
[+] Smoldot Result:
[+] Multiaddr try_from result: Ok(/webrtc)
[+] Substrate Result:
[-] Multiaddr try_from result: Err(UnknownProtocolId(280))
[+] Gossamer Result:
[+] Multiaddr ma.NewMultiaddr result: /webrtc
```
### Artifacts 1
[multiaddrtryfrom_crash1.zip](https://github.com/ChainSafe/gossamer/files/10723992/multiaddrtryfrom_crash1.zip)
# Crash 2
The differential fuzzer catches a crash. The ```Substrate``` and ```Smoldot``` targets give an error message but The ```Gossamer``` target executes the given data successfully.
```
./reproducer run all MultiaddrTryFrom /4f52899da316eab3
[+] Smoldot Result:
[-] Multiaddr try_from result: Err(FromVecError)
[+] Substrate Result:
[-] Multiaddr try_from result: Err(UnknownProtocolId(43))
[+] Gossamer Result:
[+] Multiaddr ma.NewMultiaddr result: /ipcidr/43/ipcidr/43/ipcidr/43
```
### Artifacts 2
[multiaddrtryfrom_crash2.zip](https://github.com/ChainSafe/gossamer/files/10723993/multiaddrtryfrom_crash2.zip)
# Crash 3
The differential fuzzer catches a crash. The ```Smoldot``` and ```Gossamer``` targets give an error message but The ```Substrate``` target execute the given data successfully.
```
./reproducer run all MultiaddrTryFrom /b1b4305b999e7901
[+] Smoldot Result:
[-] Multiaddr try_from result: Err(FromVecError)
[+] Substrate Result:
[+] Multiaddr try_from result: Ok("/dnsaddr//=")
[+] Gossamer Result:
[-] Multiaddr ma.NewMultiaddrBytes result: domain name "/=" contains a slash
```
### Artifacts 3
[multiaddrtryfrom_crash3.zip](https://github.com/ChainSafe/gossamer/files/10723994/multiaddrtryfrom_crash3.zip)
Contributor guide
Assessment
This issue has not been assessed yet.