TestFuzzChannelRdpgfx.c

 
#include <stddef.h>
#include <stdint.h>
 
#include <winpr/crt.h>
#include <winpr/stream.h>
#include <winpr/wlog.h>
 
#include <freerdp/addin.h>
#include <freerdp/client.h>
#include <freerdp/client/channels.h>
#include <freerdp/channels/rdpgfx.h>
#include <freerdp/codec/zgfx.h>
#include <freerdp/dvc.h>
 
#define FUZZ_MAX_RECORDS 64
 
typedef struct
{
  IDRDYNVC_ENTRY_POINTS iface;
  rdpContext* context;
  IWTSPlugin* plugin;
} fuzz_entry_points;
 
typedef struct
{
  IWTSVirtualChannelManager iface;
  IWTSListener listener;
  IWTSListenerCallback* listenerCallback;
} fuzz_channel_manager;
 
static UINT fuzz_register_plugin(IDRDYNVC_ENTRY_POINTS* pEntryPoints,
                                 WINPR_ATTR_UNUSED const char* name, IWTSPlugin* pPlugin)
{
  fuzz_entry_points* ep = (fuzz_entry_points*)pEntryPoints;
  if (ep->plugin)
    return CHANNEL_RC_ALREADY_INITIALIZED;
  ep->plugin = pPlugin;
  return CHANNEL_RC_OK;
}
 
static IWTSPlugin* fuzz_get_plugin(WINPR_ATTR_UNUSED IDRDYNVC_ENTRY_POINTS* pEntryPoints,
                                   WINPR_ATTR_UNUSED const char* name)
{
  return nullptr;
}
 
static const ADDIN_ARGV* fuzz_get_plugin_data(WINPR_ATTR_UNUSED IDRDYNVC_ENTRY_POINTS* pEntryPoints)
{
  return nullptr;
}
 
static rdpSettings* fuzz_get_rdp_settings(IDRDYNVC_ENTRY_POINTS* pEntryPoints)
{
  return ((fuzz_entry_points*)pEntryPoints)->context->settings;
}
 
static rdpContext* fuzz_get_rdp_context(IDRDYNVC_ENTRY_POINTS* pEntryPoints)
{
  return ((fuzz_entry_points*)pEntryPoints)->context;
}
 
static UINT fuzz_create_listener(IWTSVirtualChannelManager* pChannelMgr,
                                 WINPR_ATTR_UNUSED const char* pszChannelName,
                                 WINPR_ATTR_UNUSED ULONG ulFlags,
                                 IWTSListenerCallback* pListenerCallback, IWTSListener** ppListener)
{
  fuzz_channel_manager* mgr = (fuzz_channel_manager*)pChannelMgr;
  mgr->listenerCallback = pListenerCallback;
  if (ppListener)
    *ppListener = &mgr->listener;
  return CHANNEL_RC_OK;
}
 
static UINT fuzz_destroy_listener(IWTSVirtualChannelManager* pChannelMgr,
                                  WINPR_ATTR_UNUSED IWTSListener* pListener)
{
  ((fuzz_channel_manager*)pChannelMgr)->listenerCallback = nullptr;
  return CHANNEL_RC_OK;
}
 
static UINT32 fuzz_get_channel_id(WINPR_ATTR_UNUSED IWTSVirtualChannel* channel)
{
  return 1;
}
 
static const char* fuzz_get_channel_name(WINPR_ATTR_UNUSED IWTSVirtualChannel* channel)
{
  return RDPGFX_DVC_CHANNEL_NAME;
}
 
static IWTSVirtualChannel* fuzz_find_channel_by_id(WINPR_ATTR_UNUSED IWTSVirtualChannelManager* mgr,
                                                   WINPR_ATTR_UNUSED UINT32 ChannelId)
{
  return nullptr;
}
 
static UINT fuzz_channel_write(WINPR_ATTR_UNUSED IWTSVirtualChannel* pChannel,
                               WINPR_ATTR_UNUSED ULONG cbSize,
                               WINPR_ATTR_UNUSED const BYTE* pBuffer,
                               WINPR_ATTR_UNUSED void* pReserved)
{
  return CHANNEL_RC_OK;
}
 
static UINT fuzz_channel_close(WINPR_ATTR_UNUSED IWTSVirtualChannel* pChannel)
{
  return CHANNEL_RC_OK;
}
 
static void fuzz_feed(IWTSVirtualChannelCallback* callback, const uint8_t* data, size_t size)
{
  wStream buffer = WINPR_C_ARRAY_INIT;
  wStream* s = Stream_StaticConstInit(&buffer, data, size);
 
  if (Stream_GetRemainingLength(s) < 1)
    return;
  const BOOL raw = (Stream_Get_UINT8(s) & 0x01) != 0;
 
  wStream* pdu = Stream_New(nullptr, UINT16_MAX + 2);
  if (!pdu)
    return;
 
  for (size_t index = 0; index < FUZZ_MAX_RECORDS; index++)
  {
    if (Stream_GetRemainingLength(s) < 2)
      break;
 
    size_t length = Stream_Get_UINT16(s);
    if (length > Stream_GetRemainingLength(s))
      length = Stream_GetRemainingLength(s);
 
    Stream_ResetPosition(pdu);
    if (!raw)
    {
      Stream_Write_UINT8(pdu, ZGFX_SEGMENTED_SINGLE);
      Stream_Write_UINT8(pdu, ZGFX_PACKET_COMPR_TYPE_RDP8);
    }
    Stream_Copy(s, pdu, length);
    Stream_SealLength(pdu);
    Stream_ResetPosition(pdu);
 
    if (callback->OnDataReceived(callback, pdu) != CHANNEL_RC_OK)
      break;
  }
 
  Stream_Free(pdu, TRUE);
}
 
int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
{
  if (size > (1u << 20))
    return 0;
 
  wLog* root = WLog_GetRoot();
  (void)WLog_SetLogLevel(root, WLOG_TRACE);
  (void)WLog_SetLogAppenderType(root, WLOG_APPENDER_CALLBACK);
 
  RDP_CLIENT_ENTRY_POINTS entry = WINPR_C_ARRAY_INIT;
  entry.Version = RDP_CLIENT_INTERFACE_VERSION;
  entry.Size = sizeof(RDP_CLIENT_ENTRY_POINTS_V1);
  entry.ContextSize = sizeof(rdpContext);
 
  rdpContext* context = freerdp_client_context_new(&entry);
  if (!context)
    return 0;
 
  PDVC_PLUGIN_ENTRY pluginEntry = WINPR_FUNC_PTR_CAST(
      freerdp_channels_load_static_addin_entry(RDPGFX_CHANNEL_NAME, nullptr, nullptr,
                                               FREERDP_ADDIN_CHANNEL_DYNAMIC),
      PDVC_PLUGIN_ENTRY);
 
  fuzz_entry_points ep = WINPR_C_ARRAY_INIT;
  ep.iface.RegisterPlugin = fuzz_register_plugin;
  ep.iface.GetPlugin = fuzz_get_plugin;
  ep.iface.GetPluginData = fuzz_get_plugin_data;
  ep.iface.GetRdpSettings = fuzz_get_rdp_settings;
  ep.iface.GetRdpContext = fuzz_get_rdp_context;
  ep.context = context;
 
  if (!pluginEntry || (pluginEntry(&ep.iface) != CHANNEL_RC_OK) || !ep.plugin)
    goto fail;
 
  {
    IWTSPlugin* plugin = ep.plugin;
 
    fuzz_channel_manager mgr = WINPR_C_ARRAY_INIT;
    mgr.iface.CreateListener = fuzz_create_listener;
    mgr.iface.DestroyListener = fuzz_destroy_listener;
    mgr.iface.GetChannelId = fuzz_get_channel_id;
    mgr.iface.GetChannelName = fuzz_get_channel_name;
    mgr.iface.FindChannelById = fuzz_find_channel_by_id;
 
    IWTSVirtualChannel channel = WINPR_C_ARRAY_INIT;
    channel.Write = fuzz_channel_write;
    channel.Close = fuzz_channel_close;
 
    if ((plugin->Initialize(plugin, &mgr.iface) == CHANNEL_RC_OK) && mgr.listenerCallback)
    {
      BOOL accept = TRUE;
      IWTSVirtualChannelCallback* callback = nullptr;
 
      if ((mgr.listenerCallback->OnNewChannelConnection(mgr.listenerCallback, &channel,
                                                        nullptr, &accept,
                                                        &callback) == CHANNEL_RC_OK) &&
          callback)
      {
        if (callback->OnOpen(callback) == CHANNEL_RC_OK)
          fuzz_feed(callback, data, size);
        /* frees the channel callback */
        (void)callback->OnClose(callback);
      }
    }
 
    /* frees the plugin */
    (void)plugin->Terminated(plugin);
  }
 
fail:
  freerdp_client_context_free(context);
  return 0;
}