Fix oss-fuzz issue 71399: invalid param value

rnpgp · Nov 2, 2024 · c349fe4 · c349fe4
1 parent 1b86b43
commit c349fe4
Show file tree

Hide file tree

Showing 4 changed files with 10 additions and 2 deletions.
diff --git a/src/lib/crypto/sphincsplus.cpp b/src/lib/crypto/sphincsplus.cpp
@@ -302,7 +302,7 @@ sphincsplus_pubkey_size(sphincsplus_parameter_t param)
         return 64;
     default:
         RNP_LOG("invalid SLH-DSA parameter identifier");
-        throw rnp::rnp_exception(RNP_ERROR_BAD_PARAMETERS);
+        return 0;
     }
 }
 

diff --git a/src/lib/key_material.cpp b/src/lib/key_material.cpp
@@ -1823,7 +1823,12 @@ SlhdsaKeyMaterial::parse(pgp_packet_body_t &pkt) noexcept
         return false;
     }
     sphincsplus_parameter_t param = (sphincsplus_parameter_t) bt;
-    std::vector<uint8_t>    buf(sphincsplus_pubkey_size(param));
+    auto                    size = sphincsplus_pubkey_size(param);
+    if (!size) {
+        RNP_LOG("invalid SLH-DSA param");
+        return false;
+    }
+    std::vector<uint8_t> buf(size);
     if (!pkt.get(buf.data(), buf.size())) {
         RNP_LOG("failed to parse SLH-DSA public key data");
         return false;

diff --git a/src/tests/data/test_fuzz_dump/abrt-5093675862917120 b/src/tests/data/test_fuzz_dump/abrt-5093675862917120
diff --git a/src/tests/fuzz_dump.cpp b/src/tests/fuzz_dump.cpp
@@ -58,4 +58,7 @@ TEST_F(rnp_tests, test_fuzz_dump)
 
     data = file_to_vec(DATA_PATH "outofmemory-6111789935624192");
     assert_int_equal(dump_LLVMFuzzerTestOneInput(data.data(), data.size()), 0);
+
+    data = file_to_vec(DATA_PATH "abrt-5093675862917120");
+    assert_int_equal(dump_LLVMFuzzerTestOneInput(data.data(), data.size()), 0);
 }