Harden Pairs de/serialization.

.bazelrc

@@ -8,37 +8,49 @@ build:clang --action_env=BAZEL_COMPILER=clang
 build:clang --action_env=CC=clang
 build:clang --action_env=CXX=clang++
 
+# Common flags for Clang sanitizers.
+build:clang-xsan --config=clang
+build:clang-xsan --copt -O1
+build:clang-xsan --copt -fno-omit-frame-pointer
+build:clang-xsan --copt -fno-optimize-sibling-calls
+build:clang-xsan --copt -fno-sanitize-recover=all
+build:clang-xsan --linkopt -fsanitize-link-c++-runtime
+build:clang-xsan --linkopt -fuse-ld=lld
+build:clang-xsan --linkopt -rtlib=compiler-rt
+build:clang-xsan --linkopt --unwindlib=libgcc
+
 # Use Clang compiler with Address and Undefined Behavior Sanitizers.
-build:clang-asan --config=clang
+build:clang-asan --config=clang-xsan
 build:clang-asan --copt -DADDRESS_SANITIZER=1
 build:clang-asan --copt -DUNDEFINED_SANITIZER=1
-build:clang-asan --copt -O1
-build:clang-asan --copt -fno-omit-frame-pointer
-build:clang-asan --copt -fno-optimize-sibling-calls
 build:clang-asan --copt -fsanitize=address,undefined
 build:clang-asan --copt -fsanitize-address-use-after-scope
 build:clang-asan --linkopt -fsanitize=address,undefined
 build:clang-asan --linkopt -fsanitize-address-use-after-scope
-build:clang-asan --linkopt -fsanitize-link-c++-runtime
-build:clang-asan --linkopt -fuse-ld=lld
 build:clang-asan --test_env=ASAN_OPTIONS=check_initialization_order=1:detect_stack_use_after_return=1:strict_init_order=1:strict_string_checks=1
-build:clang-asan --test_env=UBSAN_OPTIONS=halt_on_error=1:print_stacktrace=1
+build:clang-asan --test_env=UBSAN_OPTIONS=print_stacktrace=1
 build:clang-asan --test_env=ASAN_SYMBOLIZER_PATH
 
 # Use Clang compiler with Address and Undefined Behavior Sanitizers (strict version).
 build:clang-asan-strict --config=clang-asan
-build:clang-asan-strict --copt -fsanitize=integer
-build:clang-asan-strict --linkopt -fsanitize=integer
+build:clang-asan-strict --copt -fsanitize=integer,local-bounds,nullability
+build:clang-asan-strict --linkopt -fsanitize=integer,local-bounds,nullability
+
+# Use Honggfuzz with Address and Undefined Behavior Sanitizers (strict version).
+build:clang-asan-honggfuzz --config=clang-asan-strict
+build:clang-asan-honggfuzz --@rules_fuzzing//fuzzing:cc_engine=@rules_fuzzing//fuzzing/engines:honggfuzz
+build:clang-asan-honggfuzz --@rules_fuzzing//fuzzing:cc_engine_instrumentation=honggfuzz
+
+# Use LibFuzzer with Address and Undefined Behavior Sanitizers (strict version).
+build:clang-asan-libfuzzer --config=clang-asan-strict
+build:clang-asan-libfuzzer --@rules_fuzzing//fuzzing:cc_engine=@rules_fuzzing//fuzzing/engines:libfuzzer
+build:clang-asan-libfuzzer --@rules_fuzzing//fuzzing:cc_engine_instrumentation=libfuzzer
 
 # Use Clang compiler with Thread Sanitizer.
-build:clang-tsan --config=clang
+build:clang-tsan --config=clang-xsan
 build:clang-tsan --copt -DTHREAD_SANITIZER=1
-build:clang-tsan --copt -O1
-build:clang-tsan --copt -fno-omit-frame-pointer
-build:clang-tsan --copt -fno-optimize-sibling-calls
 build:clang-tsan --copt -fsanitize=thread
 build:clang-tsan --linkopt -fsanitize=thread
-build:clang-tsan --linkopt -fuse-ld=lld
 
 # Use Clang-Tidy tool.
 build:clang-tidy --aspects @bazel_clang_tidy//clang_tidy:clang_tidy.bzl%clang_tidy_aspect

.github/workflows/test.yml

@@ -125,6 +125,7 @@ jobs:
           os: windows-2019
           arch: x86_64
           action: test
+          targets: -//test/fuzz/...
         - name: 'V8 on Linux/x86_64'
           engine: 'v8'
           repo: 'v8'
@@ -228,6 +229,7 @@ jobs:
           os: windows-2019
           arch: x86_64
           action: test
+          targets: -//test/fuzz/...
         - name: 'WAVM on Linux/x86_64'
           engine: 'wavm'
           repo: 'com_github_wavm_wavm'
@@ -287,7 +289,7 @@ jobs:
         --test_output=errors
         --define engine=${{ matrix.engine }}
         ${{ matrix.flags }}
-        //test/...
+        -- //test/... ${{ matrix.targets }}
 
     - name: Bazel build/test (signed Wasm module)
       if: ${{ matrix.engine != 'null' && !startsWith(matrix.os, 'windows') }}

BUILD

@@ -52,6 +52,7 @@ cc_library(
         "src/bytecode_util.cc",
         "src/context.cc",
         "src/exports.cc",
+        "src/pairs_util.cc",
         "src/shared_data.cc",
         "src/shared_data.h",
         "src/shared_queue.cc",
@@ -62,6 +63,7 @@ cc_library(
     ],
     hdrs = [
         "include/proxy-wasm/bytecode_util.h",
+        "include/proxy-wasm/pairs_util.h",
         "include/proxy-wasm/signature_util.h",
     ],
     linkopts = select({

bazel/dependencies.bzl

@@ -17,6 +17,8 @@ load("@com_google_protobuf//:protobuf_deps.bzl", "protobuf_deps")
 load("@proxy_wasm_cpp_host//bazel/cargo/wasmsign:crates.bzl", "wasmsign_fetch_remote_crates")
 load("@proxy_wasm_cpp_host//bazel/cargo/wasmtime:crates.bzl", "wasmtime_fetch_remote_crates")
 load("@rules_foreign_cc//foreign_cc:repositories.bzl", "rules_foreign_cc_dependencies")
+load("@rules_fuzzing//fuzzing:init.bzl", "rules_fuzzing_init")
+load("@rules_fuzzing//fuzzing:repositories.bzl", "rules_fuzzing_dependencies")
 load("@rules_python//python:pip.bzl", "pip_install")
 load("@rules_rust//rust:repositories.bzl", "rust_repositories", "rust_repository_set")
 
@@ -25,6 +27,9 @@ def proxy_wasm_cpp_host_dependencies():
 
     rules_foreign_cc_dependencies()
 
+    rules_fuzzing_dependencies()
+    rules_fuzzing_init()
+
     rust_repositories()
     rust_repository_set(
         name = "rust_linux_x86_64",

bazel/repositories.bzl

@@ -55,6 +55,14 @@ def proxy_wasm_cpp_host_repositories():
         url = "https://github.com/bazelbuild/rules_foreign_cc/archive/0.7.1.tar.gz",
     )
 
+    maybe(
+        http_archive,
+        name = "rules_fuzzing",
+        sha256 = "23bb074064c6f488d12044934ab1b0631e8e6898d5cf2f6bde087adb01111573",
+        strip_prefix = "rules_fuzzing-0.3.1",
+        url = "https://github.com/bazelbuild/rules_fuzzing/archive/v0.3.1.zip",
+    )
+
     maybe(
         http_archive,
         name = "rules_python",

include/proxy-wasm/exports.h

@@ -62,36 +62,6 @@ struct RegisterForeignFunction {
 
 namespace exports {
 
-template <typename Pairs> size_t pairsSize(const Pairs &result) {
-  size_t size = 4; // number of headers
-  for (auto &p : result) {
-    size += 8;                   // size of key, size of value
-    size += p.first.size() + 1;  // null terminated key
-    size += p.second.size() + 1; // null terminated value
-  }
-  return size;
-}
-
-template <typename Pairs> void marshalPairs(const Pairs &result, char *buffer) {
-  char *b = buffer;
-  *reinterpret_cast<uint32_t *>(b) = htowasm(result.size());
-  b += sizeof(uint32_t);
-  for (auto &p : result) {
-    *reinterpret_cast<uint32_t *>(b) = htowasm(p.first.size());
-    b += sizeof(uint32_t);
-    *reinterpret_cast<uint32_t *>(b) = htowasm(p.second.size());
-    b += sizeof(uint32_t);
-  }
-  for (auto &p : result) {
-    memcpy(b, p.first.data(), p.first.size());
-    b += p.first.size();
-    *b++ = 0;
-    memcpy(b, p.second.data(), p.second.size());
-    b += p.second.size();
-    *b++ = 0;
-  }
-}
-
 // ABI functions exported from host to wasm.
 
 Word get_configuration(Word value_ptr_ptr, Word value_size_ptr);

include/proxy-wasm/limits.h

@@ -30,3 +30,13 @@
 #ifndef PROXY_WASM_HOST_WASI_RANDOM_GET_MAX_SIZE_BYTES
 #define PROXY_WASM_HOST_WASI_RANDOM_GET_MAX_SIZE_BYTES (64 * 1024)
 #endif
+
+// Maximum allowed size of Pairs buffer to deserialize.
+#ifndef PROXY_WASM_HOST_PAIRS_MAX_BYTES
+#define PROXY_WASM_HOST_PAIRS_MAX_BYTES (1024 * 1024)
+#endif
+
+// Maximum allowed number of pairs in a Pairs buffer to deserialize.
+#ifndef PROXY_WASM_HOST_PAIRS_MAX_COUNT
+#define PROXY_WASM_HOST_PAIRS_MAX_COUNT 1024
+#endif

include/proxy-wasm/pairs_util.h

@@ -0,0 +1,63 @@
+// Copyright 2016-2019 Envoy Project Authors
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#pragma once
+
+#include <string>
+#include <string_view>
+#include <vector>
+
+namespace proxy_wasm {
+
+using Pairs = std::vector<std::pair<std::string_view, std::string_view>>;
+using StringPairs = std::vector<std::pair<std::string, std::string>>;
+
+class PairsUtil {
+public:
+  /**
+   * pairsSize returns the buffer size required to serialize Pairs.
+   * @param pairs Pairs to serialize.
+   * @return size of the output buffer.
+   */
+  static size_t pairsSize(const Pairs &pairs);
+
+  static size_t pairsSize(const StringPairs &stringpairs) {
+    Pairs views(stringpairs.begin(), stringpairs.end());
+    return pairsSize(views);
+  }
+
+  /**
+   * marshalPairs serializes Pairs to output buffer.
+   * @param pairs Pairs to serialize.
+   * @param buffer output buffer.
+   * @param size size of the output buffer.
+   * @return indicates whether serialization succeeded or not.
+   */
+  static bool marshalPairs(const Pairs &pairs, char *buffer, size_t size);
+
+  static bool marshalPairs(const StringPairs &stringpairs, char *buffer, size_t size) {
+    Pairs views(stringpairs.begin(), stringpairs.end());
+    return marshalPairs(views, buffer, size);
+  }
+
+  /**
+   * toPairs deserializes input buffer to Pairs.
+   * @param buffer serialized input buffer.
+   * @return deserialized Pairs.
+   */
+  static Pairs toPairs(std::string_view buffer);
+};
+
+} // namespace proxy_wasm

src/exports.cc

@@ -14,6 +14,7 @@
 // limitations under the License.
 //
 #include "include/proxy-wasm/limits.h"
+#include "include/proxy-wasm/pairs_util.h"
 #include "include/proxy-wasm/wasm.h"
 
 #include <openssl/rand.h>
@@ -58,55 +59,6 @@ RegisterForeignFunction::RegisterForeignFunction(const std::string &name, WasmFo
 
 namespace exports {
 
-namespace {
-
-Pairs toPairs(std::string_view buffer) {
-  Pairs result;
-  const char *b = buffer.data();
-  if (buffer.size() < sizeof(uint32_t)) {
-    return {};
-  }
-  auto size = wasmtoh(*reinterpret_cast<const uint32_t *>(b));
-  b += sizeof(uint32_t);
-  if (sizeof(uint32_t) + size * 2 * sizeof(uint32_t) > buffer.size()) {
-    return {};
-  }
-  result.resize(size);
-  for (uint32_t i = 0; i < size; i++) {
-    result[i].first = std::string_view(nullptr, wasmtoh(*reinterpret_cast<const uint32_t *>(b)));
-    b += sizeof(uint32_t);
-    result[i].second = std::string_view(nullptr, wasmtoh(*reinterpret_cast<const uint32_t *>(b)));
-    b += sizeof(uint32_t);
-  }
-  for (auto &p : result) {
-    p.first = std::string_view(b, p.first.size());
-    b += p.first.size() + 1;
-    p.second = std::string_view(b, p.second.size());
-    b += p.second.size() + 1;
-  }
-  return result;
-}
-
-template <typename Pairs>
-bool getPairs(ContextBase *context, const Pairs &result, uint64_t ptr_ptr, uint64_t size_ptr) {
-  if (result.empty()) {
-    return context->wasm()->copyToPointerSize("", ptr_ptr, size_ptr);
-  }
-  uint64_t size = pairsSize(result);
-  uint64_t ptr = 0;
-  char *buffer = static_cast<char *>(context->wasm()->allocMemory(size, &ptr));
-  marshalPairs(result, buffer);
-  if (!context->wasmVm()->setWord(ptr_ptr, Word(ptr))) {
-    return false;
-  }
-  if (!context->wasmVm()->setWord(size_ptr, Word(size))) {
-    return false;
-  }
-  return true;
-}
-
-} // namespace
-
 // General ABI.
 
 Word set_property(Word key_ptr, Word key_size, Word value_ptr, Word value_size) {
@@ -200,7 +152,7 @@ Word send_local_response(Word response_code, Word response_code_details_ptr,
   if (!details || !body || !additional_response_header_pairs) {
     return WasmResult::InvalidMemoryAccess;
   }
-  auto additional_headers = toPairs(additional_response_header_pairs.value());
+  auto additional_headers = PairsUtil::toPairs(additional_response_header_pairs.value());
   context->sendLocalResponse(response_code, body.value(), std::move(additional_headers),
                              grpc_status, details.value());
   context->wasm()->stopNextIteration(true);
@@ -435,7 +387,25 @@ Word get_header_map_pairs(Word type, Word ptr_ptr, Word size_ptr) {
   if (result != WasmResult::Ok) {
     return result;
   }
-  if (!getPairs(context, pairs, ptr_ptr, size_ptr)) {
+  if (pairs.empty()) {
+    if (!context->wasm()->copyToPointerSize("", ptr_ptr, size_ptr)) {
+      return WasmResult::InvalidMemoryAccess;
+    }
+    return WasmResult::Ok;
+  }
+  uint64_t size = PairsUtil::pairsSize(pairs);
+  uint64_t ptr = 0;
+  char *buffer = static_cast<char *>(context->wasm()->allocMemory(size, &ptr));
+  if (buffer == nullptr) {
+    return WasmResult::InvalidMemoryAccess;
+  }
+  if (!PairsUtil::marshalPairs(pairs, buffer, size)) {
+    return WasmResult::InvalidMemoryAccess;
+  }
+  if (!context->wasmVm()->setWord(ptr_ptr, Word(ptr))) {
+    return WasmResult::InvalidMemoryAccess;
+  }
+  if (!context->wasmVm()->setWord(size_ptr, Word(size))) {
     return WasmResult::InvalidMemoryAccess;
   }
   return WasmResult::Ok;
@@ -451,7 +421,7 @@ Word set_header_map_pairs(Word type, Word ptr, Word size) {
     return WasmResult::InvalidMemoryAccess;
   }
   return context->setHeaderMapPairs(static_cast<WasmHeaderMapType>(type.u64_),
-                                    toPairs(data.value()));
+                                    PairsUtil::toPairs(data.value()));
 }
 
 Word get_header_map_size(Word type, Word result_ptr) {
@@ -541,8 +511,8 @@ Word http_call(Word uri_ptr, Word uri_size, Word header_pairs_ptr, Word header_p
   if (!uri || !body || !header_pairs || !trailer_pairs) {
     return WasmResult::InvalidMemoryAccess;
   }
-  auto headers = toPairs(header_pairs.value());
-  auto trailers = toPairs(trailer_pairs.value());
+  auto headers = PairsUtil::toPairs(header_pairs.value());
+  auto trailers = PairsUtil::toPairs(trailer_pairs.value());
   uint32_t token = 0;
   // NB: try to write the token to verify the memory before starting the async
   // operation.
@@ -611,7 +581,7 @@ Word grpc_call(Word service_ptr, Word service_size, Word service_name_ptr, Word
     return WasmResult::InvalidMemoryAccess;
   }
   uint32_t token = 0;
-  auto initial_metadata = toPairs(initial_metadata_pairs.value());
+  auto initial_metadata = PairsUtil::toPairs(initial_metadata_pairs.value());
   auto result = context->grpcCall(service.value(), service_name.value(), method_name.value(),
                                   initial_metadata, request.value(),
                                   std::chrono::milliseconds(timeout_milliseconds), &token);
@@ -637,7 +607,7 @@ Word grpc_stream(Word service_ptr, Word service_size, Word service_name_ptr, Wor
     return WasmResult::InvalidMemoryAccess;
   }
   uint32_t token = 0;
-  auto initial_metadata = toPairs(initial_metadata_pairs.value());
+  auto initial_metadata = PairsUtil::toPairs(initial_metadata_pairs.value());
   auto result = context->grpcStream(service.value(), service_name.value(), method_name.value(),
                                     initial_metadata, &token);
   if (result != WasmResult::Ok) {