From 026aaeb2b5393e0c838873306e1c5f2084a8a1aa Mon Sep 17 00:00:00 2001 From: Dmitry Vyukov Date: Sun, 5 Jan 2020 11:46:35 +0100 Subject: prog: don't mutate strings with enumerated values Strings with enumerated values are frequently file names or have complete enumeration of relevant values. Mutating complete enumeration if not very profitable. Mutating file names leads to escaping paths and fuzzer messing with things it is not supposed to mess with as in: r0 = openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000440)='/proc/self//exe\x00', 0x3, 0x0) --- prog/encoding.go | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) (limited to 'prog/encoding.go') diff --git a/prog/encoding.go b/prog/encoding.go index 943dfe350..f288dbc93 100644 --- a/prog/encoding.go +++ b/prog/encoding.go @@ -506,10 +506,11 @@ func (p *parser) parseArgAddr(typ Type) (Arg, error) { return arg, nil } -func (p *parser) parseArgString(typ Type) (Arg, error) { - if _, ok := typ.(*BufferType); !ok { +func (p *parser) parseArgString(t Type) (Arg, error) { + typ, ok := t.(*BufferType) + if !ok { p.eatExcessive(true, "wrong string arg") - return typ.DefaultArg(), nil + return t.DefaultArg(), nil } data, err := p.deserializeData() if err != nil { @@ -541,6 +542,19 @@ func (p *parser) parseArgString(typ Type) (Arg, error) { data = append(data, make([]byte, diff)...) } data = data[:size] + if typ.Kind == BufferString && len(typ.Values) != 0 { + matched := false + for _, val := range typ.Values { + if string(data) == val { + matched = true + break + } + } + if !matched { + p.strictFailf("bad string value %q, expect %q", data, typ.Values) + data = []byte(typ.Values[0]) + } + } return MakeDataArg(typ, data), nil } -- cgit mrf-deployment