Added a fuzzer for SMIME

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20332)

3 files changed, 150 insertions, 2 deletions

diff --git a/fuzz/build.info b/fuzz/build.info
index 7ba41a7a6e..91d8143207 100644
--- a/fuzz/build.info
+++ b/fuzz/build.info
@@ -9,7 +9,7 @@
 -}
 
 IF[{- !$disabled{"fuzz-afl"} || !$disabled{"fuzz-libfuzzer"} -}]
-  PROGRAMS{noinst}=asn1 asn1parse bignum bndiv client conf crl server x509
+  PROGRAMS{noinst}=asn1 asn1parse bignum bndiv client conf crl server smime x509
   PROGRAMS{noinst}=punycode
 
   IF[{- !$disabled{"cmp"} -}]
@@ -68,6 +68,10 @@ IF[{- !$disabled{"fuzz-afl"} || !$disabled{"fuzz-libfuzzer"} -}]
   INCLUDE[punycode]=../include {- $ex_inc -}
   DEPEND[punycode]=../libcrypto.a {- $ex_lib -}
 
+  SOURCE[smime]=smime.c driver.c
+  INCLUDE[smime]=../include {- $ex_inc -}
+  DEPEND[smime]=../libcrypto ../libssl {- $ex_lib -}
+
   SOURCE[server]=server.c driver.c fuzz_rand.c
   INCLUDE[server]=../include {- $ex_inc -}
   DEPEND[server]=../libcrypto ../libssl {- $ex_lib -}
@@ -78,7 +82,7 @@ IF[{- !$disabled{"fuzz-afl"} || !$disabled{"fuzz-libfuzzer"} -}]
 ENDIF
 
 IF[{- !$disabled{tests} -}]
-  PROGRAMS{noinst}=asn1-test asn1parse-test bignum-test bndiv-test client-test conf-test crl-test server-test x509-test
+  PROGRAMS{noinst}=asn1-test asn1parse-test bignum-test bndiv-test client-test conf-test crl-test server-test smime-test x509-test
   PROGRAMS{noinst}=punycode-test
 
   IF[{- !$disabled{"cmp"} -}]
@@ -138,6 +142,10 @@ IF[{- !$disabled{tests} -}]
   INCLUDE[punycode-test]=../include
   DEPEND[punycode-test]=../libcrypto.a
 
+  SOURCE[smime-test]=smime.c test-corpus.c
+  INCLUDE[smime-test]=../include
+  DEPEND[smime-test]=../libcrypto ../libssl
+
   SOURCE[server-test]=server.c test-corpus.c fuzz_rand.c
   INCLUDE[server-test]=../include
   DEPEND[server-test]=../libcrypto ../libssl
diff --git a/fuzz/corpora/smime/b6cf925eec43acc9cc43c3104f17ac16d71439d0 b/fuzz/corpora/smime/b6cf925eec43acc9cc43c3104f17ac16d71439d0
new file mode 100644
index 0000000000..92bb948544
--- /dev/null
+++ b/fuzz/corpora/smime/b6cf925eec43acc9cc43c3104f17ac16d71439d0
@@ -0,0 +1,91 @@
+To: recipient@testcertificates.gov
+From: sender@testcertificates.gov
+Subject: Valid UTF8String Encoded Names Test9
+MIME-Version: 1.0
+Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha-256"; boundary="----BF0F19981A03F3AEBB1B40CD96D61B65"
+
+This is an S/MIME signed message
+
+------BF0F19981A03F3AEBB1B40CD96D61B65
+Content-Type: text/plain

+

+This is a sample signed message.

+
+------BF0F19981A03F3AEBB1B40CD96D61B65
+Content-Type: application/pkcs7-signature; name="smime.p7s"
+Content-Transfer-Encoding: base64
+Content-Disposition: attachment; filename="smime.p7s"
+
+MIIM7gYJKoZIhvcNAQcCoIIM3zCCDNsCAQExDzANBglghkgBZQMEAgEFADALBgkq
+hkiG9w0BBwGgggciMIIDgjCCAmqgAwIBAgIBYjANBgkqhkiG9w0BAQsFADBFMQsw
+CQYDVQQGEwJVUzEfMB0GA1UEChMWVGVzdCBDZXJ0aWZpY2F0ZXMgMjAxMTEVMBMG
+A1UEAxMMVHJ1c3QgQW5jaG9yMB4XDTEwMDEwMTA4MzAwMFoXDTMwMTIzMTA4MzAw
+MFowRjELMAkGA1UEBhMCVVMxHzAdBgNVBAoMFlRlc3QgQ2VydGlmaWNhdGVzIDIw
+MTExFjAUBgNVBAMMDVVURjhTdHJpbmcgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQDpFMdocNgWHWbH/yYbXj7cmkTMmrDj9bXTRwJQZM2I/fcTefta
+90CFELGbDX2RdtAnjlSJqkydCKjhhkKXfMQFXJDlM6MQLf4rcQoxEP8UI2Kmnbkf
+EjfsyGBxnSEFWe0wZZ8z5eWrLyIFZYk4x2Zyc5da7szsOnu63qN15kAJRf5qLTQy
+BVbvG6pJrOQaDF9ISrgA1Sj7UW2puqZ40fbX20zywWxMEIeX3QO1Ho4onJXwi81/
+LMjZ3CvWqtEuGXo+D5YJHhMBx2Ok777u34ahScf3f6h5YBixNf69RCCIR41Hki/a
+J8Uwir0Ylx9mdT0XfE42LskS6v/MsFLGUpCtAgMBAAGjfDB6MB8GA1UdIwQYMBaA
+FOR9X9FclYYILAWuvnW2ZafZXahmMB0GA1UdDgQWBBQ7Z1tE8g2nSH1zKYyTn9Uk
+4xJgJjAOBgNVHQ8BAf8EBAMCAQYwFwYDVR0gBBAwDjAMBgpghkgBZQMCATABMA8G
+A1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAAP+S9Kl9ocPuIY66PoF
+SDnkqzKGoqlaqslJ7f7oUQTUwVKGx6hxk18tUGCR4rof/JpLBj6fjYLcfAutev7e
+/ZZPf+X6X9QlJW3RpqLCIcGfa4k0LdLLDIYUGKu3YzeByWf+7AHjrFarwSxlZSHw
+ooknYMokxMrgroLoMkawy5gZSMyykCgLxWtJdCHq/lSxLnseGN7Xfpa4Yr4ST9Gg
+F3oyvMVIgp7jJUAw15Yjtfpu0NJ0EkWbLp3k27UG12xDzC4XZUfco5ecXy0Iflj1
+USDPXUMJ+9etyJQo6ctOAf1vXD90OpTS9YynXwm4VCqRRISItnWSbLIvEK0zg+Yr
+B1UwggOYMIICgKADAgECAgEBMA0GCSqGSIb3DQEBCwUAMEYxCzAJBgNVBAYTAlVT
+MR8wHQYDVQQKDBZUZXN0IENlcnRpZmljYXRlcyAyMDExMRYwFAYDVQQDDA1VVEY4
+U3RyaW5nIENBMB4XDTEwMDEwMTA4MzAwMFoXDTMwMTIzMTA4MzAwMFowbDELMAkG
+A1UEBhMCVVMxHzAdBgNVBAoMFlRlc3QgQ2VydGlmaWNhdGVzIDIwMTExPDA6BgNV
+BAMMM1ZhbGlkIFVURjhTdHJpbmcgRW5jb2RlZCBOYW1lcyBFRSBDZXJ0aWZpY2F0
+ZSBUZXN0OTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOJDId75CXDD
+skYXno4uddVrr8/ANbmczKCFNWMH/1JVs4XZw460VL+kbD1BtzjbBqNJm4o/S0QG
+mHRKRmXKGnIfBwafZQytaiUCcAYO6DGvzeKNv8ASUv46vObmXE9y5Ubz4PXD0Rbs
+k6ojiLCEd7vRcp0zlFoZHNClCZ+8Yy6PpWwxQloi/73/lEvJx6/A0RmXfKItNXoA
++6KGgjwtBBz0L5hB8DNGrP571p1kgFrIyGyGkAm2Bn2l01E+JRe380PDiNJsen58
+AGzfHSLkYwMYFAwjjitRVjih0gzsZwgVnXgfItjSy2SnY+wcK+Z3YMFL1BsIDuta
+Ee7yBx1DTbUCAwEAAaNrMGkwHwYDVR0jBBgwFoAUO2dbRPINp0h9cymMk5/VJOMS
+YCYwHQYDVR0OBBYEFLio4b3uIZIaGK9NKo+c2yNywZq/MA4GA1UdDwEB/wQEAwIE
+8DAXBgNVHSAEEDAOMAwGCmCGSAFlAwIBMAEwDQYJKoZIhvcNAQELBQADggEBAB5r
+IidlVbtehpMG1BZSa80E7dsw6r8WwKKhOezqVJmncl5MwbTKPoebEkY0u4M0zNx8
+3zymJDux+81/6VxZvSDB0HYddZNThNykAdSSfzcWJ32iDeBm/hgOH58hC1xovj9i
+NrRxIOLL85ge9Xd6ES5MCcw+HxS13lQjvZ4XDOcv7uUV0kynogxNrQYPmJWORgNI
+4TwIEW/W/IVk6mIzdRLnoq6j3dVB0NRJdl1semGB12iylyeVbV9DjC8xRNmld6px
+u7SQOo0gzXSihRueSlrxmx/Vo52drWncZwXIlN2kqJ6WVeu1znZrM3HAeA/C9yEb
+iT1GocAY0mUPCwQcwHahggOrMIIBwDCBqQIBATANBgkqhkiG9w0BAQsFADBGMQsw
+CQYDVQQGEwJVUzEfMB0GA1UECgwWVGVzdCBDZXJ0aWZpY2F0ZXMgMjAxMTEWMBQG
+A1UEAwwNVVRGOFN0cmluZyBDQRcNMTAwMTAxMDgzMDAwWhcNMzAxMjMxMDgzMDAw
+WqAvMC0wHwYDVR0jBBgwFoAUO2dbRPINp0h9cymMk5/VJOMSYCYwCgYDVR0UBAMC
+AQEwDQYJKoZIhvcNAQELBQADggEBAE2uI86u6pYfkenx+nHcN7B8ymkICJpPJlIq
+NfjteDVjwz9D2ra89nHKdXRE83ftELk0cXxN4qEuylBI+2V/WUNjll1VsTqvRSGD
+Fu6KhjZHEjbdGHu2Z+tT7E9a72X3hxYJEDycSTlaR4OvFUWeKksPaKXt6HdhV7AQ
+UHT9KbewgLDekpPKj1O1tjzs/NN2mt0mBqbm9dzi4oL2PezZLfEOpa1BXQR9r37H
+WKmDxO4SixOGNaOd+jplpzhyPDqftcMmgRZnKesEvKcXul1GRxreqhaF+dlvluKw
+zRgC9Z0x8iS8HyoqlCzdGy8xOuRJvqqfg0aPDn/waUA0pF7QfwowggHjMIHMAgEB
+MA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNVBAYTAlVTMR8wHQYDVQQKExZUZXN0IENl
+cnRpZmljYXRlcyAyMDExMRUwEwYDVQQDEwxUcnVzdCBBbmNob3IXDTEwMDEwMTA4
+MzAwMFoXDTMwMTIzMTA4MzAwMFowIjAgAgFoFw0xMDAxMDEwODMwMDBaMAwwCgYD
+VR0VBAMKAQGgLzAtMB8GA1UdIwQYMBaAFOR9X9FclYYILAWuvnW2ZafZXahmMAoG
+A1UdFAQDAgEBMA0GCSqGSIb3DQEBCwUAA4IBAQCrGR21uyFrtuFMzfC3N56VONHU
+gZCArhHw+xzZ/DY07J2Wrw95JzeqK0dXqbh2ofNyFCXK1ims4rh1GK0SH5FhjhQp
+Q2745BDlUUtK+4LRa/fGfbDb1WqlC1q8EV8nwuy33nbSl5x7rHzp8H0vpU/hg0Yi
+stz7uESMQMAsmz620+jE01cYwClBCLnHJkSSxdACjrRl0f+v3mV1UJrtTY5Vc7Uw
+K5mVZBGWqXQGLcLMTbpxbWNxwR1TrJDQ40o25E5H7o2xdnZCbYKUcQZYUkBn8JYH
+s2ND2Zo2SiKhlvggHYAo8oFxvSZPdNiymBPzNxlI/kMsLyJU6tzHZItK93fmMYIB
+4TCCAd0CAQEwSzBGMQswCQYDVQQGEwJVUzEfMB0GA1UECgwWVGVzdCBDZXJ0aWZp
+Y2F0ZXMgMjAxMTEWMBQGA1UEAwwNVVRGOFN0cmluZyBDQQIBATANBglghkgBZQME
+AgEFAKBpMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8X
+DTExMDQxNDEzMDIyMlowLwYJKoZIhvcNAQkEMSIEIMKzJ6sDo+x9LpnU6iKEMKwG
+aa970eyPsW5xPb2+6iuHMA0GCSqGSIb3DQEBAQUABIIBAJl5gCzKA9KQuO7fcWkL
+Pu4R2A0lb2yZAIQB/0qTdGStpluqwtTIWmAc6atG4tKmZyt9tMYQUkJyGSNlLSps
+ZK3T+ltJCeONyYkSZxSr/8A3UQGGJtS5s2M6CwwRe+Dfo3iupGFRIJ8TfLkAukpb
+1+ao+5hxMHYait/ds9DKkbn/JdnRhMz+SRyCgEoy9lMmEv9YG3AJziL0nQVm/+RV
+VMTRAoLUPkgTCxFwaob4yFou+o+jsk8NAzavlMIe2yWjNwMCz/sm4e9mbF4k6xKn
+3gNEaBh/KIjjQUH86hOzLIUnMb2BurnyHXQrfYGTwefAPWGACB06u5hmgk7MlQaY
+hp4=
+
+------BF0F19981A03F3AEBB1B40CD96D61B65--
+
diff --git a/fuzz/smime.c b/fuzz/smime.c
new file mode 100644
index 0000000000..8a4deff2f6
--- /dev/null
+++ b/fuzz/smime.c
@@ -0,0 +1,49 @@
+/*
+ * Copyright 2023 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * https://www.openssl.org/source/license.html
+ * or in the file LICENSE in the source distribution.
+ */
+
+#include "fuzzer.h"
+#include <openssl/err.h>
+#include <openssl/pkcs7.h>
+#include <openssl/x509.h>
+#include <stdio.h>
+
+int FuzzerInitialize(int *argc, char ***argv)
+{
+    return 1;
+}
+
+int FuzzerTestOneInput(const uint8_t *buf, size_t len)
+{
+    BIO *b = BIO_new_mem_buf(buf, len);
+    PKCS7 *p7 = SMIME_read_PKCS7(b, NULL);
+
+    if (p7 != NULL) {
+        STACK_OF(PKCS7_SIGNER_INFO) *p7si = PKCS7_get_signer_info(p7);
+        int i;
+
+        for (i = 0; i < sk_PKCS7_SIGNER_INFO_num(p7si); i++) {
+            STACK_OF(X509_ALGOR) *algs;
+
+            PKCS7_cert_from_signer_info(p7,
+                                        sk_PKCS7_SIGNER_INFO_value(p7si, i));
+            algs = PKCS7_get_smimecap(sk_PKCS7_SIGNER_INFO_value(p7si, i));
+            sk_X509_ALGOR_pop_free(algs, X509_ALGOR_free);
+        }
+        PKCS7_free(p7);
+    }
+
+    BIO_free(b);
+    ERR_clear_error();
+    return 0;
+}
+
+void FuzzerCleanup(void)
+{
+}