Fuzz: serialization heap buffer overflow via round-trip and deserialize

Cargo.toml

@@ -22,6 +22,7 @@ criterion = { version = "0.5.0", features = ["html_reports"] }
 dhat = "0.3.3"
 hyperloglog = "1.0.2"
 hyperloglogplus = "0.4.1"
+postcard = { version = "1.1.1", features=["alloc"] }
 pprof = { version = "0.14.0", features = ["flamegraph", "criterion", "protobuf-codec"] }
 probabilistic-collections = "0.7.0"
 rand = "0.8.5"

Makefile

@@ -22,6 +22,15 @@ fuzz-estimator:
 fuzz-serde:
 	RUSTFLAGS="-Z sanitizer=address" cargo +nightly fuzz run serde -- -max_len=65536
 
+fuzz-serde-json-array:
+	RUSTFLAGS="-Z sanitizer=address" cargo +nightly fuzz run serde_json_array -- -max_len=65536
+
+fuzz-serde-postcard:
+	RUSTFLAGS="-Z sanitizer=address" cargo +nightly fuzz run serde_postcard -- -max_len=65536
+
+fuzz-serde-roundtrip:
+	RUSTFLAGS="-Z sanitizer=address" cargo +nightly fuzz run serde_roundtrip -- -max_len=65536
+
 lint:
 	cargo clippy --features with_serde -- -D warnings
 

fuzz/Cargo.toml

@@ -10,6 +10,7 @@ cargo-fuzz = true
 [dependencies]
 cardinality-estimator = { path = "..", features = ["with_serde"] }
 libfuzzer-sys = "0.4"
+postcard = { version = "1.1.1", features = ["alloc"] }
 serde_json = "1.0.115"
 wyhash = "0.5.0"
 
@@ -26,3 +27,24 @@ path = "fuzz_targets/serde.rs"
 test = false
 doc = false
 bench = false
+
+[[bin]]
+name = "serde_json_array"
+path = "fuzz_targets/serde_json_array.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "serde_postcard"
+path = "fuzz_targets/serde_postcard.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "serde_roundtrip"
+path = "fuzz_targets/serde_roundtrip.rs"
+test = false
+doc = false
+bench = false

fuzz/fuzz_targets/serde_json_array.rs

@@ -0,0 +1,19 @@
+#![no_main]
+
+use serde_json::Value;
+use cardinality_estimator::estimator::CardinalityEstimator;
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    // pretty naiive version, u8s directly into each number position
+    let json: serde_json::Value = match data.len() {
+        0 => Value::Array(vec![]),
+        1 => Value::Array(vec![data[0].into()]),
+        _ => Value::Array(vec![data[0].into(),
+            Value::Array(data[1..].iter().map(|n| (*n).into()).collect())]),
+    };
+    if let Ok(mut estimator) = serde_json::from_value::<CardinalityEstimator<usize>>(json) {
+        estimator.insert(&1);
+        assert!(estimator.estimate() > 0);
+    }
+});

fuzz/fuzz_targets/serde_postcard.rs

@@ -0,0 +1,11 @@
+#![no_main]
+
+use cardinality_estimator::estimator::CardinalityEstimator;
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    if let Ok(mut estimator) = postcard::from_bytes::<CardinalityEstimator<usize>>(data) {
+        estimator.insert(&1);
+        assert!(estimator.estimate() > 0);
+    }
+});

fuzz/fuzz_targets/serde_roundtrip.rs

@@ -0,0 +1,15 @@
+#![no_main]
+
+use cardinality_estimator::estimator::CardinalityEstimator;
+use libfuzzer_sys::fuzz_target;
+use postcard::{to_allocvec, from_bytes};
+
+fuzz_target!(|data: &[u8]| {
+    let mut estimator = CardinalityEstimator::<u8>::new();
+    for d in data {
+        estimator.insert(&d);
+    }
+    let serialized = to_allocvec(&estimator).unwrap();
+    let mut roundtripped: CardinalityEstimator<u8> = from_bytes(&serialized).unwrap();
+    roundtripped.insert(&1);
+});

src/serde.rs

@@ -110,6 +110,23 @@ pub mod tests {
             original_estimator.representation(),
             deserialized_estimator.representation()
         );
+
+        // run each case with postcard serialization as well
+
+        let postcard_serialized =
+            postcard::to_allocvec(&original_estimator).expect("serialization failed");
+        assert!(
+            !postcard_serialized.is_empty(),
+            "postcard_serialized bytes should not be empty"
+        );
+
+        let postcard_estimator: CardinalityEstimator<str> =
+            postcard::from_bytes(&postcard_serialized).expect("deserialization failed");
+
+        assert_eq!(
+            original_estimator.representation(),
+            postcard_estimator.representation()
+        );
     }
 
     #[test]
@@ -130,5 +147,8 @@ pub mod tests {
     fn test_failed_deserialization(input: &[u8]) {
         let result: Result<CardinalityEstimator<str>, _> = serde_json::from_slice(input);
         assert!(result.is_err());
+
+        let result: Result<CardinalityEstimator<str>, _> = postcard::from_bytes(input);
+        assert!(result.is_err());
     }
 }