Skip to content

Commit 9d46ea3

Browse files
authored
jsign: fuzzing for appx/msix files (#10584)
This is an additional fuzzer for the APPX/MSIX files signed by Jsign
1 parent 70e9e56 commit 9d46ea3

File tree

2 files changed

+47
-3
lines changed

2 files changed

+47
-3
lines changed
Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
// Copyright 2023 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
//
15+
////////////////////////////////////////////////////////////////////////////////
16+
17+
import java.io.File;
18+
import java.io.FileInputStream;
19+
import java.io.IOException;
20+
import java.nio.file.Files;
21+
import java.security.KeyStore;
22+
23+
import net.jsign.AuthenticodeSigner;
24+
import net.jsign.appx.APPXFile;
25+
26+
public class AuthenticodeAppxSignerFuzzer {
27+
28+
public static void fuzzerTestOneInput(byte[] data) throws Exception {
29+
File file = File.createTempFile("jsign-fuzzer", "msix");
30+
file.deleteOnExit();
31+
Files.write(file.toPath(), data);
32+
33+
KeyStore keystore = KeyStore.getInstance("JKS");
34+
keystore.load(Thread.currentThread().getContextClassLoader().getResourceAsStream("keystore.jks"), "password".toCharArray());
35+
36+
try {
37+
AuthenticodeSigner signer = new AuthenticodeSigner(keystore, "test", "password").withTimestamping(false);
38+
signer.sign(new APPXFile(file));
39+
} catch (IOException e) {
40+
// expected
41+
}
42+
}
43+
}

projects/jsign/Dockerfile

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,10 @@ ENV MVN $SRC/maven/apache-maven-3.8.7/bin/mvn
2424

2525
RUN git clone --depth 1 https://github.com/ebourg/jsign.git
2626

27-
RUN zip -j $SRC/AuthenticodeExeSignerFuzzer_seed_corpus.zip jsign/jsign-core/src/test/resources/*.exe && \
28-
zip -j $SRC/AuthenticodeMsiSignerFuzzer_seed_corpus.zip jsign/jsign-core/src/test/resources/*.msi && \
29-
zip -j $SRC/AuthenticodeCabSignerFuzzer_seed_corpus.zip jsign/jsign-core/src/test/resources/mscab/*.cab
27+
RUN zip -j $SRC/AuthenticodeExeSignerFuzzer_seed_corpus.zip jsign/jsign-core/src/test/resources/*.exe && \
28+
zip -j $SRC/AuthenticodeMsiSignerFuzzer_seed_corpus.zip jsign/jsign-core/src/test/resources/*.msi && \
29+
zip -j $SRC/AuthenticodeAppxSignerFuzzer_seed_corpus.zip jsign/jsign-core/src/test/resources/*.msix && \
30+
zip -j $SRC/AuthenticodeCabSignerFuzzer_seed_corpus.zip jsign/jsign-core/src/test/resources/mscab/*.cab
3031

3132
COPY build.sh $SRC/
3233
COPY *Fuzzer.java $SRC/

0 commit comments

Comments
 (0)