react-native-quick-crypto 1.0.19 → 1.1.0

package/deps/simdutf/fuzz/main.cpp

@@ -0,0 +1,72 @@
+#include <cstddef>
+#include <cstdint>
+#include <filesystem>
+#include <fstream>
+#include <iostream>
+#include <vector>
+
+/*
+ * this provides a way to run garbage data through the library also on platforms
+ * that do not have libFuzzer. data can be taken from a fuzzing session
+ * and feeding it to a program with this main function.
+ */
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* Data, size_t Size);
+
+void handle_file(std::filesystem::path file) {
+  std::vector<char> data;
+
+  const auto Nbytes = file_size(file);
+  data.resize(Nbytes);
+
+  std::ifstream filestream(file);
+  filestream.read(data.data(), data.size());
+  if (filestream.gcount() != Nbytes) {
+    std::cerr << "failed reading from file " << file << '\n';
+    return;
+  }
+
+  std::cout << "invoking fuzzer on data from file " << file << '\n';
+
+  LLVMFuzzerTestOneInput(reinterpret_cast<const uint8_t*>(data.data()),
+                         data.size());
+}
+
+void handle_directory(std::filesystem::path directory) {
+  for (const auto& entry : std::filesystem::recursive_directory_iterator(
+           directory,
+           std::filesystem::directory_options::follow_directory_symlink)) {
+    if (entry.is_regular_file()) {
+      handle_file(entry.path());
+    } else if (entry.is_symlink()) {
+      auto resolved = read_symlink(entry);
+      if (is_regular_file(resolved)) {
+        handle_file(resolved);
+      }
+    }
+  }
+}
+
+void handle_possible_file(std::filesystem::path possible_file) {
+  if (std::filesystem::is_directory(possible_file)) {
+    handle_directory(possible_file);
+  } else if (is_regular_file(possible_file)) {
+    handle_file(possible_file);
+  } else if (is_symlink(possible_file)) {
+    auto resolved = read_symlink(possible_file);
+    handle_possible_file(resolved);
+  } else {
+    std::cerr << "not a directory, regular file or symlink: " << possible_file
+              << '\n';
+  }
+}
+
+void handle_arg(const char* path) {
+  return handle_possible_file(std::filesystem::path(path));
+}
+
+int main(int argc, char* argv[]) {
+  for (int i = 1; i < argc; ++i) {
+    handle_arg(argv[i]);
+  }
+}

package/deps/simdutf/fuzz/minimize_and_cleanse.sh

@@ -0,0 +1,87 @@
+#!/bin/sh
+#
+# minimizes and cleanses a crash.
+# arg1 is the fuzzer
+# arg2 is the crash case
+
+usage() {
+    echo "$0 fuzzer crashcase"
+}
+
+if [ $# -ne 2 ] ; then
+    usage
+    exit 1
+fi
+
+if [ ! -x "$1" ] ; then
+    echo "fuzzer should be passes ad arg 1"
+    exit 1
+fi
+
+if [ ! -e "$2" ] ; then
+    echo "crash case should be passed as arg 2"
+    exit 1
+fi
+
+TIMEOUT=30
+
+REPRODUCER=reproducer.$(basename $1).cpp
+
+rm -f minimized_crash cleaned_crash $REPRODUCER
+
+"$1" "$2" -minimize_crash=1 -exact_artifact_path=minimized_crash -max_total_time=$TIMEOUT
+
+"$1" minimized_crash -max_total_time=$TIMEOUT -cleanse_crash=1 -exact_artifact_path=cleaned_crash
+
+if [ ! -e cleaned_crash ] ; then
+    # in case it was not possible to clean, just copy it over
+    cp minimized_crash cleaned_crash
+fi
+
+if ! which xxd >/dev/null ; then
+   echo "please install xxd (sudo apt install xxd)"
+   exit 1
+fi
+
+# create a reproducer
+echo '#include <cstddef>
+#include <cstdint>
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
+
+int main() {' >$REPRODUCER
+xxd --include cleaned_crash >>$REPRODUCER
+echo '
+LLVMFuzzerTestOneInput(cleaned_crash,cleaned_crash_len);
+}' >> $REPRODUCER
+
+CF=clang-format-18
+if which $CF >/dev/null; then
+    $CF -fallback-style=Mozilla -i $REPRODUCER
+fi
+
+FUZZER=$(basename $1)
+mv cleaned_crash cleaned_crash.$FUZZER
+rm minimized_crash
+
+echo "find the crash data in file cleaned_crash.$FUZZER"
+echo "find a reproducer source file in $REPRODUCER"
+
+CXX=/usr/lib/ccache/clang++-18
+TARGET=out/$(basename $REPRODUCER .cpp)
+if [ -x $CXX ]; then
+    echo compiling a reproducer binary in $TARGET
+    set -x
+else
+    echo "compile a reproducer with the following command:"
+    CXX="echo clang++"
+fi
+$CXX \
+    -o $TARGET \
+    $REPRODUCER \
+    $FUZZER.cpp \
+    work/lib/libsimdutf.a \
+    -I work/include \
+    -std=c++20 \
+    -g \
+    -fsanitize=address,undefined

package/deps/simdutf/fuzz/misc.cpp

@@ -0,0 +1,216 @@
+#include <cstddef>
+#include <cstdint>
+#include <ranges>
+
+#include "helpers/common.h"
+#include "simdutf.h"
+
+void autodetect(std::span<const char> chardata) {
+  std::vector<simdutf::encoding_type> results;
+  const auto implementations = get_supported_implementations();
+  for (const simdutf::implementation* impl : implementations) {
+    results.push_back(
+        impl->autodetect_encoding(chardata.data(), chardata.size()));
+  }
+  auto neq = [](const auto& a, const auto& b) { return a != b; };
+  if (std::ranges::adjacent_find(results, neq) != results.end()) {
+    std::cerr << "output differs between implementations\n";
+    for (std::size_t i = 0; i < implementations.size(); ++i) {
+      std::cerr << "implementation " << implementations[i] << " gave "
+                << results.at(i) << '\n';
+    }
+    std::abort();
+  }
+}
+
+void detect(std::span<const char> chardata) {
+  std::vector<int> results;
+  const auto implementations = get_supported_implementations();
+  for (const simdutf::implementation* impl : implementations) {
+    results.push_back(impl->detect_encodings(chardata.data(), chardata.size()));
+  }
+  auto neq = [](const auto& a, const auto& b) { return a != b; };
+  if (std::ranges::adjacent_find(results, neq) != results.end()) {
+    std::cerr << "in detect_encodings(const char*, std::size_t):\n";
+    std::cerr << "output differs between implementations\n";
+    for (std::size_t i = 0; i < implementations.size(); ++i) {
+      std::cerr << "implementation " << implementations[i]->name() << " gave "
+                << results.at(i) << '\n';
+    }
+    std::cerr << " std::vector<unsigned char> data{";
+    for (unsigned char x : chardata) {
+      std::cerr << +x << ", ";
+    };
+    std::cerr << "};\n";
+    std::abort();
+  }
+}
+
+void validate_ascii(std::span<const char> chardata) {
+  // use int, not bool to avoid vector<bool>
+  std::vector<int> results;
+  const auto implementations = get_supported_implementations();
+  for (const simdutf::implementation* impl : implementations) {
+    results.push_back(+impl->validate_ascii(chardata.data(), chardata.size()));
+  }
+  auto neq = [](const auto& a, const auto& b) { return a != b; };
+  if (std::ranges::adjacent_find(results, neq) != results.end()) {
+    std::cerr << "in validate_ascii(const char*, std::size_t):\n";
+    std::cerr << "output differs between implementations\n";
+    for (std::size_t i = 0; i < implementations.size(); ++i) {
+      std::cerr << "implementation " << implementations[i]->name() << " gave "
+                << results.at(i) << '\n';
+    }
+    std::cerr << " std::vector<unsigned char> data{";
+    for (unsigned char x : chardata) {
+      std::cerr << +x << ", ";
+    };
+    std::cerr << "};\n";
+    std::abort();
+  }
+}
+
+void validate_ascii_with_err(std::span<const char> chardata) {
+  // use int, not bool to avoid vector<bool>
+  std::vector<simdutf::result> results;
+  const auto implementations = get_supported_implementations();
+  for (const simdutf::implementation* impl : implementations) {
+    results.push_back(
+        impl->validate_ascii_with_errors(chardata.data(), chardata.size()));
+  }
+  auto neq = [](const auto& a, const auto& b) { return a != b; };
+  if (std::ranges::adjacent_find(results, neq) != results.end()) {
+    std::cerr << "in validate_ascii(const char*, std::size_t):\n";
+    std::cerr << "output differs between implementations\n";
+    for (std::size_t i = 0; i < implementations.size(); ++i) {
+      std::cerr << "implementation " << implementations[i]->name() << " gave "
+                << results.at(i) << '\n';
+    }
+    std::cerr << " std::vector<unsigned char> data{";
+    for (unsigned char x : chardata) {
+      std::cerr << +x << ", ";
+    };
+    std::cerr << "};\n";
+    std::abort();
+  }
+}
+
+void utf16_endianness(std::span<const char16_t> data) {
+  std::vector<std::string> results;
+  const auto implementations = get_supported_implementations();
+  for (const simdutf::implementation* impl : implementations) {
+    std::vector<char16_t> out(data.size());
+    impl->change_endianness_utf16(data.data(), data.size(), out.data());
+    results.push_back(FNV1A_hash::as_str(out));
+  }
+  auto neq = [](const auto& a, const auto& b) { return a != b; };
+  if (std::ranges::adjacent_find(results, neq) != results.end()) {
+    std::cerr << "in utf16_endianness(const char*, std::size_t):\n";
+    std::cerr << "output differs between implementations\n";
+    for (std::size_t i = 0; i < implementations.size(); ++i) {
+      std::cerr << "implementation " << implementations[i]->name() << " gave "
+                << results.at(i) << '\n';
+    }
+    std::cerr << " std::vector<char16_t> data{";
+    for (int x : data) {
+      std::cerr << +x << ", ";
+    };
+    std::cerr << "};\n";
+    std::abort();
+  }
+}
+
+void convert_latin1_to_utf8_safe(std::span<const char> chardata,
+                                 const std::size_t outputsize) {
+  // convert with a limited output buffer
+  std::vector<char> limited_output(outputsize);
+  const auto limited_ret = simdutf::convert_latin1_to_utf8_safe(
+      chardata.data(), chardata.size(), limited_output.data(), outputsize);
+
+  // convert with a sufficiently large output buffer
+  std::vector<char> large_output(2 * chardata.size());
+  const auto large_ret = simdutf::convert_latin1_to_utf8(
+      chardata.data(), chardata.size(), large_output.data());
+
+  if (large_ret != 0) {
+    // conversion was possible with a large buffer.
+    if (large_ret <= outputsize) {
+      // the limited buffer was large enough, ensure we got the same result
+      assert(limited_ret == large_ret);
+      assert(std::ranges::equal(limited_output | std::views::take(large_ret),
+                                large_output | std::views::take(large_ret)));
+    } else {
+      // the number of written bytes for a limited buffer must not exceed what
+      // the large buffer got.
+      assert(limited_ret <= large_ret);
+      // the written data should be equal
+      assert(std::ranges::equal(limited_output | std::views::take(limited_ret),
+                                large_output | std::views::take(limited_ret)));
+    }
+  } else {
+    // conversion with a big buffer failed - is there anything we can check or
+    // assert for the limited buffer? I don't think so.
+  }
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  // pick one of the functions, based on the fuzz data.
+  // the first byte is which action to take. step forward
+  // several bytes so the input is aligned.
+  if (size < 4) {
+    return 0;
+  }
+  constexpr auto Ncases = 9u;
+  constexpr auto actionmask = std::bit_ceil(Ncases) - 1;
+  const auto action = data[0] & actionmask;
+
+  const std::uint16_t u16 = data[1] + (data[2] << 8);
+
+  data += 4;
+  size -= 4;
+
+  const std::span<const char> chardata{(const char*)data, size};
+  const std::span<const char16_t> u16data{(const char16_t*)data,
+                                          size / sizeof(char16_t)};
+
+  switch (action) {
+  case 0:
+    autodetect(chardata);
+    break;
+  case 1:
+    detect(chardata);
+    break;
+  case 2:
+    validate_ascii(chardata);
+    break;
+  case 3:
+    validate_ascii_with_err(chardata);
+    break;
+  case 4:
+    utf16_endianness(u16data);
+    break;
+  case 5: {
+    [[maybe_unused]] auto ret =
+        simdutf::trim_partial_utf16le(u16data.data(), u16data.size());
+    assert(ret == u16data.size() || ret + 1 == u16data.size());
+  } break;
+  case 6: {
+    [[maybe_unused]] auto ret =
+        simdutf::trim_partial_utf16be(u16data.data(), u16data.size());
+    assert(ret == u16data.size() || ret + 1 == u16data.size());
+  } break;
+  case 7: {
+    [[maybe_unused]] const std::size_t N = chardata.size();
+    [[maybe_unused]] const auto ret =
+        simdutf::trim_partial_utf8(chardata.data(), chardata.size());
+    if ((ret + 3 < N) || (ret > N)) {
+      std::cerr << "ret=" << ret << " N=" << N << '\n';
+      std::abort();
+    }
+  } break;
+  case 8:
+    convert_latin1_to_utf8_safe(chardata, u16);
+    break;
+  }
+  return 0;
+}

package/deps/simdutf/fuzz/random_fuzz.sh

@@ -0,0 +1,154 @@
+#!/bin/sh
+#
+# this is a helper script that repeatedly:
+# - pulls the latest changes from upstream using git pull (assumes you are on an appropriate branch)
+# - selects random compiler optimization
+# - selects random selection of sanitizers
+# - selects a random clang compiler
+# - builds the fuzzers
+# - runs each fuzzer for a limited time, in random order
+#
+# it is intended to run in a screen/tmux session
+# continuously. every once in a while, see if it has
+# stopped (indicating compilation failure or a fuzzing finding)
+
+set -eux
+
+src=$(dirname "$0")/..
+src=$(readlink -f "$src")
+
+TMPWORKDIR=$(mktemp -d)
+
+# store the corpus dir somewhere "permanent" and not inside the checked out
+# git dir since that tends to get cleaned
+corpusdir=/var/tmp/$(whoami)/simdutf/corpus/
+
+selectrandomoptlevel() {
+    echo "g 0 1 2 3 z s" |tr ' ' '\n' |sort --random-sort |head -n1
+}
+
+selectrandomclang() {
+    # on a debian/ubuntu system with ccache installed,
+    # looking for compilers in /usr/lib/ccache/ is the best place.
+    #
+    # on rocky linux, clang++ and clang++-$VER are in /usr/bin
+    #
+    # on the freebsd system I have access to, the compilers are in /usr/local/bin
+    # and named clang++$VER (note the lack of dash before $VER!) as well
+    # as /usr/bin/clang++ . There is also a clang++-devel in /usr/local/bin
+    compilerlist=$TMPWORKDIR/clangcandidates
+    echo clang++ >$compilerlist
+    echo clang++-devel >>$compilerlist
+    for ver in $(seq 15 40); do
+	echo clang++-$ver >>$compilerlist
+	echo clang++$ver >>$compilerlist
+    done
+    echo '#include <stddef.h> // for size_t (rather than std::size_t)
+          #include <stdint.h> // for uint8_t (rather than std::uint8_t)
+          extern "C" int LLVMFuzzerTestOneInput(const uint8_t* Data, size_t Size){return 0;}
+          ' > $TMPWORKDIR/testprog.cpp
+    for candidate in $(sort --random-sort $compilerlist); do
+	# only include candidates which exist and support fuzzer and sanitizers
+	if $candidate -std=c++20 -fsanitize=fuzzer-no-link,address,undefined -o $TMPWORKDIR/testprog.o -c $TMPWORKDIR/testprog.cpp  >/dev/null 2>&1 && \
+		$candidate -fsanitize=fuzzer,address,undefined -o $TMPWORKDIR/testprog $TMPWORKDIR/testprog.o >/dev/null 2>&1; then
+	    if [ -e /usr/lib/ccache/$candidate ]; then
+		echo /usr/lib/ccache/$candidate
+	    elif [ -e /usr/local/libexec/ccache/$candidate ]; then
+                echo /usr/local/libexec/ccache/$candidate
+	    else
+		echo $candidate
+	    fi
+	    return
+	fi
+    done	
+}
+
+selectsanitizerflags() {
+    echo \
+	"-fsanitize=fuzzer-no-link,address,undefined -fsanitize-trap=undefined
+-fsanitize=fuzzer-no-link,address
+-fsanitize=fuzzer-no-link,undefined -fsanitize-trap=undefined
+-fsanitize=fuzzer-no-link" | sort --random-sort |head -n1
+}
+
+# on bsd, put the fuzzing in low priority. on linux, use nice.
+if which idprio >/dev/null 2>&1 ; then
+    # idprio is by default a privileged operation, try it out to see if we can use it.
+    if idprio 5 true >/dev/null 2>&1; then
+	BENICE="idprio 5"
+    else
+	# nope. use nice instead.
+	BENICE="nice -n19"
+    fi
+elif which nice >/dev/null 2>&1 ; then
+    BENICE="nice -n19"
+else
+    BENICE=""
+fi
+
+# to get vector support on riscv64, we need to specify the arch
+MARCHFLAGS=
+case $(uname -m) in
+    x86_64)
+    # debian and rocky linux amd64
+    ;;
+    amd64)
+    # freebsd amd64
+    ;;
+    aarch64)
+    # debian arm64
+    ;;
+    arm64)
+    # freebsd arm64
+    ;;
+    arm)
+    # freebsd armv7
+    ;;
+    riscv64)
+	MARCHFLAGS="-march=rv64gcv"
+	;;
+    loongarch64)
+	MARCHFLAGS="-mlsx -mlasx"
+	;;
+    *)
+	;;
+esac
+
+while true ; do
+
+    echo "pulling the latest changes"
+    cd "$src"
+    git pull
+    
+    export CXX=$(selectrandomclang)
+    optlevel=$(selectrandomoptlevel)
+    export CXXFLAGS="$(selectsanitizerflags) -g -O${optlevel} ${MARCHFLAGS} -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION=1"
+    export LIB_FUZZING_ENGINE="-fsanitize=fuzzer"
+    export OUT=fuzz/out
+    export WORK=fuzz/work
+    mkdir -p $OUT $WORK
+    
+    rm -rf build/
+    # we will run in oss-fuzz mode, so we can set CXXFLAGS from here.
+    # do that by pointing out one directory above the repo root
+    export SRC=$(pwd)/..
+    $BENICE fuzz/build.sh
+
+    fuzzers="base64 conversion misc roundtrip"
+    for fuzzer in $(echo $fuzzers|tr ' ' '\n' |sort --random-sort); do
+	if [ ! -d  "$corpusdir/$fuzzer" ] ; then
+	    # populate with the backup corpus from oss-fuzz
+	    mkdir -p $TMPWORKDIR/ossfuzzcorpus/$fuzzer
+	    cd $TMPWORKDIR/ossfuzzcorpus/$fuzzer
+	    # in case this fails, keep going.
+	    if wget "https://storage.googleapis.com/simdutf-backup.clusterfuzz-external.appspot.com/corpus/libFuzzer/simdutf_${fuzzer}/public.zip" ;then
+		mkdir -p "$corpusdir/$fuzzer"
+		unzip -q public.zip -d "$corpusdir/$fuzzer"
+		rm public.zip
+	    fi
+	    cd $src
+	fi
+	mkdir -p "$corpusdir/$fuzzer"
+	$BENICE fuzz/out/$fuzzer -timeout=100 -max_total_time=3600 -jobs=$(nproc) -workers=$(nproc) "$corpusdir/$fuzzer"
+    done
+done