[fuzz] add fuzz tests for hpack encoding and decoding (#13315)

Signed-off-by: Asra Ali <asraa@google.com>

test/common/http/http2/BUILD

@@ -4,6 +4,7 @@ load(
     "envoy_cc_test",
     "envoy_cc_test_library",
     "envoy_package",
+    "envoy_proto_library",
 )
 
 licenses(["notice"])  # Apache 2
@@ -177,3 +178,22 @@ envoy_cc_fuzz_test(
         "//test/common/http/http2:codec_impl_test_util",
     ],
 )
+
+envoy_proto_library(
+    name = "hpack_fuzz_proto",
+    srcs = ["hpack_fuzz.proto"],
+    deps = ["//test/fuzz:common_proto"],
+)
+
+envoy_cc_fuzz_test(
+    name = "hpack_fuzz_test",
+    srcs = ["hpack_fuzz_test.cc"],
+    corpus = "hpack_corpus",
+    external_deps = [
+        "nghttp2",
+    ],
+    deps = [
+        ":hpack_fuzz_proto_cc_proto",
+        "//test/test_common:utility_lib",
+    ],
+)

test/common/http/http2/hpack_fuzz.proto

@@ -0,0 +1,14 @@
+syntax = "proto3";
+
+package test.common.http.http2;
+
+import "test/fuzz/common.proto";
+
+import "validate/validate.proto";
+
+// Structured input for hpack_fuzz_test.
+
+message HpackTestCase {
+  test.fuzz.Headers headers = 1 [(validate.rules).message.required = true];
+  bool end_headers = 2;
+}

test/common/http/http2/hpack_fuzz_test.cc

@@ -0,0 +1,155 @@
+// Fuzzer for HPACK encoding and decoding.
+// TODO(asraa): Speed up by using raw byte input and separators rather than protobuf input.
+
+#include <algorithm>
+
+#include "test/common/http/http2/hpack_fuzz.pb.validate.h"
+#include "test/fuzz/fuzz_runner.h"
+#include "test/test_common/utility.h"
+
+#include "absl/container/fixed_array.h"
+#include "nghttp2/nghttp2.h"
+
+namespace Envoy {
+namespace Http {
+namespace Http2 {
+namespace {
+
+// Dynamic Header Table Size
+constexpr int kHeaderTableSize = 4096;
+
+std::vector<nghttp2_nv> createNameValueArray(const test::fuzz::Headers& input) {
+  const size_t nvlen = input.headers().size();
+  std::vector<nghttp2_nv> nva(nvlen);
+  int i = 0;
+  for (const auto& header : input.headers()) {
+    // TODO(asraa): Consider adding flags in fuzzed input.
+    const uint8_t flags = 0;
+    nva[i++] = {const_cast<uint8_t*>(reinterpret_cast<const uint8_t*>(header.key().data())),
+                const_cast<uint8_t*>(reinterpret_cast<const uint8_t*>(header.value().data())),
+                header.key().size(), header.value().size(), flags};
+  }
+
+  return nva;
+}
+
+Buffer::OwnedImpl encodeHeaders(nghttp2_hd_deflater* deflater,
+                                const std::vector<nghttp2_nv>& input_nv) {
+  // Estimate the upper bound
+  const size_t buflen = nghttp2_hd_deflate_bound(deflater, input_nv.data(), input_nv.size());
+
+  Buffer::RawSlice iovec;
+  Buffer::OwnedImpl payload;
+  payload.reserve(buflen, &iovec, 1);
+  ASSERT(iovec.len_ >= buflen);
+
+  // Encode using nghttp2
+  uint8_t* buf = reinterpret_cast<uint8_t*>(iovec.mem_);
+  ASSERT(input_nv.data() != nullptr);
+  const ssize_t result =
+      nghttp2_hd_deflate_hd(deflater, buf, buflen, input_nv.data(), input_nv.size());
+  ASSERT(result >= 0, absl::StrCat("Failed to decode with result ", result));
+
+  iovec.len_ = result;
+  payload.commit(&iovec, 1);
+
+  return payload;
+}
+
+std::vector<nghttp2_nv> decodeHeaders(nghttp2_hd_inflater* inflater,
+                                      const Buffer::OwnedImpl& payload, bool end_headers) {
+  // Decode using nghttp2
+  Buffer::RawSliceVector slices = payload.getRawSlices();
+  const int num_slices = slices.size();
+  ASSERT(num_slices == 1, absl::StrCat("number of slices ", num_slices));
+
+  std::vector<nghttp2_nv> decoded_headers;
+  int inflate_flags = 0;
+  nghttp2_nv decoded_nv;
+  while (slices[0].len_ > 0) {
+    ssize_t result = nghttp2_hd_inflate_hd2(inflater, &decoded_nv, &inflate_flags,
+                                            reinterpret_cast<uint8_t*>(slices[0].mem_),
+                                            slices[0].len_, end_headers);
+    // Decoding should not fail and data should not be left in slice.
+    ASSERT(result >= 0);
+
+    slices[0].mem_ = reinterpret_cast<uint8_t*>(slices[0].mem_) + result;
+    slices[0].len_ -= result;
+
+    if (inflate_flags & NGHTTP2_HD_INFLATE_EMIT) {
+      // One header key value pair has been successfully decoded.
+      decoded_headers.push_back(decoded_nv);
+    }
+  }
+
+  if (end_headers) {
+    nghttp2_hd_inflate_end_headers(inflater);
+  }
+
+  return decoded_headers;
+}
+
+struct NvComparator {
+  inline bool operator()(const nghttp2_nv& a, const nghttp2_nv& b) {
+    absl::string_view a_str(reinterpret_cast<char*>(a.name), a.namelen);
+    absl::string_view b_str(reinterpret_cast<char*>(b.name), b.namelen);
+    return a_str.compare(b_str);
+  }
+};
+
+DEFINE_PROTO_FUZZER(const test::common::http::http2::HpackTestCase& input) {
+  // Validate headers.
+  try {
+    TestUtility::validate(input);
+  } catch (const EnvoyException& e) {
+    ENVOY_LOG_MISC(trace, "EnvoyException: {}", e.what());
+    return;
+  }
+
+  // Create name value pairs from headers.
+  std::vector<nghttp2_nv> input_nv = createNameValueArray(input.headers());
+  // Skip encoding empty headers. nghttp2 will throw a nullptr error on runtime if it receives a
+  // nullptr input.
+  if (!input_nv.data()) {
+    return;
+  }
+
+  // Create Deflater and Inflater
+  nghttp2_hd_deflater* deflater = nullptr;
+  int rc = nghttp2_hd_deflate_new(&deflater, kHeaderTableSize);
+  ASSERT(rc == 0);
+  nghttp2_hd_inflater* inflater = nullptr;
+  rc = nghttp2_hd_inflate_new(&inflater);
+  ASSERT(rc == 0);
+
+  // Encode headers with nghttp2.
+  const Buffer::OwnedImpl payload = encodeHeaders(deflater, input_nv);
+  ASSERT(!payload.getRawSlices().empty());
+
+  // Decode headers with nghttp2
+  std::vector<nghttp2_nv> output_nv = decodeHeaders(inflater, payload, input.end_headers());
+
+  // Verify that decoded == encoded.
+  ASSERT(input_nv.size() == output_nv.size());
+  std::sort(input_nv.begin(), input_nv.end(), NvComparator());
+  std::sort(output_nv.begin(), output_nv.end(), NvComparator());
+  for (size_t i = 0; i < input_nv.size(); i++) {
+    absl::string_view in_name = {reinterpret_cast<char*>(input_nv[i].name), input_nv[i].namelen};
+    absl::string_view out_name = {reinterpret_cast<char*>(output_nv[i].name), output_nv[i].namelen};
+    absl::string_view in_val = {reinterpret_cast<char*>(input_nv[i].value), input_nv[i].valuelen};
+    absl::string_view out_val = {reinterpret_cast<char*>(output_nv[i].value),
+                                 output_nv[i].valuelen};
+    ASSERT(in_name == out_name);
+    ASSERT(in_val == out_val);
+  }
+
+  // Delete inflater
+  nghttp2_hd_inflate_del(inflater);
+  // Delete deflater.
+  nghttp2_hd_deflate_del(deflater);
+}
+
+} // namespace
+} // namespace Http2
+} // namespace Http
+} // namespace Envoy