Split fuzz targets

fuzz/Cargo.toml

@@ -1,5 +1,5 @@
 [package]
-name = "scrypt-fuzz"
+name = "fuzz"
 version = "0.0.0"
 publish = false
 edition = "2018"
@@ -9,12 +9,25 @@ cargo-fuzz = true
 
 [dependencies]
 libfuzzer-sys = "0.4"
-base16ct = { version = "0.2", features = ["alloc"] }
 scrypt = { path = "../scrypt", features = ["simple"]}
 
 [[bin]]
-name = "scrypt_fuzzer"
-path = "fuzz_targets/scrypt_fuzzer.rs"
+name = "scrypt_hash"
+path = "fuzz_targets/scrypt_hash.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "scrypt_phc_verify"
+path = "fuzz_targets/scrypt_phc_verify.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "scrypt_phc_hash"
+path = "fuzz_targets/scrypt_phc_hash.rs"
 test = false
 doc = false
 bench = false

fuzz/LICENSE-MIT

@@ -1,4 +1,5 @@
-Copyright (c) 2021-2024 The RustCrypto Project Developers
+Copyright (c) 2024 The RustCrypto Project Developers
+Copyright (c) 2024 Google LLC
 
 Permission is hereby granted, free of charge, to any
 person obtaining a copy of this software and associated
@@ -23,18 +24,3 @@ CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
 OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
 IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 DEALINGS IN THE SOFTWARE.
-
-
-
-Copyright (c) 2024 Google LLC
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-      http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.

fuzz/fuzz_targets/scrypt_hash.rs

@@ -0,0 +1,12 @@
+#![no_main]
+use libfuzzer_sys::fuzz_target;
+use scrypt::scrypt;
+
+use fuzz::ScryptRandParams;
+
+fuzz_target!(|data: (&[u8], &[u8], ScryptRandParams)| {
+    let (password, salt, ScryptRandParams(params)) = data;
+    let mut result = [0u8; 64];
+    let res = scrypt(password, salt, &params, &mut result);
+    assert!(res.is_ok());
+});

fuzz/fuzz_targets/scrypt_phc_hash.rs

@@ -0,0 +1,22 @@
+#![no_main]
+use libfuzzer_sys::fuzz_target;
+use scrypt::password_hash::{Ident, PasswordHasher, Salt, SaltString};
+use scrypt::Scrypt;
+
+use fuzz::ScryptRandParams;
+
+fuzz_target!(|data: (&[u8], &[u8], ScryptRandParams)| {
+    let (password, salt, ScryptRandParams(params)) = data;
+    if salt.len() < Salt::MIN_LENGTH {
+        return;
+    }
+    let salt_string = SaltString::encode_b64(salt).unwrap();
+    let res = Scrypt.hash_password_customized(
+        password,
+        Some(Ident::new_unwrap("scrypt")),
+        None,
+        params,
+        &salt_string,
+    );
+    assert!(res.is_ok());
+});

fuzz/fuzz_targets/scrypt_phc_verify.rs

@@ -0,0 +1,13 @@
+#![no_main]
+use libfuzzer_sys::fuzz_target;
+use scrypt::password_hash::{PasswordHash, PasswordVerifier};
+use scrypt::Scrypt;
+
+const SAMPLE_HASH: &str = "$scrypt$ln=16,r=8,p=1$\
+    aM15713r3Xsvxbi31lqr1Q$nFNh2CVHVjNldFVKDHDlm4CbdRSCdEBsjjJxD+iCs5E";
+
+fuzz_target!(|password: &[u8]| {
+    let hash = PasswordHash::new(SAMPLE_HASH).expect("SAMPLE_HASH is valid");
+    let res = Scrypt.verify_password(password, &hash);
+    assert!(res.is_err());
+});

fuzz/src/lib.rs

@@ -0,0 +1,16 @@
+use libfuzzer_sys::arbitrary::{Arbitrary, Result, Unstructured};
+
+#[derive(Debug)]
+pub struct ScryptRandParams(pub scrypt::Params);
+
+impl<'a> Arbitrary<'a> for ScryptRandParams {
+    fn arbitrary(u: &mut Unstructured<'a>) -> Result<Self> {
+        let log_n = u.int_in_range(0..=15)?;
+        let r = u.int_in_range(1..=32)?;
+        let p = u.int_in_range(1..=16)?;
+        let len = u.int_in_range(10..=64)?;
+
+        let params = scrypt::Params::new(log_n, r, p, len).unwrap();
+        Ok(Self(params))
+    }
+}