jar type: add fuzzer for 3rd-party dep (#1360)

Signed-off-by: AdamKorcz <adam@adalogics.com>

pkg/types/jar/v0.0.1/fuzz_test.go

@@ -16,12 +16,16 @@
 package jar
 
 import (
+	"archive/zip"
+	"bytes"
 	"context"
 	"sync"
 	"testing"
 
 	fuzz "github.com/AdaLogics/go-fuzz-headers"
 
+	jarutils "github.com/sassoftware/relic/lib/signjar"
+
 	fuzzUtils "github.com/sigstore/rekor/pkg/fuzz"
 	"github.com/sigstore/rekor/pkg/types/jar"
 )
@@ -54,3 +58,60 @@ func FuzzJarCreateProposedEntry(f *testing.F) {
 		_, _ = c.IndexKeys()
 	})
 }
+
+type zipFile struct {
+	fileName string
+	fileBody []byte
+}
+
+func FuzzJarutilsVerify(f *testing.F) {
+	f.Fuzz(func(t *testing.T, data []byte) {
+		ff := fuzz.NewConsumer(data)
+		noOfFiles, err := ff.GetInt()
+		if err != nil {
+			return
+		}
+		zipFiles := make([]*zipFile, 0)
+		for i := 0; i < noOfFiles%20; i++ {
+			fileName, err := ff.GetString()
+			if err != nil {
+				return
+			}
+			fileBody, err := ff.GetBytes()
+			if err != nil {
+				return
+			}
+			zf := &zipFile{
+				fileName: fileName,
+				fileBody: fileBody,
+			}
+			zipFiles = append(zipFiles, zf)
+		}
+		if len(zipFiles) == 0 {
+			return
+		}
+
+		buf := new(bytes.Buffer)
+		w := zip.NewWriter(buf)
+		for _, file := range zipFiles {
+			f, err := w.Create(file.fileName)
+			if err != nil {
+				w.Close()
+				return
+			}
+			_, err = f.Write([]byte(file.fileBody))
+			if err != nil {
+				w.Close()
+				return
+			}
+		}
+
+		w.Close()
+		zipData := buf.Bytes()
+		zipReader, err := zip.NewReader(bytes.NewReader(zipData), int64(len(zipData)))
+		if err != nil {
+			return
+		}
+		_, _ = jarutils.Verify(zipReader, false)
+	})
+}

tests/oss_fuzz.sh

@@ -60,5 +60,19 @@ compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/helm/v0.0.1 FuzzHel
 compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/helm/v0.0.1 FuzzHelmProvenanceUnmarshal FuzzHelmProvenanceUnmarshal
 compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/rekord/v0.0.1 FuzzRekordCreateProposedEntry FuzzRekordCreateProposedEntry
 
+# Test 3rd party API that rekor/pkg/types/jar/v0.0.1 uses
+cd $SRC
+git clone https://github.com/sassoftware/relic
+cd $SRC/relic
+git checkout dfb082b79b74bf792c0bfd7aca6e22bea6156a85
+cd $SRC/instrumentation
+go run main.go $SRC/relic
+cd $SRC/relic
+go mod tidy
+cd $SRC/rekor
+go mod edit -replace github.com/sassoftware/relic=$SRC/relic
+compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/jar/v0.0.1 FuzzJarutilsVerify FuzzJarutilsVerify 
+
+
 cp $SRC/rekor/tests/fuzz-testdata/*.options $OUT/
 zip $OUT/FuzzPackageUnmarshal_seed_corpus.zip $SRC/rekor/tests/fuzz-testdata/seeds/alpine/FuzzPackageUnmarshal/FuzzPackageUnmarshal_seed1