fuzz/decoder.c: Limit the key sizes on which checks are run

In particular the DH safe prime check will be limited to 8192 bits
and the private and pairwise checks are limited to 16384 bits on
any key types.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/24049)

diff --git a/fuzz/decoder.c b/fuzz/decoder.c
index 1a6558dbb3a265c453e82f5258e07aab16a56624..c7b6d02f73722cd8ba56259eac24df71440d0c79 100644 (file)
--- a/fuzz/decoder.c
+++ b/fuzz/decoder.c
@@ -64,10 +64,19 @@ int FuzzerTestOneInput(const uint8_t *buf, size_t len)
         EVP_PKEY_free(pkey2);
 
         ctx = EVP_PKEY_CTX_new(pkey, NULL);
-        EVP_PKEY_param_check(ctx);
+        /*
+         * Param check will take too long time on large DH parameters.
+         * Skip it.
+         */
+        if (!EVP_PKEY_is_a(pkey, "DH") || EVP_PKEY_get_bits(pkey) <= 8192)
+            EVP_PKEY_param_check(ctx);
+
         EVP_PKEY_public_check(ctx);
-        EVP_PKEY_private_check(ctx);
-        EVP_PKEY_pairwise_check(ctx);
+        /* Private and pairwise checks are unbounded, skip for large keys. */
+        if (EVP_PKEY_get_bits(pkey) <= 16384) {
+            EVP_PKEY_private_check(ctx);
+            EVP_PKEY_pairwise_check(ctx);
+        }
         OPENSSL_assert(ctx != NULL);
         EVP_PKEY_CTX_free(ctx);
         EVP_PKEY_free(pkey);