CNA-VGAP-029: No fuzz target covers .cnj documents or the JSON parser, and .cnj files are read whole with no size bound

CNA snapshot 009d40f5  ·  Known Issues › Verification gaps  ·  source links pinned to 009d40f5

The content fuzz suites cover the XNB container, LZX, XNB writer input and the CNB container; ContentManager's ReadTextFile reads any .cnj into memory before parsing, with no counterpart of XnbReadLimits.

Identifier

CNA-VGAP-029

Category

Verification gap

Subsystem

Testing & evidence

Status

Open

Verified against

CNA 009d40f5 (009d40f5dd085c4e674d3479675fac84b12b3e0a)

Evidence basis

Source-verified: read at TARGET, not executed

Tests touching this area

Yes: see Current tests

Affected contract

ContentManager's .cnj tier (ReadTextFile, ParseCnjEnvelope and the per-type .cnj readers)

Expected behaviour

CNA hardens its binary formats with explicit limits and fuzzing; the textual .cnj route takes untrusted input through the same ContentManager and needs equivalent evidence.

Actual behaviour at TARGET

ReadTextFile in ContentManager.cpp streams the whole file into a std::string with no size check. The fuzz tests are XnbContainerFuzzTests.cpp, LzxDecoderFuzzTests.cpp, XnbWriterInputFuzzTests.cpp and CnbContainerFuzzTests.cpp; none feeds .cnj or JSON, and neither do the other fuzz harnesses in the tree (intermediate XML, model, compiled effects, C API). The unbounded JSON nesting is CNA-BUG-016, reproduced with a header-only probe (a 100,000-level document ends in SIGSEGV); the substring scanners in the Model and skinned-model readers are another untested surface. The existing malformed-document cases (CnbCompilerStrictnessTests and the Cnj* suites) are hand-written examples, not mutation.

Source locations

• modules/content/src/Xna/ContentManager.cpp — ReadTextFile: whole-file read, no size limit
• modules/content/tests/CNA/Internal/Xnb/XnbContainerFuzzTests.cpp — fuzzing exists for XNB, LZX, XNB writer input
• modules/content/tests/CNA/Content/Cnb/CnbContainerFuzzTests.cpp — fuzzing exists for CNB

Evidence

Checked by reading and by listing every *Fuzz* file under modules at 009d40f5; not executed.

Independent re-verification: Checked by reading and by listing every fuzz-related file at 009d40f5; not executed. The binary loaders' 'too large' checks in ContentManager.cpp compare against the int32 maximum, a representability check; XnbReadLimits bounds decompressed size, collection counts and nesting, and the .cnj route has no counterpart.

Focused reproduction

No focused reproduction is known. Nothing has been invented here; the evidence above is what exists.

Current tests

The .cnj readers have example-based tests; no mutation or size-limit test exists.

Regression test

A deterministic mutation suite over the committed .cnj fixtures (the pattern of CnbContainerFuzzTests.cpp) expecting only ContentLoadException, plus a size-limit test once a limit exists.

Blast radius

Evidence only; applications that load .cnj from untrusted sources carry the unmeasured risk.

Workaround

No workaround is known.