diff --git a/contrib/fuzz/Makefile b/contrib/fuzz/Makefile --- a/contrib/fuzz/Makefile +++ b/contrib/fuzz/Makefile @@ -121,6 +121,14 @@ fncache_fuzzer: fncache.cc manifest.o ch -lFuzzingEngine `$$OUT/sanpy/bin/python-config --ldflags` \ -o $$OUT/fncache_fuzzer +jsonescapeu8fast_fuzzer: jsonescapeu8fast.cc manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o + $(CXX) $(CXXFLAGS) `$$OUT/sanpy/bin/python-config --cflags` \ + -Wno-register -Wno-macro-redefined \ + -I../../mercurial jsonescapeu8fast.cc \ + manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o \ + -lFuzzingEngine `$$OUT/sanpy/bin/python-config --ldflags` \ + -o $$OUT/jsonescapeu8fast_fuzzer + manifest_corpus.zip: python manifest_corpus.py $$OUT/manifest_fuzzer_seed_corpus.zip @@ -171,6 +179,6 @@ clean: mpatch \ xdiff -oss-fuzz: bdiff_fuzzer mpatch_fuzzer mpatch_corpus.zip xdiff_fuzzer dirs_fuzzer fncache_fuzzer manifest_fuzzer manifest_corpus.zip revlog_fuzzer revlog_corpus.zip dirstate_fuzzer dirstate_corpus.zip fm1readmarkers_fuzzer fm1readmarkers_corpus.zip +oss-fuzz: bdiff_fuzzer mpatch_fuzzer mpatch_corpus.zip xdiff_fuzzer dirs_fuzzer fncache_fuzzer jsonescapeu8fast_fuzzer manifest_fuzzer manifest_corpus.zip revlog_fuzzer revlog_corpus.zip dirstate_fuzzer dirstate_corpus.zip fm1readmarkers_fuzzer fm1readmarkers_corpus.zip .PHONY: all clean oss-fuzz diff --git a/contrib/fuzz/jsonescapeu8fast.cc b/contrib/fuzz/jsonescapeu8fast.cc new file mode 100644 --- /dev/null +++ b/contrib/fuzz/jsonescapeu8fast.cc @@ -0,0 +1,57 @@ +#include +#include +#include +#include + +#include "pyutil.h" + +#include +#include +#include + +extern "C" { + +static PyCodeObject *code; + +extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + contrib::initpy(*argv[0]); + code = (PyCodeObject *)Py_CompileString(R"py( +from parsers import jsonescapeu8fast + +try: + jsonescapeu8fast(data, paranoid) +except Exception as e: + pass + # uncomment this print if you're editing this Python code + # to debug failures. + # print(e) +)py", + "fuzzer", Py_file_input); + if (!code) { + std::cerr << "failed to compile Python code!" << std::endl; + } + return 0; +} + +int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) +{ + FuzzedDataProvider provider(Data, Size); + bool paranoid = provider.ConsumeBool(); + std::string remainder = provider.ConsumeRemainingBytesAsString(); + + PyObject *mtext = PyBytes_FromStringAndSize( + (const char *)remainder.c_str(), remainder.size()); + PyObject *locals = PyDict_New(); + PyDict_SetItemString(locals, "data", mtext); + PyDict_SetItemString(locals, "paranoid", paranoid ? Py_True : Py_False); + PyObject *res = PyEval_EvalCode(code, contrib::pyglobals(), locals); + if (!res) { + PyErr_Print(); + } + Py_XDECREF(res); + Py_DECREF(locals); + Py_DECREF(mtext); + return 0; // Non-zero return values are reserved for future use. +} +}