##// END OF EJS Templates
fuzz: always define LLVMFuzzerInitialize() even if we don't need it...
Augie Fackler -
r44261:51a99e09 default
parent child Browse files
Show More
@@ -1,42 +1,47 b''
1 /*
1 /*
2 * bdiff.cc - fuzzer harness for bdiff.c
2 * bdiff.cc - fuzzer harness for bdiff.c
3 *
3 *
4 * Copyright 2018, Google Inc.
4 * Copyright 2018, Google Inc.
5 *
5 *
6 * This software may be used and distributed according to the terms of
6 * This software may be used and distributed according to the terms of
7 * the GNU General Public License, incorporated herein by reference.
7 * the GNU General Public License, incorporated herein by reference.
8 */
8 */
9 #include <memory>
9 #include <memory>
10 #include <stdlib.h>
10 #include <stdlib.h>
11
11
12 #include <fuzzer/FuzzedDataProvider.h>
12 #include <fuzzer/FuzzedDataProvider.h>
13
13
14 extern "C" {
14 extern "C" {
15 #include "bdiff.h"
15 #include "bdiff.h"
16
16
17 extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv)
18 {
19 return 0;
20 }
21
17 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
22 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
18 {
23 {
19 FuzzedDataProvider provider(Data, Size);
24 FuzzedDataProvider provider(Data, Size);
20 std::string left = provider.ConsumeRandomLengthString(Size);
25 std::string left = provider.ConsumeRandomLengthString(Size);
21 std::string right = provider.ConsumeRemainingBytesAsString();
26 std::string right = provider.ConsumeRemainingBytesAsString();
22
27
23 struct bdiff_line *a, *b;
28 struct bdiff_line *a, *b;
24 int an = bdiff_splitlines(left.c_str(), left.size(), &a);
29 int an = bdiff_splitlines(left.c_str(), left.size(), &a);
25 int bn = bdiff_splitlines(right.c_str(), right.size(), &b);
30 int bn = bdiff_splitlines(right.c_str(), right.size(), &b);
26 struct bdiff_hunk l;
31 struct bdiff_hunk l;
27 bdiff_diff(a, an, b, bn, &l);
32 bdiff_diff(a, an, b, bn, &l);
28 free(a);
33 free(a);
29 free(b);
34 free(b);
30 bdiff_freehunks(l.next);
35 bdiff_freehunks(l.next);
31 return 0; // Non-zero return values are reserved for future use.
36 return 0; // Non-zero return values are reserved for future use.
32 }
37 }
33
38
34 #ifdef HG_FUZZER_INCLUDE_MAIN
39 #ifdef HG_FUZZER_INCLUDE_MAIN
35 int main(int argc, char **argv)
40 int main(int argc, char **argv)
36 {
41 {
37 const char data[] = "asdf";
42 const char data[] = "asdf";
38 return LLVMFuzzerTestOneInput((const uint8_t *)data, 4);
43 return LLVMFuzzerTestOneInput((const uint8_t *)data, 4);
39 }
44 }
40 #endif
45 #endif
41
46
42 } // extern "C"
47 } // extern "C"
@@ -1,122 +1,127 b''
1 /*
1 /*
2 * mpatch.cc - fuzzer harness for mpatch.c
2 * mpatch.cc - fuzzer harness for mpatch.c
3 *
3 *
4 * Copyright 2018, Google Inc.
4 * Copyright 2018, Google Inc.
5 *
5 *
6 * This software may be used and distributed according to the terms of
6 * This software may be used and distributed according to the terms of
7 * the GNU General Public License, incorporated herein by reference.
7 * the GNU General Public License, incorporated herein by reference.
8 */
8 */
9 #include <iostream>
9 #include <iostream>
10 #include <memory>
10 #include <memory>
11 #include <stdint.h>
11 #include <stdint.h>
12 #include <stdlib.h>
12 #include <stdlib.h>
13 #include <vector>
13 #include <vector>
14
14
15 #include "fuzzutil.h"
15 #include "fuzzutil.h"
16
16
17 extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv)
18 {
19 return 0;
20 }
21
17 // To avoid having too many OOMs from the fuzzer infrastructure, we'll
22 // To avoid having too many OOMs from the fuzzer infrastructure, we'll
18 // skip patch application if the resulting fulltext would be bigger
23 // skip patch application if the resulting fulltext would be bigger
19 // than 10MiB.
24 // than 10MiB.
20 #define MAX_OUTPUT_SIZE 10485760
25 #define MAX_OUTPUT_SIZE 10485760
21
26
22 extern "C" {
27 extern "C" {
23 #include "bitmanipulation.h"
28 #include "bitmanipulation.h"
24 #include "mpatch.h"
29 #include "mpatch.h"
25
30
26 struct mpatchbin {
31 struct mpatchbin {
27 std::unique_ptr<char[]> data;
32 std::unique_ptr<char[]> data;
28 size_t len;
33 size_t len;
29 };
34 };
30
35
31 static mpatch_flist *getitem(void *vbins, ssize_t pos)
36 static mpatch_flist *getitem(void *vbins, ssize_t pos)
32 {
37 {
33 std::vector<mpatchbin> *bins = (std::vector<mpatchbin> *)vbins;
38 std::vector<mpatchbin> *bins = (std::vector<mpatchbin> *)vbins;
34 const mpatchbin &bin = bins->at(pos + 1);
39 const mpatchbin &bin = bins->at(pos + 1);
35 struct mpatch_flist *res;
40 struct mpatch_flist *res;
36 LOG(2) << "mpatch_decode " << bin.len << std::endl;
41 LOG(2) << "mpatch_decode " << bin.len << std::endl;
37 if (mpatch_decode(bin.data.get(), bin.len, &res) < 0)
42 if (mpatch_decode(bin.data.get(), bin.len, &res) < 0)
38 return NULL;
43 return NULL;
39 return res;
44 return res;
40 }
45 }
41
46
42 // input format:
47 // input format:
43 // u8 number of inputs
48 // u8 number of inputs
44 // one u16 for each input, its length
49 // one u16 for each input, its length
45 // the inputs
50 // the inputs
46 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
51 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
47 {
52 {
48 if (!Size) {
53 if (!Size) {
49 return 0;
54 return 0;
50 }
55 }
51 // First byte of data is how many texts we expect, first text
56 // First byte of data is how many texts we expect, first text
52 // being the base the rest being the deltas.
57 // being the base the rest being the deltas.
53 ssize_t numtexts = Data[0];
58 ssize_t numtexts = Data[0];
54 if (numtexts < 2) {
59 if (numtexts < 2) {
55 // No point if we don't have at least a base text and a delta...
60 // No point if we don't have at least a base text and a delta...
56 return 0;
61 return 0;
57 }
62 }
58 // Each text will be described by a byte for how long it
63 // Each text will be described by a byte for how long it
59 // should be, so give up if we don't have enough.
64 // should be, so give up if we don't have enough.
60 if ((Size - 1) < (numtexts * 2)) {
65 if ((Size - 1) < (numtexts * 2)) {
61 return 0;
66 return 0;
62 }
67 }
63 size_t consumed = 1 + (numtexts * 2);
68 size_t consumed = 1 + (numtexts * 2);
64 LOG(2) << "input contains " << Size << std::endl;
69 LOG(2) << "input contains " << Size << std::endl;
65 LOG(2) << numtexts << " texts, consuming " << consumed << std::endl;
70 LOG(2) << numtexts << " texts, consuming " << consumed << std::endl;
66 std::vector<mpatchbin> bins;
71 std::vector<mpatchbin> bins;
67 bins.reserve(numtexts);
72 bins.reserve(numtexts);
68 for (int i = 0; i < numtexts; ++i) {
73 for (int i = 0; i < numtexts; ++i) {
69 mpatchbin bin;
74 mpatchbin bin;
70 size_t nthsize = getbeuint16((char *)Data + 1 + (2 * i));
75 size_t nthsize = getbeuint16((char *)Data + 1 + (2 * i));
71 LOG(2) << "text " << i << " is " << nthsize << std::endl;
76 LOG(2) << "text " << i << " is " << nthsize << std::endl;
72 char *start = (char *)Data + consumed;
77 char *start = (char *)Data + consumed;
73 consumed += nthsize;
78 consumed += nthsize;
74 if (consumed > Size) {
79 if (consumed > Size) {
75 LOG(2) << "ran out of data, consumed " << consumed
80 LOG(2) << "ran out of data, consumed " << consumed
76 << " of " << Size << std::endl;
81 << " of " << Size << std::endl;
77 return 0;
82 return 0;
78 }
83 }
79 bin.len = nthsize;
84 bin.len = nthsize;
80 bin.data.reset(new char[nthsize]);
85 bin.data.reset(new char[nthsize]);
81 memcpy(bin.data.get(), start, nthsize);
86 memcpy(bin.data.get(), start, nthsize);
82 bins.push_back(std::move(bin));
87 bins.push_back(std::move(bin));
83 }
88 }
84 LOG(2) << "mpatch_flist" << std::endl;
89 LOG(2) << "mpatch_flist" << std::endl;
85 struct mpatch_flist *patch =
90 struct mpatch_flist *patch =
86 mpatch_fold(&bins, getitem, 0, numtexts - 1);
91 mpatch_fold(&bins, getitem, 0, numtexts - 1);
87 if (!patch) {
92 if (!patch) {
88 return 0;
93 return 0;
89 }
94 }
90 LOG(2) << "mpatch_calcsize" << std::endl;
95 LOG(2) << "mpatch_calcsize" << std::endl;
91 ssize_t outlen = mpatch_calcsize(bins[0].len, patch);
96 ssize_t outlen = mpatch_calcsize(bins[0].len, patch);
92 LOG(2) << "outlen " << outlen << std::endl;
97 LOG(2) << "outlen " << outlen << std::endl;
93 if (outlen < 0 || outlen > MAX_OUTPUT_SIZE) {
98 if (outlen < 0 || outlen > MAX_OUTPUT_SIZE) {
94 goto cleanup;
99 goto cleanup;
95 }
100 }
96 {
101 {
97 char *dest = (char *)malloc(outlen);
102 char *dest = (char *)malloc(outlen);
98 LOG(2) << "expecting " << outlen << " total bytes at "
103 LOG(2) << "expecting " << outlen << " total bytes at "
99 << (void *)dest << std::endl;
104 << (void *)dest << std::endl;
100 mpatch_apply(dest, bins[0].data.get(), bins[0].len, patch);
105 mpatch_apply(dest, bins[0].data.get(), bins[0].len, patch);
101 free(dest);
106 free(dest);
102 LOG(1) << "applied a complete patch" << std::endl;
107 LOG(1) << "applied a complete patch" << std::endl;
103 }
108 }
104 cleanup:
109 cleanup:
105 mpatch_lfree(patch);
110 mpatch_lfree(patch);
106 return 0;
111 return 0;
107 }
112 }
108
113
109 #ifdef HG_FUZZER_INCLUDE_MAIN
114 #ifdef HG_FUZZER_INCLUDE_MAIN
110 int main(int argc, char **argv)
115 int main(int argc, char **argv)
111 {
116 {
112 // One text, one patch.
117 // One text, one patch.
113 const char data[] = "\x02\x00\0x1\x00\x0d"
118 const char data[] = "\x02\x00\0x1\x00\x0d"
114 // base text
119 // base text
115 "a"
120 "a"
116 // binary delta that will append a single b
121 // binary delta that will append a single b
117 "\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x01b";
122 "\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x01b";
118 return LLVMFuzzerTestOneInput((const uint8_t *)data, 19);
123 return LLVMFuzzerTestOneInput((const uint8_t *)data, 19);
119 }
124 }
120 #endif
125 #endif
121
126
122 } // extern "C"
127 } // extern "C"
@@ -1,61 +1,66 b''
1 /*
1 /*
2 * xdiff.cc - fuzzer harness for thirdparty/xdiff
2 * xdiff.cc - fuzzer harness for thirdparty/xdiff
3 *
3 *
4 * Copyright 2018, Google Inc.
4 * Copyright 2018, Google Inc.
5 *
5 *
6 * This software may be used and distributed according to the terms of
6 * This software may be used and distributed according to the terms of
7 * the GNU General Public License, incorporated herein by reference.
7 * the GNU General Public License, incorporated herein by reference.
8 */
8 */
9 #include "thirdparty/xdiff/xdiff.h"
9 #include "thirdparty/xdiff/xdiff.h"
10 #include <inttypes.h>
10 #include <inttypes.h>
11 #include <stdlib.h>
11 #include <stdlib.h>
12
12
13 #include <fuzzer/FuzzedDataProvider.h>
13 #include <fuzzer/FuzzedDataProvider.h>
14
14
15 extern "C" {
15 extern "C" {
16
16
17 int LLVMFuzzerInitialize(int *argc, char ***argv)
18 {
19 return 0;
20 }
21
17 int hunk_consumer(long a1, long a2, long b1, long b2, void *priv)
22 int hunk_consumer(long a1, long a2, long b1, long b2, void *priv)
18 {
23 {
19 // TODO: probably also test returning -1 from this when things break?
24 // TODO: probably also test returning -1 from this when things break?
20 return 0;
25 return 0;
21 }
26 }
22
27
23 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
28 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
24 {
29 {
25 // Don't allow fuzzer inputs larger than 100k, since we'll just bog
30 // Don't allow fuzzer inputs larger than 100k, since we'll just bog
26 // down and not accomplish much.
31 // down and not accomplish much.
27 if (Size > 100000) {
32 if (Size > 100000) {
28 return 0;
33 return 0;
29 }
34 }
30 FuzzedDataProvider provider(Data, Size);
35 FuzzedDataProvider provider(Data, Size);
31 std::string left = provider.ConsumeRandomLengthString(Size);
36 std::string left = provider.ConsumeRandomLengthString(Size);
32 std::string right = provider.ConsumeRemainingBytesAsString();
37 std::string right = provider.ConsumeRemainingBytesAsString();
33 mmfile_t a, b;
38 mmfile_t a, b;
34
39
35 a.ptr = (char *)left.c_str();
40 a.ptr = (char *)left.c_str();
36 a.size = left.size();
41 a.size = left.size();
37 b.ptr = (char *)right.c_str();
42 b.ptr = (char *)right.c_str();
38 b.size = right.size();
43 b.size = right.size();
39 xpparam_t xpp = {
44 xpparam_t xpp = {
40 XDF_INDENT_HEURISTIC, /* flags */
45 XDF_INDENT_HEURISTIC, /* flags */
41 };
46 };
42 xdemitconf_t xecfg = {
47 xdemitconf_t xecfg = {
43 XDL_EMIT_BDIFFHUNK, /* flags */
48 XDL_EMIT_BDIFFHUNK, /* flags */
44 hunk_consumer, /* hunk_consume_func */
49 hunk_consumer, /* hunk_consume_func */
45 };
50 };
46 xdemitcb_t ecb = {
51 xdemitcb_t ecb = {
47 NULL, /* priv */
52 NULL, /* priv */
48 };
53 };
49 xdl_diff(&a, &b, &xpp, &xecfg, &ecb);
54 xdl_diff(&a, &b, &xpp, &xecfg, &ecb);
50 return 0; // Non-zero return values are reserved for future use.
55 return 0; // Non-zero return values are reserved for future use.
51 }
56 }
52
57
53 #ifdef HG_FUZZER_INCLUDE_MAIN
58 #ifdef HG_FUZZER_INCLUDE_MAIN
54 int main(int argc, char **argv)
59 int main(int argc, char **argv)
55 {
60 {
56 const char data[] = "asdf";
61 const char data[] = "asdf";
57 return LLVMFuzzerTestOneInput((const uint8_t *)data, 4);
62 return LLVMFuzzerTestOneInput((const uint8_t *)data, 4);
58 }
63 }
59 #endif
64 #endif
60
65
61 } // extern "C"
66 } // extern "C"
General Comments 0
You need to be logged in to leave comments. Login now