upstream/mercurial-mirror Files · contrib/fuzz/bdiff.cc

dirs: resolve fuzzer OOM situation by disallowing deep directory hierarchies...

dirs: resolve fuzzer OOM situation by disallowing deep directory hierarchies It seems like 2048 directories ought to be enough for any reasonable use of Mercurial? A previous version of this patch scanned for slashes before any allocations occurred. That approach is slower than this in the happy path, but much faster than this in the case that too many slashes are encountered. We may want to revisit it in the future using memchr() so it'll be well-optimized by the libc we're using. .. bc: Mercurial will now defend against OOMs by refusing to operate on paths with 2048 or more components. This means that _extremely_ deep path hierarchies will be rejected, but we anticipate nobody is using hierarchies this deep. Differential Revision: https://phab.mercurial-scm.org/D7411

Augie Fackler - - Load All Authors

File last commit:

r44011:dbc39f02 default


                r44057:0796e266

default

Download file

             bdiff.cc
        
                    42 lines
            
             | 1.0 KiB
            
                | text/x-c
            
             |
                CppLexer
            
             / contrib / fuzz / bdiff.cc
          
                    History
                
                 |
                  Annotation
                 | Raw
                 |Copy content
                 |Copy permalink

      /*

       * bdiff.cc - fuzzer harness for bdiff.c

       *

       * Copyright 2018, Google Inc.

       *

       * This software may be used and distributed according to the terms of

       * the GNU General Public License, incorporated herein by reference.

       */

      #include <memory>

      #include <stdlib.h>

      #include <fuzzer/FuzzedDataProvider.h>

      extern "C" {

      #include "bdiff.h"

      int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)

      {

      	FuzzedDataProvider provider(Data, Size);

      	std::string left = provider.ConsumeRandomLengthString(Size);

      	std::string right = provider.ConsumeRemainingBytesAsString();

      	struct bdiff_line *a, *b;

      	int an = bdiff_splitlines(left.c_str(), left.size(), &a);

      	int bn = bdiff_splitlines(right.c_str(), right.size(), &b);

      	struct bdiff_hunk l;

      	bdiff_diff(a, an, b, bn, &l);

      	free(a);

      	free(b);

      	bdiff_freehunks(l.next);

      	return 0; // Non-zero return values are reserved for future use.

      }

      #ifdef HG_FUZZER_INCLUDE_MAIN

      int main(int argc, char **argv)

      {

      	const char data[] = "asdf";

      	return LLVMFuzzerTestOneInput((const uint8_t *)data, 4);

      }

      #endif

      } // extern "C"

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages

				/*
				* bdiff.cc - fuzzer harness for bdiff.c
				*
				* Copyright 2018, Google Inc.
				*
				* This software may be used and distributed according to the terms of
				* the GNU General Public License, incorporated herein by reference.
				*/
				#include <memory>
				#include <stdlib.h>

				#include <fuzzer/FuzzedDataProvider.h>

				extern "C" {
				#include "bdiff.h"

				int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
				{
				FuzzedDataProvider provider(Data, Size);
				std::string left = provider.ConsumeRandomLengthString(Size);
				std::string right = provider.ConsumeRemainingBytesAsString();

				struct bdiff_line a, b;
				int an = bdiff_splitlines(left.c_str(), left.size(), &a);
				int bn = bdiff_splitlines(right.c_str(), right.size(), &b);
				struct bdiff_hunk l;
				bdiff_diff(a, an, b, bn, &l);
				free(a);
				free(b);
				bdiff_freehunks(l.next);
				return 0; // Non-zero return values are reserved for future use.
				}

				#ifdef HG_FUZZER_INCLUDE_MAIN
				int main(int argc, char **argv)
				{
				const char data[] = "asdf";
				return LLVMFuzzerTestOneInput((const uint8_t *)data, 4);
				}
				#endif

				} // extern "C"