diff options
author | Kostya Serebryany <kcc@google.com> | 2019-04-30 22:05:55 +0000 |
---|---|---|
committer | Kostya Serebryany <kcc@google.com> | 2019-04-30 22:05:55 +0000 |
commit | eccb4157048ca84adb8557118e502978cb20d1b9 (patch) | |
tree | f9db7690de98e9eadcc0a76b264579f6201b8f1b | |
parent | 56d59bd9cdbd18d00d2b487812e19ff7302201c7 (diff) | |
download | compiler-rt-eccb4157048ca84adb8557118e502978cb20d1b9.tar.gz |
[libFuzzer] add MagicSeparatorTest
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@359620 91177308-0d34-0410-b5e6-96231b3b80d8
-rw-r--r-- | test/fuzzer/MagicSeparatorTest.cpp | 49 | ||||
-rw-r--r-- | test/fuzzer/magic-separator.test | 2 |
2 files changed, 51 insertions, 0 deletions
diff --git a/test/fuzzer/MagicSeparatorTest.cpp b/test/fuzzer/MagicSeparatorTest.cpp new file mode 100644 index 000000000..2c0fbc90c --- /dev/null +++ b/test/fuzzer/MagicSeparatorTest.cpp @@ -0,0 +1,49 @@ +// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. +// See https://llvm.org/LICENSE.txt for license information. +// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception + +// Simple test for a fuzzer. +// This is a sample fuzz target for a custom serialization format that uses +// a magic separator to split the input into several independent buffers. +// The fuzzer must find the input consisting of 2 subinputs: "Fuzz" and "me". +#include <cassert> +#include <cstdint> +#include <cstdio> +#include <cstdlib> +#include <cstring> + +#include <algorithm> +#include <vector> + +// Splits [data,data+size) into a vector of strings using a "magic" Separator. +std::vector<std::vector<uint8_t>> SplitInput(const uint8_t *Data, size_t Size, + const uint8_t *Separator, + size_t SeparatorSize) { + std::vector<std::vector<uint8_t>> Res; + assert(SeparatorSize > 0); + auto Beg = Data; + auto End = Data + Size; + // Using memmem here. std::search may be harder for libFuzzer today. + while (const uint8_t *Pos = (const uint8_t *)memmem(Beg, End - Beg, + Separator, SeparatorSize)) { + Res.push_back({Beg, Pos}); + Beg = Pos + SeparatorSize; + } + if (Beg < End) + Res.push_back({Beg, End}); + return Res; +} + +static volatile int *Nil = nullptr; + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + if (Size > 10) return 0; // To make the test quick. + const uint8_t Separator[] = {0xDE, 0xAD, 0xBE, 0xEF}; + auto Inputs = SplitInput(Data, Size, Separator, sizeof(Separator)); + std::vector<uint8_t> Fuzz({'F', 'u', 'z', 'z'}); + std::vector<uint8_t> Me({'m', 'e'}); + if (Inputs.size() == 2 && Inputs[0] == Fuzz && Inputs[1] == Me) + *Nil = 42; // crash. + return 0; +} + diff --git a/test/fuzzer/magic-separator.test b/test/fuzzer/magic-separator.test new file mode 100644 index 000000000..eef671e70 --- /dev/null +++ b/test/fuzzer/magic-separator.test @@ -0,0 +1,2 @@ +RUN: %cpp_compiler -O2 %S/MagicSeparatorTest.cpp -o %t-MagicSeparatorTest +RUN: not %run %t-MagicSeparatorTest -use_value_profile=1 -seed=1 -runs=100000000 -max_len=10 |