Cleanup fuzzing

This commit is contained in:
Victor Zverovich
2020-10-13 09:08:04 -07:00
parent 63e40c9614
commit 82c4e2236a
6 changed files with 126 additions and 153 deletions
+23 -37
View File
@@ -1,54 +1,40 @@
// Copyright (c) 2019, Paul Dreik
// For the license information refer to format.h.
#include <fmt/chrono.h>
#include <cstdint>
#include <type_traits>
#include <vector>
#include <fmt/chrono.h>
#include "fuzzer-common.h"
template <typename Item1>
void invoke_fmt(const uint8_t* data, size_t size, unsigned int argsize) {
static_assert(sizeof(Item1) <= fmt_fuzzer::nfixed, "nfixed too small");
if (size <= fmt_fuzzer::nfixed) return;
const Item1 item1 = fmt_fuzzer::assignFromBuf<Item1>(data);
template <typename T>
void invoke_fmt(const uint8_t* data, size_t size, unsigned arg_name_size) {
static_assert(sizeof(T) <= fixed_size, "fixed_size too small");
if (size <= fixed_size) return;
const T value = assign_from_buf<T>(data);
data += fixed_size;
size -= fixed_size;
data += fmt_fuzzer::nfixed;
size -= fmt_fuzzer::nfixed;
// How many chars should be used for the argument name?
if (argsize <= 0 || argsize >= size) return;
#if FMT_FUZZ_SEPARATE_ALLOCATION
std::vector<char> argnamebuffer(argsize + 1);
std::memcpy(argnamebuffer.data(), data, argsize);
auto argname = argnamebuffer.data();
#else
auto argname = fmt_fuzzer::as_chars(data);
#endif
data += argsize;
size -= argsize;
#if FMT_FUZZ_SEPARATE_ALLOCATION
std::vector<char> fmtstringbuffer(size);
std::memcpy(fmtstringbuffer.data(), data, size);
auto format_str = fmt::string_view(fmtstringbuffer.data(), size);
#else
auto format_str = fmt::string_view(fmt_fuzzer::as_chars(data), size);
#endif
if (arg_name_size <= 0 || arg_name_size >= size) return;
data_to_string arg_name(data, arg_name_size, true);
data += arg_name_size;
size -= arg_name_size;
data_to_string format_str(data, size);
#if FMT_FUZZ_FORMAT_TO_STRING
std::string message = fmt::format(format_str, fmt::arg(argname, item1));
std::string message =
fmt::format(format_str.get(), fmt::arg(arg_name.data(), value));
#else
fmt::memory_buffer out;
fmt::format_to(out, format_str, fmt::arg(argname, item1));
fmt::format_to(out, format_str.get(), fmt::arg(arg_name.data(), value));
#endif
}
// For dynamic dispatching to an explicit instantiation.
template <typename Callback> void invoke(int index, Callback callback) {
switch (index) {
template <typename Callback> void invoke(int type, Callback callback) {
switch (type) {
case 0:
callback(bool());
break;
@@ -100,14 +86,14 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
if (size <= 3) return 0;
// Switch types depending on the first byte of the input.
const auto first = data[0] & 0x0F;
const unsigned second = (data[0] & 0xF0) >> 4;
const auto type = data[0] & 0x0F;
const unsigned arg_name_size = (data[0] & 0xF0) >> 4;
data++;
size--;
try {
invoke(first, [=](auto param1) {
invoke_fmt<decltype(param1)>(data, size, second);
invoke(type, [=](auto arg) {
invoke_fmt<decltype(arg)>(data, size, arg_name_size);
});
} catch (std::exception&) {
}