Cleanup fuzzing
This commit is contained in:
+23
-37
@@ -1,54 +1,40 @@
|
||||
// Copyright (c) 2019, Paul Dreik
|
||||
// For the license information refer to format.h.
|
||||
|
||||
#include <fmt/chrono.h>
|
||||
|
||||
#include <cstdint>
|
||||
#include <type_traits>
|
||||
#include <vector>
|
||||
#include <fmt/chrono.h>
|
||||
|
||||
#include "fuzzer-common.h"
|
||||
|
||||
template <typename Item1>
|
||||
void invoke_fmt(const uint8_t* data, size_t size, unsigned int argsize) {
|
||||
static_assert(sizeof(Item1) <= fmt_fuzzer::nfixed, "nfixed too small");
|
||||
if (size <= fmt_fuzzer::nfixed) return;
|
||||
const Item1 item1 = fmt_fuzzer::assignFromBuf<Item1>(data);
|
||||
template <typename T>
|
||||
void invoke_fmt(const uint8_t* data, size_t size, unsigned arg_name_size) {
|
||||
static_assert(sizeof(T) <= fixed_size, "fixed_size too small");
|
||||
if (size <= fixed_size) return;
|
||||
const T value = assign_from_buf<T>(data);
|
||||
data += fixed_size;
|
||||
size -= fixed_size;
|
||||
|
||||
data += fmt_fuzzer::nfixed;
|
||||
size -= fmt_fuzzer::nfixed;
|
||||
|
||||
// How many chars should be used for the argument name?
|
||||
if (argsize <= 0 || argsize >= size) return;
|
||||
|
||||
#if FMT_FUZZ_SEPARATE_ALLOCATION
|
||||
std::vector<char> argnamebuffer(argsize + 1);
|
||||
std::memcpy(argnamebuffer.data(), data, argsize);
|
||||
auto argname = argnamebuffer.data();
|
||||
#else
|
||||
auto argname = fmt_fuzzer::as_chars(data);
|
||||
#endif
|
||||
data += argsize;
|
||||
size -= argsize;
|
||||
|
||||
#if FMT_FUZZ_SEPARATE_ALLOCATION
|
||||
std::vector<char> fmtstringbuffer(size);
|
||||
std::memcpy(fmtstringbuffer.data(), data, size);
|
||||
auto format_str = fmt::string_view(fmtstringbuffer.data(), size);
|
||||
#else
|
||||
auto format_str = fmt::string_view(fmt_fuzzer::as_chars(data), size);
|
||||
#endif
|
||||
if (arg_name_size <= 0 || arg_name_size >= size) return;
|
||||
data_to_string arg_name(data, arg_name_size, true);
|
||||
data += arg_name_size;
|
||||
size -= arg_name_size;
|
||||
|
||||
data_to_string format_str(data, size);
|
||||
#if FMT_FUZZ_FORMAT_TO_STRING
|
||||
std::string message = fmt::format(format_str, fmt::arg(argname, item1));
|
||||
std::string message =
|
||||
fmt::format(format_str.get(), fmt::arg(arg_name.data(), value));
|
||||
#else
|
||||
fmt::memory_buffer out;
|
||||
fmt::format_to(out, format_str, fmt::arg(argname, item1));
|
||||
fmt::format_to(out, format_str.get(), fmt::arg(arg_name.data(), value));
|
||||
#endif
|
||||
}
|
||||
|
||||
// For dynamic dispatching to an explicit instantiation.
|
||||
template <typename Callback> void invoke(int index, Callback callback) {
|
||||
switch (index) {
|
||||
template <typename Callback> void invoke(int type, Callback callback) {
|
||||
switch (type) {
|
||||
case 0:
|
||||
callback(bool());
|
||||
break;
|
||||
@@ -100,14 +86,14 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
|
||||
if (size <= 3) return 0;
|
||||
|
||||
// Switch types depending on the first byte of the input.
|
||||
const auto first = data[0] & 0x0F;
|
||||
const unsigned second = (data[0] & 0xF0) >> 4;
|
||||
const auto type = data[0] & 0x0F;
|
||||
const unsigned arg_name_size = (data[0] & 0xF0) >> 4;
|
||||
data++;
|
||||
size--;
|
||||
|
||||
try {
|
||||
invoke(first, [=](auto param1) {
|
||||
invoke_fmt<decltype(param1)>(data, size, second);
|
||||
invoke(type, [=](auto arg) {
|
||||
invoke_fmt<decltype(arg)>(data, size, arg_name_size);
|
||||
});
|
||||
} catch (std::exception&) {
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user