leavelet/fmt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Cleanup fuzzing

Browse Source
This commit is contained in:
Victor Zverovich
2020-10-13 09:08:04 -07:00
parent 63e40c9614
commit 82c4e2236a
6 changed files with 126 additions and 153 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/fuzzing/one-arg.cc
+20 -48
View File
@@ -2,63 +2,35 @@
// For the license information refer to format.h.
#include <cstdint>
#include <stdexcept>
#include <type_traits>
#include <vector>
#include <exception>
#include <fmt/chrono.h>
#include "fuzzer-common.h"
using fmt_fuzzer::nfixed;
template <typename T, typename Repr>
const T* from_repr(const Repr& r) { return &r; }
template <typename Item>
void invoke_fmt(const uint8_t* data, size_t size) {
constexpr auto N = sizeof(Item);
static_assert(N <= nfixed, "Nfixed is too small");
if (size <= nfixed) return;
const Item item = fmt_fuzzer::assignFromBuf<Item>(data);
data += nfixed;
size -= nfixed;
#if FMT_FUZZ_SEPARATE_ALLOCATION
std::vector<char> fmtstringbuffer(size);
std::memcpy(fmtstringbuffer.data(), data, size);
auto format_str = fmt::string_view(fmtstringbuffer.data(), size);
#else
auto format_str = fmt::string_view(fmt_fuzzer::as_chars(data), size);
#endif
#if FMT_FUZZ_FORMAT_TO_STRING
std::string message = fmt::format(format_str, item);
#else
fmt::memory_buffer message;
fmt::format_to(message, format_str, item);
#endif
template <>
const std::tm* from_repr<std::tm>(const std::time_t& t) {
return std::localtime(&t);
}
void invoke_fmt_time(const uint8_t* data, size_t size) {
using Item = std::time_t;
static_assert(sizeof(Item) <= nfixed, "Nfixed too small");
if (size <= nfixed) return;
const Item item = fmt_fuzzer::assignFromBuf<Item>(data);
data += nfixed;
size -= nfixed;
#if FMT_FUZZ_SEPARATE_ALLOCATION
std::vector<char> fmtstringbuffer(size);
std::memcpy(fmtstringbuffer.data(), data, size);
auto format_str = fmt::string_view(fmtstringbuffer.data(), size);
#else
auto format_str = fmt::string_view(fmt_fuzzer::as_chars(data), size);
#endif
auto* b = std::localtime(&item);
if (b) {
template <typename T, typename Repr = T>
void invoke_fmt(const uint8_t* data, size_t size) {
static_assert(sizeof(Repr) <= fixed_size, "Nfixed is too small");
if (size <= fixed_size) return;
auto repr = assign_from_buf<Repr>(data);
const T* value = from_repr<T>(repr);
if (!value) return;
data += fixed_size;
size -= fixed_size;
data_to_string format_str(data, size);
#if FMT_FUZZ_FORMAT_TO_STRING
std::string message = fmt::format(format_str, *b);
std::string message = fmt::format(format_str.get(), *value);
#else
fmt::memory_buffer message;
fmt::format_to(message, format_str, *b);
fmt::memory_buffer message;
fmt::format_to(message, format_str.get(), *value);
#endif
}
}
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
@@ -110,7 +82,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
invoke_fmt<long double>(data, size);
break;
case 13:
invoke_fmt_time(data, size);
invoke_fmt<std::tm, std::time_t>(data, size);
break;
default:
break;