123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127 |
- // Copyright 2018 The Chromium Authors. All rights reserved.
- // Use of this source code is governed by a BSD-style license that can be
- // found in the LICENSE file.
- #include <fuzzer/FuzzedDataProvider.h>
- #include <tuple>
- #include "base/pickle.h"
- namespace {
- constexpr int kIterations = 16;
- constexpr int kReadControlBytes = 32;
- constexpr int kReadDataTypes = 17;
- constexpr int kMaxReadLength = 1024;
- constexpr int kMaxSkipBytes = 1024;
- } // namespace
- extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
- if (size < kReadControlBytes) {
- return 0;
- }
- // Use the first kReadControlBytes bytes of the fuzzer input to control how
- // the pickled data is read.
- FuzzedDataProvider data_provider(data, kReadControlBytes);
- data += kReadControlBytes;
- size -= kReadControlBytes;
- base::Pickle pickle(reinterpret_cast<const char*>(data), size);
- base::PickleIterator iter(pickle);
- for (int i = 0; i < kIterations; i++) {
- uint8_t read_type = data_provider.ConsumeIntegral<uint8_t>();
- switch (read_type % kReadDataTypes) {
- case 0: {
- bool result = 0;
- std::ignore = iter.ReadBool(&result);
- break;
- }
- case 1: {
- int result = 0;
- std::ignore = iter.ReadInt(&result);
- break;
- }
- case 2: {
- long result = 0;
- std::ignore = iter.ReadLong(&result);
- break;
- }
- case 3: {
- uint16_t result = 0;
- std::ignore = iter.ReadUInt16(&result);
- break;
- }
- case 4: {
- uint32_t result = 0;
- std::ignore = iter.ReadUInt32(&result);
- break;
- }
- case 5: {
- int64_t result = 0;
- std::ignore = iter.ReadInt64(&result);
- break;
- }
- case 6: {
- uint64_t result = 0;
- std::ignore = iter.ReadUInt64(&result);
- break;
- }
- case 7: {
- float result = 0;
- std::ignore = iter.ReadFloat(&result);
- break;
- }
- case 8: {
- double result = 0;
- std::ignore = iter.ReadDouble(&result);
- break;
- }
- case 9: {
- std::string result;
- std::ignore = iter.ReadString(&result);
- break;
- }
- case 10: {
- base::StringPiece result;
- std::ignore = iter.ReadStringPiece(&result);
- break;
- }
- case 11: {
- std::u16string result;
- std::ignore = iter.ReadString16(&result);
- break;
- }
- case 12: {
- base::StringPiece16 result;
- std::ignore = iter.ReadStringPiece16(&result);
- break;
- }
- case 13: {
- const char* data_result = nullptr;
- size_t length_result = 0;
- std::ignore = iter.ReadData(&data_result, &length_result);
- break;
- }
- case 14: {
- const char* data_result = nullptr;
- int read_length =
- data_provider.ConsumeIntegralInRange(0, kMaxReadLength);
- std::ignore =
- iter.ReadBytes(&data_result, static_cast<size_t>(read_length));
- break;
- }
- case 15: {
- size_t result = 0;
- std::ignore = iter.ReadLength(&result);
- break;
- }
- case 16: {
- std::ignore = iter.SkipBytes(static_cast<size_t>(
- data_provider.ConsumeIntegralInRange(0, kMaxSkipBytes)));
- break;
- }
- }
- }
- return 0;
- }
|