🚧 added MessagePack fuzz target
This commit is contained in:
		
							parent
							
								
									e4cc62e653
								
							
						
					
					
						commit
						1399abc583
					
				
					 3 changed files with 79 additions and 0 deletions
				
			
		
							
								
								
									
										8
									
								
								Makefile
									
										
									
									
									
								
							
							
						
						
									
										8
									
								
								Makefile
									
										
									
									
									
								
							| 
						 | 
					@ -62,6 +62,14 @@ fuzz_testing_cbor:
 | 
				
			||||||
	find test/data -size -5k -name *.cbor | xargs -I{} cp "{}" fuzz-testing/testcases
 | 
						find test/data -size -5k -name *.cbor | xargs -I{} cp "{}" fuzz-testing/testcases
 | 
				
			||||||
	@echo "Execute: afl-fuzz -i fuzz-testing/testcases -o fuzz-testing/out fuzz-testing/fuzzer"
 | 
						@echo "Execute: afl-fuzz -i fuzz-testing/testcases -o fuzz-testing/out fuzz-testing/fuzzer"
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
					fuzz_testing_msgpack:
 | 
				
			||||||
 | 
						rm -fr fuzz-testing
 | 
				
			||||||
 | 
						mkdir -p fuzz-testing fuzz-testing/testcases fuzz-testing/out
 | 
				
			||||||
 | 
						$(MAKE) parse_msgpack_fuzzer -C test CXX=afl-clang++
 | 
				
			||||||
 | 
						mv test/parse_msgpack_fuzzer fuzz-testing/fuzzer
 | 
				
			||||||
 | 
						find test/data -size -5k -name *.msgpack | xargs -I{} cp "{}" fuzz-testing/testcases
 | 
				
			||||||
 | 
						@echo "Execute: afl-fuzz -i fuzz-testing/testcases -o fuzz-testing/out fuzz-testing/fuzzer"
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
					
 | 
				
			||||||
##########################################################################
 | 
					##########################################################################
 | 
				
			||||||
# static analyzer
 | 
					# static analyzer
 | 
				
			||||||
| 
						 | 
					
 | 
				
			||||||
| 
						 | 
					@ -89,3 +89,6 @@ parse_afl_fuzzer:
 | 
				
			||||||
 | 
					
 | 
				
			||||||
parse_cbor_fuzzer:
 | 
					parse_cbor_fuzzer:
 | 
				
			||||||
	$(CXX) $(CXXFLAGS) $(CPPFLAGS) src/fuzzer-driver_afl.cpp src/fuzzer-parse_cbor.cpp -o $@
 | 
						$(CXX) $(CXXFLAGS) $(CPPFLAGS) src/fuzzer-driver_afl.cpp src/fuzzer-parse_cbor.cpp -o $@
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
					parse_msgpack_fuzzer:
 | 
				
			||||||
 | 
						$(CXX) $(CXXFLAGS) $(CPPFLAGS) src/fuzzer-driver_afl.cpp src/fuzzer-parse_msgpack.cpp -o $@
 | 
				
			||||||
| 
						 | 
					
 | 
				
			||||||
							
								
								
									
										68
									
								
								test/src/fuzzer-parse_msgpack.cpp
									
										
									
									
									
										Normal file
									
								
							
							
						
						
									
										68
									
								
								test/src/fuzzer-parse_msgpack.cpp
									
										
									
									
									
										Normal file
									
								
							| 
						 | 
					@ -0,0 +1,68 @@
 | 
				
			||||||
 | 
					/*
 | 
				
			||||||
 | 
					    __ _____ _____ _____
 | 
				
			||||||
 | 
					 __|  |   __|     |   | |  JSON for Modern C++ (fuzz test support)
 | 
				
			||||||
 | 
					|  |  |__   |  |  | | | |  version 2.0.9
 | 
				
			||||||
 | 
					|_____|_____|_____|_|___|  https://github.com/nlohmann/json
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
					This file implements a parser test suitable for fuzz testing. Given a byte
 | 
				
			||||||
 | 
					array data, it performs the following steps:
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
					- j1 = from_msgpack(data)
 | 
				
			||||||
 | 
					- vec = to_msgpack(j1)
 | 
				
			||||||
 | 
					- j2 = from_msgpack(vec)
 | 
				
			||||||
 | 
					- assert(j1 == j2)
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
					The provided function `LLVMFuzzerTestOneInput` can be used in different fuzzer
 | 
				
			||||||
 | 
					drivers.
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
					Licensed under the MIT License <http://opensource.org/licenses/MIT>.
 | 
				
			||||||
 | 
					*/
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
					#include <iostream>
 | 
				
			||||||
 | 
					#include <sstream>
 | 
				
			||||||
 | 
					#include <json.hpp>
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
					using json = nlohmann::json;
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
					// see http://llvm.org/docs/LibFuzzer.html
 | 
				
			||||||
 | 
					extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
 | 
				
			||||||
 | 
					{
 | 
				
			||||||
 | 
					    try
 | 
				
			||||||
 | 
					    {
 | 
				
			||||||
 | 
					        // step 1: parse input
 | 
				
			||||||
 | 
					        std::vector<uint8_t> vec1(data, data + size);
 | 
				
			||||||
 | 
					        json j1 = json::from_msgpack(vec1);
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
					        try
 | 
				
			||||||
 | 
					        {
 | 
				
			||||||
 | 
					            // step 2: round trip
 | 
				
			||||||
 | 
					            std::vector<uint8_t> vec2 = json::to_msgpack(j1);
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
					            // parse serialization
 | 
				
			||||||
 | 
					            json j2 = json::from_msgpack(vec2);
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
					            // deserializations must match
 | 
				
			||||||
 | 
					            assert(j1 == j2);
 | 
				
			||||||
 | 
					        }
 | 
				
			||||||
 | 
					        catch (const std::invalid_argument&)
 | 
				
			||||||
 | 
					        {
 | 
				
			||||||
 | 
					            // parsing a MessagePack serialization must not fail
 | 
				
			||||||
 | 
					            assert(false);
 | 
				
			||||||
 | 
					        }
 | 
				
			||||||
 | 
					    }
 | 
				
			||||||
 | 
					    catch (const std::invalid_argument&)
 | 
				
			||||||
 | 
					    {
 | 
				
			||||||
 | 
					        // parse errors are ok, because input may be random bytes
 | 
				
			||||||
 | 
					    }
 | 
				
			||||||
 | 
					    catch (const std::out_of_range&)
 | 
				
			||||||
 | 
					    {
 | 
				
			||||||
 | 
					        // parse errors are ok, because input may be random bytes
 | 
				
			||||||
 | 
					    }
 | 
				
			||||||
 | 
					    catch (const std::domain_error&)
 | 
				
			||||||
 | 
					    {
 | 
				
			||||||
 | 
					        // parse errors are ok, because input may be random bytes
 | 
				
			||||||
 | 
					    }
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
					    // return 0 - non-zero return values are reserved for future use
 | 
				
			||||||
 | 
					    return 0;
 | 
				
			||||||
 | 
					}
 | 
				
			||||||
		Loading…
	
	Add table
		Add a link
		
	
		Reference in a new issue