🚧 added MessagePack fuzz target
This commit is contained in:
		
							parent
							
								
									e4cc62e653
								
							
						
					
					
						commit
						1399abc583
					
				
					 3 changed files with 79 additions and 0 deletions
				
			
		
							
								
								
									
										8
									
								
								Makefile
									
										
									
									
									
								
							
							
						
						
									
										8
									
								
								Makefile
									
										
									
									
									
								
							|  | @ -62,6 +62,14 @@ fuzz_testing_cbor: | ||||||
| 	find test/data -size -5k -name *.cbor | xargs -I{} cp "{}" fuzz-testing/testcases | 	find test/data -size -5k -name *.cbor | xargs -I{} cp "{}" fuzz-testing/testcases | ||||||
| 	@echo "Execute: afl-fuzz -i fuzz-testing/testcases -o fuzz-testing/out fuzz-testing/fuzzer" | 	@echo "Execute: afl-fuzz -i fuzz-testing/testcases -o fuzz-testing/out fuzz-testing/fuzzer" | ||||||
| 
 | 
 | ||||||
|  | fuzz_testing_msgpack: | ||||||
|  | 	rm -fr fuzz-testing | ||||||
|  | 	mkdir -p fuzz-testing fuzz-testing/testcases fuzz-testing/out | ||||||
|  | 	$(MAKE) parse_msgpack_fuzzer -C test CXX=afl-clang++ | ||||||
|  | 	mv test/parse_msgpack_fuzzer fuzz-testing/fuzzer | ||||||
|  | 	find test/data -size -5k -name *.msgpack | xargs -I{} cp "{}" fuzz-testing/testcases | ||||||
|  | 	@echo "Execute: afl-fuzz -i fuzz-testing/testcases -o fuzz-testing/out fuzz-testing/fuzzer" | ||||||
|  | 
 | ||||||
| 
 | 
 | ||||||
| ##########################################################################
 | ##########################################################################
 | ||||||
| # static analyzer
 | # static analyzer
 | ||||||
|  |  | ||||||
|  | @ -89,3 +89,6 @@ parse_afl_fuzzer: | ||||||
| 
 | 
 | ||||||
| parse_cbor_fuzzer: | parse_cbor_fuzzer: | ||||||
| 	$(CXX) $(CXXFLAGS) $(CPPFLAGS) src/fuzzer-driver_afl.cpp src/fuzzer-parse_cbor.cpp -o $@ | 	$(CXX) $(CXXFLAGS) $(CPPFLAGS) src/fuzzer-driver_afl.cpp src/fuzzer-parse_cbor.cpp -o $@ | ||||||
|  | 
 | ||||||
|  | parse_msgpack_fuzzer: | ||||||
|  | 	$(CXX) $(CXXFLAGS) $(CPPFLAGS) src/fuzzer-driver_afl.cpp src/fuzzer-parse_msgpack.cpp -o $@ | ||||||
|  |  | ||||||
							
								
								
									
										68
									
								
								test/src/fuzzer-parse_msgpack.cpp
									
										
									
									
									
										Normal file
									
								
							
							
						
						
									
										68
									
								
								test/src/fuzzer-parse_msgpack.cpp
									
										
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,68 @@ | ||||||
|  | /*
 | ||||||
|  |     __ _____ _____ _____ | ||||||
|  |  __|  |   __|     |   | |  JSON for Modern C++ (fuzz test support) | ||||||
|  | |  |  |__   |  |  | | | |  version 2.0.9 | ||||||
|  | |_____|_____|_____|_|___|  https://github.com/nlohmann/json
 | ||||||
|  | 
 | ||||||
|  | This file implements a parser test suitable for fuzz testing. Given a byte | ||||||
|  | array data, it performs the following steps: | ||||||
|  | 
 | ||||||
|  | - j1 = from_msgpack(data) | ||||||
|  | - vec = to_msgpack(j1) | ||||||
|  | - j2 = from_msgpack(vec) | ||||||
|  | - assert(j1 == j2) | ||||||
|  | 
 | ||||||
|  | The provided function `LLVMFuzzerTestOneInput` can be used in different fuzzer | ||||||
|  | drivers. | ||||||
|  | 
 | ||||||
|  | Licensed under the MIT License <http://opensource.org/licenses/MIT>.
 | ||||||
|  | */ | ||||||
|  | 
 | ||||||
|  | #include <iostream> | ||||||
|  | #include <sstream> | ||||||
|  | #include <json.hpp> | ||||||
|  | 
 | ||||||
|  | using json = nlohmann::json; | ||||||
|  | 
 | ||||||
|  | // see http://llvm.org/docs/LibFuzzer.html
 | ||||||
|  | extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) | ||||||
|  | { | ||||||
|  |     try | ||||||
|  |     { | ||||||
|  |         // step 1: parse input
 | ||||||
|  |         std::vector<uint8_t> vec1(data, data + size); | ||||||
|  |         json j1 = json::from_msgpack(vec1); | ||||||
|  | 
 | ||||||
|  |         try | ||||||
|  |         { | ||||||
|  |             // step 2: round trip
 | ||||||
|  |             std::vector<uint8_t> vec2 = json::to_msgpack(j1); | ||||||
|  | 
 | ||||||
|  |             // parse serialization
 | ||||||
|  |             json j2 = json::from_msgpack(vec2); | ||||||
|  | 
 | ||||||
|  |             // deserializations must match
 | ||||||
|  |             assert(j1 == j2); | ||||||
|  |         } | ||||||
|  |         catch (const std::invalid_argument&) | ||||||
|  |         { | ||||||
|  |             // parsing a MessagePack serialization must not fail
 | ||||||
|  |             assert(false); | ||||||
|  |         } | ||||||
|  |     } | ||||||
|  |     catch (const std::invalid_argument&) | ||||||
|  |     { | ||||||
|  |         // parse errors are ok, because input may be random bytes
 | ||||||
|  |     } | ||||||
|  |     catch (const std::out_of_range&) | ||||||
|  |     { | ||||||
|  |         // parse errors are ok, because input may be random bytes
 | ||||||
|  |     } | ||||||
|  |     catch (const std::domain_error&) | ||||||
|  |     { | ||||||
|  |         // parse errors are ok, because input may be random bytes
 | ||||||
|  |     } | ||||||
|  | 
 | ||||||
|  |     // return 0 - non-zero return values are reserved for future use
 | ||||||
|  |     return 0; | ||||||
|  | } | ||||||
		Loading…
	
	Add table
		Add a link
		
	
		Reference in a new issue