Mercurial > hg
view contrib/fuzz/mpatch.cc @ 42678:f95b59ffc307
byteify-strings: add --treat-as-kwargs argument to handle kwargs-like objects
This argument will help extensions move to Python 3 as keyword arguments
should not be byte-prefixed. Most of the time, code bases will call this
object `kwargs`, but other conventions exist like `opts`, so it should make
sense to allow for custom names.
This is a best effort solution that does minimal static checking; cases like
`options = [o for o in ('a', 'b', 'c') if kwargs.get(o)]`
and other just as complicated will not be detected.
author | Raphaël Gomès <rgomes@octobus.net> |
---|---|
date | Fri, 02 Aug 2019 10:18:22 +0200 |
parents | 46dcb9f14900 |
children | 51a99e09c54b |
line wrap: on
line source
/* * mpatch.cc - fuzzer harness for mpatch.c * * Copyright 2018, Google Inc. * * This software may be used and distributed according to the terms of * the GNU General Public License, incorporated herein by reference. */ #include <iostream> #include <memory> #include <stdint.h> #include <stdlib.h> #include <vector> #include "fuzzutil.h" // To avoid having too many OOMs from the fuzzer infrastructure, we'll // skip patch application if the resulting fulltext would be bigger // than 10MiB. #define MAX_OUTPUT_SIZE 10485760 extern "C" { #include "bitmanipulation.h" #include "mpatch.h" struct mpatchbin { std::unique_ptr<char[]> data; size_t len; }; static mpatch_flist *getitem(void *vbins, ssize_t pos) { std::vector<mpatchbin> *bins = (std::vector<mpatchbin> *)vbins; const mpatchbin &bin = bins->at(pos + 1); struct mpatch_flist *res; LOG(2) << "mpatch_decode " << bin.len << std::endl; if (mpatch_decode(bin.data.get(), bin.len, &res) < 0) return NULL; return res; } // input format: // u8 number of inputs // one u16 for each input, its length // the inputs int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { if (!Size) { return 0; } // First byte of data is how many texts we expect, first text // being the base the rest being the deltas. ssize_t numtexts = Data[0]; if (numtexts < 2) { // No point if we don't have at least a base text and a delta... return 0; } // Each text will be described by a byte for how long it // should be, so give up if we don't have enough. if ((Size - 1) < (numtexts * 2)) { return 0; } size_t consumed = 1 + (numtexts * 2); LOG(2) << "input contains " << Size << std::endl; LOG(2) << numtexts << " texts, consuming " << consumed << std::endl; std::vector<mpatchbin> bins; bins.reserve(numtexts); for (int i = 0; i < numtexts; ++i) { mpatchbin bin; size_t nthsize = getbeuint16((char *)Data + 1 + (2 * i)); LOG(2) << "text " << i << " is " << nthsize << std::endl; char *start = (char *)Data + consumed; consumed += nthsize; if (consumed > Size) { LOG(2) << "ran out of data, consumed " << consumed << " of " << Size << std::endl; return 0; } bin.len = nthsize; bin.data.reset(new char[nthsize]); memcpy(bin.data.get(), start, nthsize); bins.push_back(std::move(bin)); } LOG(2) << "mpatch_flist" << std::endl; struct mpatch_flist *patch = mpatch_fold(&bins, getitem, 0, numtexts - 1); if (!patch) { return 0; } LOG(2) << "mpatch_calcsize" << std::endl; ssize_t outlen = mpatch_calcsize(bins[0].len, patch); LOG(2) << "outlen " << outlen << std::endl; if (outlen < 0 || outlen > MAX_OUTPUT_SIZE) { goto cleanup; } { char *dest = (char *)malloc(outlen); LOG(2) << "expecting " << outlen << " total bytes at " << (void *)dest << std::endl; mpatch_apply(dest, bins[0].data.get(), bins[0].len, patch); free(dest); LOG(1) << "applied a complete patch" << std::endl; } cleanup: mpatch_lfree(patch); return 0; } #ifdef HG_FUZZER_INCLUDE_MAIN int main(int argc, char **argv) { // One text, one patch. const char data[] = "\x02\x00\0x1\x00\x0d" // base text "a" // binary delta that will append a single b "\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x01b"; return LLVMFuzzerTestOneInput((const uint8_t *)data, 19); } #endif } // extern "C"