This is an archive of the discontinued Mercurial Phabricator instance.

Differential D2632

fuzz: add a fuzzer for xdiff
ClosedPublic

Authored by durin42 on Mar 3 2018, 10:12 PM.

Details

Reviewers
indygreg
Group Reviewers
hg-reviewers
Commits
rHG624cbd1477a6: fuzz: add a fuzzer for xdiff
rHG38a81b88688b: fuzz: add a fuzzer for xdiff
Summary

Based entirely on the fuzzer for bdiff.

Diff Detail

Repository
rHG Mercurial
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

durin42 created this revision.Mar 3 2018, 10:12 PM
indygreg accepted this revision.Mar 3 2018, 10:20 PM
This revision is now accepted and ready to land.Mar 3 2018, 10:20 PM
Closed by commit rHG38a81b88688b: fuzz: add a fuzzer for xdiff (authored by durin42). · Explain WhyMar 3 2018, 10:24 PM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathPackages
Mcontrib/fuzz/Makefile (24 lines)
AMcontrib/fuzz/xdiff.cc (67 lines)

Diff 6533

contrib/fuzz/Makefile

bdiff.o: ../../mercurial/bdiff.c bdiff.o: ../../mercurial/bdiff.c
clang -g -O1 -fsanitize=fuzzer-no-link,address -c -o bdiff.o \ clang -g -O1 -fsanitize=fuzzer-no-link,address -c -o bdiff.o \
../../mercurial/bdiff.c ../../mercurial/bdiff.c
bdiff: bdiff.cc bdiff.o bdiff: bdiff.cc bdiff.o
clang -DHG_FUZZER_INCLUDE_MAIN=1 -g -O1 -fsanitize=fuzzer-no-link,address \ clang -DHG_FUZZER_INCLUDE_MAIN=1 -g -O1 -fsanitize=fuzzer-no-link,address \
-I../../mercurial bdiff.cc bdiff.o -o bdiff -I../../mercurial bdiff.cc bdiff.o -o bdiff
bdiff-oss-fuzz.o: ../../mercurial/bdiff.c bdiff-oss-fuzz.o: ../../mercurial/bdiff.c
$$CC $$CFLAGS -c -o bdiff-oss-fuzz.o ../../mercurial/bdiff.c $$CC $$CFLAGS -c -o bdiff-oss-fuzz.o ../../mercurial/bdiff.c
bdiff_fuzzer: bdiff.cc bdiff-oss-fuzz.o bdiff_fuzzer: bdiff.cc bdiff-oss-fuzz.o
$$CXX $$CXXFLAGS -std=c++11 -I../../mercurial bdiff.cc \ $$CXX $$CXXFLAGS -std=c++11 -I../../mercurial bdiff.cc \
bdiff-oss-fuzz.o -lFuzzingEngine -o $$OUT/bdiff_fuzzer bdiff-oss-fuzz.o -lFuzzingEngine -o $$OUT/bdiff_fuzzer
all: bdiff x%.o: ../../mercurial/thirdparty/xdiff/x%.c ../../mercurial/thirdparty/xdiff/*.h
clang -g -O1 -fsanitize=fuzzer-no-link,address -c \
-o $@ \
$<
oss-fuzz: bdiff_fuzzer xdiff: xdiff.cc xdiffi.o xemit.o xmerge.o xprepare.o xutils.o
clang -DHG_FUZZER_INCLUDE_MAIN=1 -g -O1 -fsanitize=fuzzer-no-link,address \
-I../../mercurial xdiff.cc \
xdiffi.o xemit.o xmerge.o xprepare.o xutils.o -o xdiff
fuzz-x%.o: ../../mercurial/thirdparty/xdiff/x%.c ../../mercurial/thirdparty/xdiff/*.h
$$CC $$CFLAGS -c \
-o $@ \
$<
xdiff_fuzzer: xdiff.cc fuzz-xdiffi.o fuzz-xemit.o fuzz-xmerge.o fuzz-xprepare.o fuzz-xutils.o
$$CXX $$CXXFLAGS -std=c++11 -I../../mercurial xdiff.cc \
fuzz-xdiffi.o fuzz-xemit.o fuzz-xmerge.o fuzz-xprepare.o fuzz-xutils.o \
-lFuzzingEngine -o $$OUT/xdiff_fuzzer
all: bdiff xdiff
oss-fuzz: bdiff_fuzzer xdiff_fuzzer
.PHONY: all oss-fuzz .PHONY: all oss-fuzz

contrib/fuzz/xdiff.cc

  • This file was added.
/*
* xdiff.cc - fuzzer harness for thirdparty/xdiff
*
* Copyright 2018, Google Inc.
*
* This software may be used and distributed according to the terms of
* the GNU General Public License, incorporated herein by reference.
*/
#include "thirdparty/xdiff/xdiff.h"
#include <inttypes.h>
#include <stdlib.h>
extern "C" {
int hunk_consumer(long a1, long a2, long b1, long b2, void *priv)
{
// TODO: probably also test returning -1 from this when things break?
return 0;
}
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
{
if (!Size) {
return 0;
}
// figure out a random point in [0, Size] to split our input.
size_t split = Data[0] / 255.0 * Size;
mmfile_t a, b;
// `a` input to diff is data[1:split]
a.ptr = (char *)Data + 1;
// which has len split-1
a.size = split - 1;
// `b` starts at the next byte after `a` ends
b.ptr = a.ptr + a.size;
b.size = Size - split;
xpparam_t xpp = {
XDF_INDENT_HEURISTIC, /* flags */
NULL, /* anchors */
0, /* anchors_nr */
};
xdemitconf_t xecfg = {
0, /* ctxlen */
0, /* interhunkctxlen */
XDL_EMIT_BDIFFHUNK, /* flags */
NULL, /* find_func */
NULL, /* find_func_priv */
hunk_consumer, /* hunk_consume_func */
};
xdemitcb_t ecb = {
NULL, /* priv */
NULL, /* outf */
};
xdl_diff(&a, &b, &xpp, &xecfg, &ecb);
return 0; // Non-zero return values are reserved for future use.
}
#ifdef HG_FUZZER_INCLUDE_MAIN
int main(int argc, char **argv)
{
const char data[] = "asdf";
return LLVMFuzzerTestOneInput((const uint8_t *)data, 4);
}
#endif
} // extern "C"