This is an archive of the discontinued Mercurial Phabricator instance.

Differential D7370

fuzz: clean out most of fuzzutil
ClosedPublic

Authored by durin42 on Nov 11 2019, 5:02 PM.

Details

Reviewers
indygreg
Group Reviewers
hg-reviewers
Commits
rHG6f5c352f41b6: fuzz: clean out most of fuzzutil
Summary

It's now a header-only setup that just selects absl:: or std::
versions of things as needed, and a logging helper. There's some room
for future cleanups here: we could move to just requiring a C++17
compiler and get rid of the absl stuff. Also, the mpatch parser has a
fair amount of parsing the input string into char* blocks that we can
and probably should fix that up to use FuzzedDataProvider as well.

Diff Detail

Repository
rHG Mercurial
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

durin42 created this revision.Nov 11 2019, 5:02 PM
indygreg accepted this revision.Nov 11 2019, 10:01 PM
This revision is now accepted and ready to land.Nov 11 2019, 10:01 PM
durin42 added a commit: rHG6f5c352f41b6: fuzz: clean out most of fuzzutil.Nov 11 2019, 10:03 PM
Closed by commit rHG6f5c352f41b6: fuzz: clean out most of fuzzutil (authored by durin42). · Explain Why
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathPackages
Mcontrib/fuzz/Makefile (33 lines)
Mcontrib/fuzz/fuzzutil.h (10 lines)
DMcontrib/fuzz/fuzzutil.cc (27 lines)

Diff 18037

contrib/fuzz/Makefile

CC = clang CC = clang
CXX = clang++ CXX = clang++
all: bdiff mpatch xdiff all: bdiff mpatch xdiff
fuzzutil.o: fuzzutil.cc fuzzutil.h
$(CXX) $(CXXFLAGS) -g -O1 \
-std=c++17 \
-I../../mercurial -c -o fuzzutil.o fuzzutil.cc
fuzzutil-oss-fuzz.o: fuzzutil.cc fuzzutil.h
$(CXX) $(CXXFLAGS) -std=c++17 \
-I../../mercurial -c -o fuzzutil-oss-fuzz.o fuzzutil.cc
pyutil.o: pyutil.cc pyutil.h pyutil.o: pyutil.cc pyutil.h
$(CXX) $(CXXFLAGS) -g -O1 \ $(CXX) $(CXXFLAGS) -g -O1 \
`$$OUT/sanpy/bin/python-config --cflags` \ `$$OUT/sanpy/bin/python-config --cflags` \
-I../../mercurial -c -o pyutil.o pyutil.cc -I../../mercurial -c -o pyutil.o pyutil.cc
bdiff.o: ../../mercurial/bdiff.c bdiff.o: ../../mercurial/bdiff.c
$(CC) $(CFLAGS) -fsanitize=fuzzer-no-link,address -c -o bdiff.o \ $(CC) $(CFLAGS) -fsanitize=fuzzer-no-link,address -c -o bdiff.o \
../../mercurial/bdiff.c ../../mercurial/bdiff.c
bdiff: bdiff.cc bdiff.o fuzzutil.o bdiff: bdiff.cc bdiff.o
$(CXX) $(CXXFLAGS) -DHG_FUZZER_INCLUDE_MAIN=1 -g -O1 -fsanitize=fuzzer-no-link,address \ $(CXX) $(CXXFLAGS) -DHG_FUZZER_INCLUDE_MAIN=1 -g -O1 -fsanitize=fuzzer-no-link,address \
-std=c++17 \ -std=c++17 \
-I../../mercurial bdiff.cc bdiff.o fuzzutil.o -o bdiff -I../../mercurial bdiff.cc bdiff.o -o bdiff
bdiff-oss-fuzz.o: ../../mercurial/bdiff.c bdiff-oss-fuzz.o: ../../mercurial/bdiff.c
$(CC) $(CFLAGS) -c -o bdiff-oss-fuzz.o ../../mercurial/bdiff.c $(CC) $(CFLAGS) -c -o bdiff-oss-fuzz.o ../../mercurial/bdiff.c
bdiff_fuzzer: bdiff.cc bdiff-oss-fuzz.o fuzzutil-oss-fuzz.o bdiff_fuzzer: bdiff.cc bdiff-oss-fuzz.o
$(CXX) $(CXXFLAGS) -std=c++17 -I../../mercurial bdiff.cc \ $(CXX) $(CXXFLAGS) -std=c++17 -I../../mercurial bdiff.cc \
bdiff-oss-fuzz.o fuzzutil-oss-fuzz.o -lFuzzingEngine -o \ bdiff-oss-fuzz.o -lFuzzingEngine -o \
$$OUT/bdiff_fuzzer $$OUT/bdiff_fuzzer
mpatch.o: ../../mercurial/mpatch.c mpatch.o: ../../mercurial/mpatch.c
$(CC) -g -O1 -fsanitize=fuzzer-no-link,address -c -o mpatch.o \ $(CC) -g -O1 -fsanitize=fuzzer-no-link,address -c -o mpatch.o \
../../mercurial/mpatch.c ../../mercurial/mpatch.c
mpatch: CXXFLAGS += -std=c++17 mpatch: CXXFLAGS += -std=c++17
mpatch: mpatch.cc mpatch.o fuzzutil.o mpatch: mpatch.cc mpatch.o
$(CXX) $(CXXFLAGS) -DHG_FUZZER_INCLUDE_MAIN=1 -g -O1 -fsanitize=fuzzer-no-link,address \ $(CXX) $(CXXFLAGS) -DHG_FUZZER_INCLUDE_MAIN=1 -g -O1 -fsanitize=fuzzer-no-link,address \
-I../../mercurial mpatch.cc mpatch.o fuzzutil.o -o mpatch -I../../mercurial mpatch.cc mpatch.o -o mpatch
mpatch-oss-fuzz.o: ../../mercurial/mpatch.c mpatch-oss-fuzz.o: ../../mercurial/mpatch.c
$(CC) $(CFLAGS) -c -o mpatch-oss-fuzz.o ../../mercurial/mpatch.c $(CC) $(CFLAGS) -c -o mpatch-oss-fuzz.o ../../mercurial/mpatch.c
mpatch_fuzzer: mpatch.cc mpatch-oss-fuzz.o fuzzutil-oss-fuzz.o mpatch_fuzzer: mpatch.cc mpatch-oss-fuzz.o
$(CXX) $(CXXFLAGS) -std=c++17 -I../../mercurial mpatch.cc \ $(CXX) $(CXXFLAGS) -std=c++17 -I../../mercurial mpatch.cc \
mpatch-oss-fuzz.o fuzzutil-oss-fuzz.o -lFuzzingEngine -o \ mpatch-oss-fuzz.o -lFuzzingEngine -o \
$$OUT/mpatch_fuzzer $$OUT/mpatch_fuzzer
mpatch_corpus.zip: mpatch_corpus.zip:
python mpatch_corpus.py $$OUT/mpatch_fuzzer_seed_corpus.zip python mpatch_corpus.py $$OUT/mpatch_fuzzer_seed_corpus.zip
x%.o: ../../mercurial/thirdparty/xdiff/x%.c ../../mercurial/thirdparty/xdiff/*.h x%.o: ../../mercurial/thirdparty/xdiff/x%.c ../../mercurial/thirdparty/xdiff/*.h
$(CC) -g -O1 -fsanitize=fuzzer-no-link,address -c \ $(CC) -g -O1 -fsanitize=fuzzer-no-link,address -c \
-o $@ \ -o $@ \
$< $<
xdiff: CXXFLAGS += -std=c++17 xdiff: CXXFLAGS += -std=c++17
xdiff: xdiff.cc xdiffi.o xprepare.o xutils.o fuzzutil.o xdiff: xdiff.cc xdiffi.o xprepare.o xutils.o
$(CXX) $(CXXFLAGS) -DHG_FUZZER_INCLUDE_MAIN=1 -g -O1 -fsanitize=fuzzer-no-link,address \ $(CXX) $(CXXFLAGS) -DHG_FUZZER_INCLUDE_MAIN=1 -g -O1 -fsanitize=fuzzer-no-link,address \
-I../../mercurial xdiff.cc \ -I../../mercurial xdiff.cc \
xdiffi.o xprepare.o xutils.o fuzzutil.o -o xdiff xdiffi.o xprepare.o xutils.o -o xdiff
fuzz-x%.o: ../../mercurial/thirdparty/xdiff/x%.c ../../mercurial/thirdparty/xdiff/*.h fuzz-x%.o: ../../mercurial/thirdparty/xdiff/x%.c ../../mercurial/thirdparty/xdiff/*.h
$(CC) $(CFLAGS) -c \ $(CC) $(CFLAGS) -c \
-o $@ \ -o $@ \
$< $<
xdiff_fuzzer: xdiff.cc fuzz-xdiffi.o fuzz-xprepare.o fuzz-xutils.o fuzzutil-oss-fuzz.o xdiff_fuzzer: xdiff.cc fuzz-xdiffi.o fuzz-xprepare.o fuzz-xutils.o
$(CXX) $(CXXFLAGS) -std=c++17 -I../../mercurial xdiff.cc \ $(CXX) $(CXXFLAGS) -std=c++17 -I../../mercurial xdiff.cc \
fuzz-xdiffi.o fuzz-xprepare.o fuzz-xutils.o fuzzutil-oss-fuzz.o \ fuzz-xdiffi.o fuzz-xprepare.o fuzz-xutils.o \
-lFuzzingEngine -o $$OUT/xdiff_fuzzer -lFuzzingEngine -o $$OUT/xdiff_fuzzer
manifest.o: ../../mercurial/cext/manifest.c manifest.o: ../../mercurial/cext/manifest.c
$(CC) $(CFLAGS) `$$OUT/sanpy/bin/python-config --cflags` \ $(CC) $(CFLAGS) `$$OUT/sanpy/bin/python-config --cflags` \
-I../../mercurial \ -I../../mercurial \
-c -o manifest.o ../../mercurial/cext/manifest.c -c -o manifest.o ../../mercurial/cext/manifest.c
charencode.o: ../../mercurial/cext/charencode.c charencode.o: ../../mercurial/cext/charencode.c

contrib/fuzz/fuzzutil.h

#endif #endif
/* set DEBUG to 1 for a few debugging prints, or 2 for a lot */ /* set DEBUG to 1 for a few debugging prints, or 2 for a lot */
#define DEBUG 0 #define DEBUG 0
#define LOG(level) \ #define LOG(level) \
if (level <= DEBUG) \ if (level <= DEBUG) \
std::cout std::cout
struct two_inputs {
std::unique_ptr<char[]> right;
size_t right_size;
std::unique_ptr<char[]> left;
size_t left_size;
};
/* Split a non-zero-length input into two inputs. */
contrib::optional<two_inputs> SplitInputs(const uint8_t *Data, size_t Size);
#endif /* CONTRIB_FUZZ_FUZZUTIL_H */ #endif /* CONTRIB_FUZZ_FUZZUTIL_H */

contrib/fuzz/fuzzutil.cc

  • This file was deleted.
#include "fuzzutil.h"
#include <cstring>
#include <utility>
contrib::optional<two_inputs> SplitInputs(const uint8_t *Data, size_t Size)
{
if (!Size) {
return contrib::nullopt;
}
// figure out a random point in [0, Size] to split our input.
size_t left_size = (Data[0] / 255.0) * (Size - 1);
// Copy inputs to new allocations so if bdiff over-reads
// AddressSanitizer can detect it.
std::unique_ptr<char[]> left(new char[left_size]);
std::memcpy(left.get(), Data + 1, left_size);
// right starts at the next byte after left ends
size_t right_size = Size - (left_size + 1);
std::unique_ptr<char[]> right(new char[right_size]);
std::memcpy(right.get(), Data + 1 + left_size, right_size);
LOG(2) << "inputs are " << left_size << " and " << right_size
<< " bytes" << std::endl;
two_inputs result = {std::move(right), right_size, std::move(left),
left_size};
return result;
}
contrib/fuzz/Makefile