Coverage Report

Created: 2021-05-04 09:02

/src/botan/src/fuzzer/bn_cmp.cpp
Line
Count
Source
1
/*
2
* (C) 2021 Jack Lloyd
3
*
4
* Botan is released under the Simplified BSD License (see license.txt)
5
*/
6
7
#include "fuzzers.h"
8
9
#include <botan/bigint.h>
10
11
void fuzz(const uint8_t in[], size_t len)
12
107
   {
13
107
   const size_t max_bits = 512;
14
15
107
   if(len < 3 || len > 1 + 2*(max_bits/8))
16
31
      return;
17
18
76
   const uint8_t signs = in[0];
19
76
   const size_t x_len = (len - 1) / 2;
20
21
76
   Botan::BigInt x = Botan::BigInt::decode(in + 1, x_len);
22
76
   Botan::BigInt y = Botan::BigInt::decode(in + 1 + x_len, len - x_len - 1);
23
24
76
   if(signs & 1)
25
35
      x.flip_sign();
26
76
   if(signs & 2)
27
43
      y.flip_sign();
28
29
76
   const Botan::BigInt d1 = x - y;
30
76
   const Botan::BigInt d2 = y - x;
31
32
76
   FUZZER_ASSERT_TRUE(d1.cmp(d2, false) == 0);
33
34
76
   const bool is_eq = (x == y);
35
76
   const bool is_lt = (x < y);
36
76
   const bool is_gt = (x > y);
37
76
   const bool is_lte = (x <= y);
38
76
   const bool is_gte = (x >= y);
39
40
76
   if(is_eq)
41
3
      {
42
3
      FUZZER_ASSERT_TRUE(d1.is_zero());
43
3
      FUZZER_ASSERT_TRUE(d2.is_zero());
44
3
      }
45
46
76
   if(is_lte)
47
30
      {
48
30
      FUZZER_ASSERT_TRUE(is_lt || is_eq);
49
30
      }
50
51
76
   if(is_gte)
52
49
      {
53
49
      FUZZER_ASSERT_TRUE(is_gt || is_eq);
54
49
      }
55
56
76
   if(is_lt)
57
27
      {
58
27
      FUZZER_ASSERT_TRUE(!is_gt);
59
27
      FUZZER_ASSERT_TRUE(d1.is_nonzero());
60
27
      FUZZER_ASSERT_TRUE(d2.is_nonzero());
61
27
      FUZZER_ASSERT_TRUE(d1.is_negative());
62
27
      FUZZER_ASSERT_TRUE(d2.is_positive());
63
27
      }
64
65
76
   if(is_gt)
66
46
      {
67
46
      FUZZER_ASSERT_TRUE(!is_lt);
68
46
      FUZZER_ASSERT_TRUE(d1.is_nonzero());
69
46
      FUZZER_ASSERT_TRUE(d2.is_nonzero());
70
46
      FUZZER_ASSERT_TRUE(d1.is_positive());
71
46
      FUZZER_ASSERT_TRUE(d2.is_negative());
72
46
      }
73
76
   }
74