Coverage Report

Created: 2018-09-25 14:53

/src/mozilla-central/tools/fuzzing/libfuzzer/FuzzerCrossOver.cpp
Line
Count
Source (jump to first uncovered line)
1
//===- FuzzerCrossOver.cpp - Cross over two test inputs -------------------===//
2
//
3
//                     The LLVM Compiler Infrastructure
4
//
5
// This file is distributed under the University of Illinois Open Source
6
// License. See LICENSE.TXT for details.
7
//
8
//===----------------------------------------------------------------------===//
9
// Cross over test inputs.
10
//===----------------------------------------------------------------------===//
11
12
#include "FuzzerDefs.h"
13
#include "FuzzerMutate.h"
14
#include "FuzzerRandom.h"
15
#include <cstring>
16
17
namespace fuzzer {
18
19
// Cross Data1 and Data2, store the result (up to MaxOutSize bytes) in Out.
20
size_t MutationDispatcher::CrossOver(const uint8_t *Data1, size_t Size1,
21
                                     const uint8_t *Data2, size_t Size2,
22
0
                                     uint8_t *Out, size_t MaxOutSize) {
23
0
  assert(Size1 || Size2);
24
0
  MaxOutSize = Rand(MaxOutSize) + 1;
25
0
  size_t OutPos = 0;
26
0
  size_t Pos1 = 0;
27
0
  size_t Pos2 = 0;
28
0
  size_t *InPos = &Pos1;
29
0
  size_t InSize = Size1;
30
0
  const uint8_t *Data = Data1;
31
0
  bool CurrentlyUsingFirstData = true;
32
0
  while (OutPos < MaxOutSize && (Pos1 < Size1 || Pos2 < Size2)) {
33
0
    // Merge a part of Data into Out.
34
0
    size_t OutSizeLeft = MaxOutSize - OutPos;
35
0
    if (*InPos < InSize) {
36
0
      size_t InSizeLeft = InSize - *InPos;
37
0
      size_t MaxExtraSize = std::min(OutSizeLeft, InSizeLeft);
38
0
      size_t ExtraSize = Rand(MaxExtraSize) + 1;
39
0
      memcpy(Out + OutPos, Data + *InPos, ExtraSize);
40
0
      OutPos += ExtraSize;
41
0
      (*InPos) += ExtraSize;
42
0
    }
43
0
    // Use the other input data on the next iteration.
44
0
    InPos  = CurrentlyUsingFirstData ? &Pos2 : &Pos1;
45
0
    InSize = CurrentlyUsingFirstData ? Size2 : Size1;
46
0
    Data   = CurrentlyUsingFirstData ? Data2 : Data1;
47
0
    CurrentlyUsingFirstData = !CurrentlyUsingFirstData;
48
0
  }
49
0
  return OutPos;
50
0
}
51
52
}  // namespace fuzzer