/src/mozilla-central/tools/fuzzing/libfuzzer/FuzzerCrossOver.cpp
Line | Count | Source (jump to first uncovered line) |
1 | | //===- FuzzerCrossOver.cpp - Cross over two test inputs -------------------===// |
2 | | // |
3 | | // The LLVM Compiler Infrastructure |
4 | | // |
5 | | // This file is distributed under the University of Illinois Open Source |
6 | | // License. See LICENSE.TXT for details. |
7 | | // |
8 | | //===----------------------------------------------------------------------===// |
9 | | // Cross over test inputs. |
10 | | //===----------------------------------------------------------------------===// |
11 | | |
12 | | #include "FuzzerDefs.h" |
13 | | #include "FuzzerMutate.h" |
14 | | #include "FuzzerRandom.h" |
15 | | #include <cstring> |
16 | | |
17 | | namespace fuzzer { |
18 | | |
19 | | // Cross Data1 and Data2, store the result (up to MaxOutSize bytes) in Out. |
20 | | size_t MutationDispatcher::CrossOver(const uint8_t *Data1, size_t Size1, |
21 | | const uint8_t *Data2, size_t Size2, |
22 | 0 | uint8_t *Out, size_t MaxOutSize) { |
23 | 0 | assert(Size1 || Size2); |
24 | 0 | MaxOutSize = Rand(MaxOutSize) + 1; |
25 | 0 | size_t OutPos = 0; |
26 | 0 | size_t Pos1 = 0; |
27 | 0 | size_t Pos2 = 0; |
28 | 0 | size_t *InPos = &Pos1; |
29 | 0 | size_t InSize = Size1; |
30 | 0 | const uint8_t *Data = Data1; |
31 | 0 | bool CurrentlyUsingFirstData = true; |
32 | 0 | while (OutPos < MaxOutSize && (Pos1 < Size1 || Pos2 < Size2)) { |
33 | 0 | // Merge a part of Data into Out. |
34 | 0 | size_t OutSizeLeft = MaxOutSize - OutPos; |
35 | 0 | if (*InPos < InSize) { |
36 | 0 | size_t InSizeLeft = InSize - *InPos; |
37 | 0 | size_t MaxExtraSize = std::min(OutSizeLeft, InSizeLeft); |
38 | 0 | size_t ExtraSize = Rand(MaxExtraSize) + 1; |
39 | 0 | memcpy(Out + OutPos, Data + *InPos, ExtraSize); |
40 | 0 | OutPos += ExtraSize; |
41 | 0 | (*InPos) += ExtraSize; |
42 | 0 | } |
43 | 0 | // Use the other input data on the next iteration. |
44 | 0 | InPos = CurrentlyUsingFirstData ? &Pos2 : &Pos1; |
45 | 0 | InSize = CurrentlyUsingFirstData ? Size2 : Size1; |
46 | 0 | Data = CurrentlyUsingFirstData ? Data2 : Data1; |
47 | 0 | CurrentlyUsingFirstData = !CurrentlyUsingFirstData; |
48 | 0 | } |
49 | 0 | return OutPos; |
50 | 0 | } |
51 | | |
52 | | } // namespace fuzzer |