/src/flatbuffers/tests/fuzzer/flatbuffers_parser_fuzzer.cc
Line | Count | Source |
1 | | // Copyright 2015 The Chromium Authors. All rights reserved. |
2 | | // Use of this source code is governed by a BSD-style license that can be |
3 | | // found in the LICENSE file. |
4 | | #include <stddef.h> |
5 | | #include <stdint.h> |
6 | | #include <clocale> |
7 | | #include <string> |
8 | | |
9 | | #include "flatbuffers/idl.h" |
10 | | #include "test_init.h" |
11 | | |
12 | | static constexpr size_t kMinInputLength = 1; |
13 | | static constexpr size_t kMaxInputLength = 16384; |
14 | | |
15 | | static constexpr uint8_t flags_strict_json = 0x80; |
16 | | static constexpr uint8_t flags_skip_unexpected_fields_in_json = 0x40; |
17 | | static constexpr uint8_t flags_allow_non_utf8 = 0x20; |
18 | | |
19 | | // Utility for test run. |
20 | | OneTimeTestInit OneTimeTestInit::one_time_init_; |
21 | | |
22 | 27.4k | extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { |
23 | | // Reserve one byte for Parser flags and one byte for repetition counter. |
24 | 27.4k | if (size < 3) return 0; |
25 | 27.4k | const uint8_t flags = data[0]; |
26 | 27.4k | (void)data[1]; // reserved |
27 | 27.4k | data += 2; |
28 | 27.4k | size -= 2; // bypass |
29 | | |
30 | 27.4k | const std::string original(reinterpret_cast<const char *>(data), size); |
31 | 27.4k | auto input = std::string(original.c_str()); // until '\0' |
32 | 27.4k | if (input.size() < kMinInputLength || input.size() > kMaxInputLength) |
33 | 17 | return 0; |
34 | | |
35 | 27.3k | flatbuffers::IDLOptions opts; |
36 | 27.3k | opts.strict_json = (flags & flags_strict_json); |
37 | 27.3k | opts.skip_unexpected_fields_in_json = |
38 | 27.3k | (flags & flags_skip_unexpected_fields_in_json); |
39 | 27.3k | opts.allow_non_utf8 = (flags & flags_allow_non_utf8); |
40 | | |
41 | 27.3k | flatbuffers::Parser parser(opts); |
42 | | |
43 | | // Guarantee 0-termination in the input. |
44 | 27.3k | auto parse_input = input.c_str(); |
45 | | |
46 | | // Check Parser. |
47 | 27.3k | parser.Parse(parse_input); |
48 | | // TODO: |
49 | | // Need to add additional checks for inputs passed Parse(parse_input) successfully: |
50 | | // 1. Serialization to bfbs. |
51 | | // 2. Generation of a default object. |
52 | | // 3. Verification of the object using reflection. |
53 | | // 3. Printing to json. |
54 | 27.3k | return 0; |
55 | 27.4k | } |