Coverage Report

Created: 2026-09-14 07:09

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/fmt/test/fuzzing/named-arg.cc
Line
Count
Source
1
// Copyright (c) 2019, Paul Dreik
2
// For the license information refer to format.h.
3
4
#include <fmt/chrono.h>
5
6
#include <cstdint>
7
#include <type_traits>
8
#include <vector>
9
10
#include "fuzzer-common.h"
11
12
template <typename T>
13
10.9k
void invoke_fmt(const uint8_t* data, size_t size, unsigned arg_name_size) {
14
10.9k
  static_assert(sizeof(T) <= fixed_size, "fixed_size too small");
15
10.9k
  if (size <= fixed_size) return;
16
10.8k
  const T value = assign_from_buf<T>(data);
17
10.8k
  data += fixed_size;
18
10.8k
  size -= fixed_size;
19
20
10.8k
  if (arg_name_size <= 0 || arg_name_size >= size) return;
21
10.8k
  data_to_string arg_name(data, arg_name_size, true);
22
10.8k
  data += arg_name_size;
23
10.8k
  size -= arg_name_size;
24
25
10.8k
  data_to_string format_str(data, size);
26
10.8k
  try {
27
#if FMT_FUZZ_FORMAT_TO_STRING
28
    std::string message =
29
        fmt::format(format_str.get(), fmt::arg(arg_name.data(), value));
30
#else
31
10.8k
    fmt::memory_buffer out;
32
10.8k
    fmt::format_to(std::back_inserter(out), format_str.get(),
33
10.8k
                   fmt::arg(arg_name.data(), value));
34
10.8k
#endif
35
10.8k
  } catch (std::exception&) {
36
8.31k
  }
37
10.8k
}
void invoke_fmt<bool>(unsigned char const*, unsigned long, unsigned int)
Line
Count
Source
13
264
void invoke_fmt(const uint8_t* data, size_t size, unsigned arg_name_size) {
14
264
  static_assert(sizeof(T) <= fixed_size, "fixed_size too small");
15
264
  if (size <= fixed_size) return;
16
258
  const T value = assign_from_buf<T>(data);
17
258
  data += fixed_size;
18
258
  size -= fixed_size;
19
20
258
  if (arg_name_size <= 0 || arg_name_size >= size) return;
21
244
  data_to_string arg_name(data, arg_name_size, true);
22
244
  data += arg_name_size;
23
244
  size -= arg_name_size;
24
25
244
  data_to_string format_str(data, size);
26
244
  try {
27
#if FMT_FUZZ_FORMAT_TO_STRING
28
    std::string message =
29
        fmt::format(format_str.get(), fmt::arg(arg_name.data(), value));
30
#else
31
244
    fmt::memory_buffer out;
32
244
    fmt::format_to(std::back_inserter(out), format_str.get(),
33
244
                   fmt::arg(arg_name.data(), value));
34
244
#endif
35
244
  } catch (std::exception&) {
36
216
  }
37
244
}
void invoke_fmt<char>(unsigned char const*, unsigned long, unsigned int)
Line
Count
Source
13
377
void invoke_fmt(const uint8_t* data, size_t size, unsigned arg_name_size) {
14
377
  static_assert(sizeof(T) <= fixed_size, "fixed_size too small");
15
377
  if (size <= fixed_size) return;
16
371
  const T value = assign_from_buf<T>(data);
17
371
  data += fixed_size;
18
371
  size -= fixed_size;
19
20
371
  if (arg_name_size <= 0 || arg_name_size >= size) return;
21
364
  data_to_string arg_name(data, arg_name_size, true);
22
364
  data += arg_name_size;
23
364
  size -= arg_name_size;
24
25
364
  data_to_string format_str(data, size);
26
364
  try {
27
#if FMT_FUZZ_FORMAT_TO_STRING
28
    std::string message =
29
        fmt::format(format_str.get(), fmt::arg(arg_name.data(), value));
30
#else
31
364
    fmt::memory_buffer out;
32
364
    fmt::format_to(std::back_inserter(out), format_str.get(),
33
364
                   fmt::arg(arg_name.data(), value));
34
364
#endif
35
364
  } catch (std::exception&) {
36
332
  }
37
364
}
void invoke_fmt<signed char>(unsigned char const*, unsigned long, unsigned int)
Line
Count
Source
13
179
void invoke_fmt(const uint8_t* data, size_t size, unsigned arg_name_size) {
14
179
  static_assert(sizeof(T) <= fixed_size, "fixed_size too small");
15
179
  if (size <= fixed_size) return;
16
176
  const T value = assign_from_buf<T>(data);
17
176
  data += fixed_size;
18
176
  size -= fixed_size;
19
20
176
  if (arg_name_size <= 0 || arg_name_size >= size) return;
21
169
  data_to_string arg_name(data, arg_name_size, true);
22
169
  data += arg_name_size;
23
169
  size -= arg_name_size;
24
25
169
  data_to_string format_str(data, size);
26
169
  try {
27
#if FMT_FUZZ_FORMAT_TO_STRING
28
    std::string message =
29
        fmt::format(format_str.get(), fmt::arg(arg_name.data(), value));
30
#else
31
169
    fmt::memory_buffer out;
32
169
    fmt::format_to(std::back_inserter(out), format_str.get(),
33
169
                   fmt::arg(arg_name.data(), value));
34
169
#endif
35
169
  } catch (std::exception&) {
36
142
  }
37
169
}
void invoke_fmt<unsigned char>(unsigned char const*, unsigned long, unsigned int)
Line
Count
Source
13
112
void invoke_fmt(const uint8_t* data, size_t size, unsigned arg_name_size) {
14
112
  static_assert(sizeof(T) <= fixed_size, "fixed_size too small");
15
112
  if (size <= fixed_size) return;
16
110
  const T value = assign_from_buf<T>(data);
17
110
  data += fixed_size;
18
110
  size -= fixed_size;
19
20
110
  if (arg_name_size <= 0 || arg_name_size >= size) return;
21
105
  data_to_string arg_name(data, arg_name_size, true);
22
105
  data += arg_name_size;
23
105
  size -= arg_name_size;
24
25
105
  data_to_string format_str(data, size);
26
105
  try {
27
#if FMT_FUZZ_FORMAT_TO_STRING
28
    std::string message =
29
        fmt::format(format_str.get(), fmt::arg(arg_name.data(), value));
30
#else
31
105
    fmt::memory_buffer out;
32
105
    fmt::format_to(std::back_inserter(out), format_str.get(),
33
105
                   fmt::arg(arg_name.data(), value));
34
105
#endif
35
105
  } catch (std::exception&) {
36
83
  }
37
105
}
void invoke_fmt<short>(unsigned char const*, unsigned long, unsigned int)
Line
Count
Source
13
199
void invoke_fmt(const uint8_t* data, size_t size, unsigned arg_name_size) {
14
199
  static_assert(sizeof(T) <= fixed_size, "fixed_size too small");
15
199
  if (size <= fixed_size) return;
16
196
  const T value = assign_from_buf<T>(data);
17
196
  data += fixed_size;
18
196
  size -= fixed_size;
19
20
196
  if (arg_name_size <= 0 || arg_name_size >= size) return;
21
191
  data_to_string arg_name(data, arg_name_size, true);
22
191
  data += arg_name_size;
23
191
  size -= arg_name_size;
24
25
191
  data_to_string format_str(data, size);
26
191
  try {
27
#if FMT_FUZZ_FORMAT_TO_STRING
28
    std::string message =
29
        fmt::format(format_str.get(), fmt::arg(arg_name.data(), value));
30
#else
31
191
    fmt::memory_buffer out;
32
191
    fmt::format_to(std::back_inserter(out), format_str.get(),
33
191
                   fmt::arg(arg_name.data(), value));
34
191
#endif
35
191
  } catch (std::exception&) {
36
156
  }
37
191
}
void invoke_fmt<unsigned short>(unsigned char const*, unsigned long, unsigned int)
Line
Count
Source
13
127
void invoke_fmt(const uint8_t* data, size_t size, unsigned arg_name_size) {
14
127
  static_assert(sizeof(T) <= fixed_size, "fixed_size too small");
15
127
  if (size <= fixed_size) return;
16
121
  const T value = assign_from_buf<T>(data);
17
121
  data += fixed_size;
18
121
  size -= fixed_size;
19
20
121
  if (arg_name_size <= 0 || arg_name_size >= size) return;
21
113
  data_to_string arg_name(data, arg_name_size, true);
22
113
  data += arg_name_size;
23
113
  size -= arg_name_size;
24
25
113
  data_to_string format_str(data, size);
26
113
  try {
27
#if FMT_FUZZ_FORMAT_TO_STRING
28
    std::string message =
29
        fmt::format(format_str.get(), fmt::arg(arg_name.data(), value));
30
#else
31
113
    fmt::memory_buffer out;
32
113
    fmt::format_to(std::back_inserter(out), format_str.get(),
33
113
                   fmt::arg(arg_name.data(), value));
34
113
#endif
35
113
  } catch (std::exception&) {
36
89
  }
37
113
}
void invoke_fmt<int>(unsigned char const*, unsigned long, unsigned int)
Line
Count
Source
13
459
void invoke_fmt(const uint8_t* data, size_t size, unsigned arg_name_size) {
14
459
  static_assert(sizeof(T) <= fixed_size, "fixed_size too small");
15
459
  if (size <= fixed_size) return;
16
453
  const T value = assign_from_buf<T>(data);
17
453
  data += fixed_size;
18
453
  size -= fixed_size;
19
20
453
  if (arg_name_size <= 0 || arg_name_size >= size) return;
21
446
  data_to_string arg_name(data, arg_name_size, true);
22
446
  data += arg_name_size;
23
446
  size -= arg_name_size;
24
25
446
  data_to_string format_str(data, size);
26
446
  try {
27
#if FMT_FUZZ_FORMAT_TO_STRING
28
    std::string message =
29
        fmt::format(format_str.get(), fmt::arg(arg_name.data(), value));
30
#else
31
446
    fmt::memory_buffer out;
32
446
    fmt::format_to(std::back_inserter(out), format_str.get(),
33
446
                   fmt::arg(arg_name.data(), value));
34
446
#endif
35
446
  } catch (std::exception&) {
36
361
  }
37
446
}
void invoke_fmt<unsigned int>(unsigned char const*, unsigned long, unsigned int)
Line
Count
Source
13
450
void invoke_fmt(const uint8_t* data, size_t size, unsigned arg_name_size) {
14
450
  static_assert(sizeof(T) <= fixed_size, "fixed_size too small");
15
450
  if (size <= fixed_size) return;
16
444
  const T value = assign_from_buf<T>(data);
17
444
  data += fixed_size;
18
444
  size -= fixed_size;
19
20
444
  if (arg_name_size <= 0 || arg_name_size >= size) return;
21
437
  data_to_string arg_name(data, arg_name_size, true);
22
437
  data += arg_name_size;
23
437
  size -= arg_name_size;
24
25
437
  data_to_string format_str(data, size);
26
437
  try {
27
#if FMT_FUZZ_FORMAT_TO_STRING
28
    std::string message =
29
        fmt::format(format_str.get(), fmt::arg(arg_name.data(), value));
30
#else
31
437
    fmt::memory_buffer out;
32
437
    fmt::format_to(std::back_inserter(out), format_str.get(),
33
437
                   fmt::arg(arg_name.data(), value));
34
437
#endif
35
437
  } catch (std::exception&) {
36
335
  }
37
437
}
void invoke_fmt<long>(unsigned char const*, unsigned long, unsigned int)
Line
Count
Source
13
1.03k
void invoke_fmt(const uint8_t* data, size_t size, unsigned arg_name_size) {
14
1.03k
  static_assert(sizeof(T) <= fixed_size, "fixed_size too small");
15
1.03k
  if (size <= fixed_size) return;
16
1.02k
  const T value = assign_from_buf<T>(data);
17
1.02k
  data += fixed_size;
18
1.02k
  size -= fixed_size;
19
20
1.02k
  if (arg_name_size <= 0 || arg_name_size >= size) return;
21
1.02k
  data_to_string arg_name(data, arg_name_size, true);
22
1.02k
  data += arg_name_size;
23
1.02k
  size -= arg_name_size;
24
25
1.02k
  data_to_string format_str(data, size);
26
1.02k
  try {
27
#if FMT_FUZZ_FORMAT_TO_STRING
28
    std::string message =
29
        fmt::format(format_str.get(), fmt::arg(arg_name.data(), value));
30
#else
31
1.02k
    fmt::memory_buffer out;
32
1.02k
    fmt::format_to(std::back_inserter(out), format_str.get(),
33
1.02k
                   fmt::arg(arg_name.data(), value));
34
1.02k
#endif
35
1.02k
  } catch (std::exception&) {
36
806
  }
37
1.02k
}
void invoke_fmt<unsigned long>(unsigned char const*, unsigned long, unsigned int)
Line
Count
Source
13
855
void invoke_fmt(const uint8_t* data, size_t size, unsigned arg_name_size) {
14
855
  static_assert(sizeof(T) <= fixed_size, "fixed_size too small");
15
855
  if (size <= fixed_size) return;
16
849
  const T value = assign_from_buf<T>(data);
17
849
  data += fixed_size;
18
849
  size -= fixed_size;
19
20
849
  if (arg_name_size <= 0 || arg_name_size >= size) return;
21
842
  data_to_string arg_name(data, arg_name_size, true);
22
842
  data += arg_name_size;
23
842
  size -= arg_name_size;
24
25
842
  data_to_string format_str(data, size);
26
842
  try {
27
#if FMT_FUZZ_FORMAT_TO_STRING
28
    std::string message =
29
        fmt::format(format_str.get(), fmt::arg(arg_name.data(), value));
30
#else
31
842
    fmt::memory_buffer out;
32
842
    fmt::format_to(std::back_inserter(out), format_str.get(),
33
842
                   fmt::arg(arg_name.data(), value));
34
842
#endif
35
842
  } catch (std::exception&) {
36
661
  }
37
842
}
void invoke_fmt<float>(unsigned char const*, unsigned long, unsigned int)
Line
Count
Source
13
2.08k
void invoke_fmt(const uint8_t* data, size_t size, unsigned arg_name_size) {
14
2.08k
  static_assert(sizeof(T) <= fixed_size, "fixed_size too small");
15
2.08k
  if (size <= fixed_size) return;
16
2.07k
  const T value = assign_from_buf<T>(data);
17
2.07k
  data += fixed_size;
18
2.07k
  size -= fixed_size;
19
20
2.07k
  if (arg_name_size <= 0 || arg_name_size >= size) return;
21
2.07k
  data_to_string arg_name(data, arg_name_size, true);
22
2.07k
  data += arg_name_size;
23
2.07k
  size -= arg_name_size;
24
25
2.07k
  data_to_string format_str(data, size);
26
2.07k
  try {
27
#if FMT_FUZZ_FORMAT_TO_STRING
28
    std::string message =
29
        fmt::format(format_str.get(), fmt::arg(arg_name.data(), value));
30
#else
31
2.07k
    fmt::memory_buffer out;
32
2.07k
    fmt::format_to(std::back_inserter(out), format_str.get(),
33
2.07k
                   fmt::arg(arg_name.data(), value));
34
2.07k
#endif
35
2.07k
  } catch (std::exception&) {
36
1.57k
  }
37
2.07k
}
void invoke_fmt<double>(unsigned char const*, unsigned long, unsigned int)
Line
Count
Source
13
2.97k
void invoke_fmt(const uint8_t* data, size_t size, unsigned arg_name_size) {
14
2.97k
  static_assert(sizeof(T) <= fixed_size, "fixed_size too small");
15
2.97k
  if (size <= fixed_size) return;
16
2.97k
  const T value = assign_from_buf<T>(data);
17
2.97k
  data += fixed_size;
18
2.97k
  size -= fixed_size;
19
20
2.97k
  if (arg_name_size <= 0 || arg_name_size >= size) return;
21
2.96k
  data_to_string arg_name(data, arg_name_size, true);
22
2.96k
  data += arg_name_size;
23
2.96k
  size -= arg_name_size;
24
25
2.96k
  data_to_string format_str(data, size);
26
2.96k
  try {
27
#if FMT_FUZZ_FORMAT_TO_STRING
28
    std::string message =
29
        fmt::format(format_str.get(), fmt::arg(arg_name.data(), value));
30
#else
31
2.96k
    fmt::memory_buffer out;
32
2.96k
    fmt::format_to(std::back_inserter(out), format_str.get(),
33
2.96k
                   fmt::arg(arg_name.data(), value));
34
2.96k
#endif
35
2.96k
  } catch (std::exception&) {
36
2.18k
  }
37
2.96k
}
void invoke_fmt<long double>(unsigned char const*, unsigned long, unsigned int)
Line
Count
Source
13
1.84k
void invoke_fmt(const uint8_t* data, size_t size, unsigned arg_name_size) {
14
1.84k
  static_assert(sizeof(T) <= fixed_size, "fixed_size too small");
15
1.84k
  if (size <= fixed_size) return;
16
1.84k
  const T value = assign_from_buf<T>(data);
17
1.84k
  data += fixed_size;
18
1.84k
  size -= fixed_size;
19
20
1.84k
  if (arg_name_size <= 0 || arg_name_size >= size) return;
21
1.83k
  data_to_string arg_name(data, arg_name_size, true);
22
1.83k
  data += arg_name_size;
23
1.83k
  size -= arg_name_size;
24
25
1.83k
  data_to_string format_str(data, size);
26
1.83k
  try {
27
#if FMT_FUZZ_FORMAT_TO_STRING
28
    std::string message =
29
        fmt::format(format_str.get(), fmt::arg(arg_name.data(), value));
30
#else
31
1.83k
    fmt::memory_buffer out;
32
1.83k
    fmt::format_to(std::back_inserter(out), format_str.get(),
33
1.83k
                   fmt::arg(arg_name.data(), value));
34
1.83k
#endif
35
1.83k
  } catch (std::exception&) {
36
1.37k
  }
37
1.83k
}
38
39
// For dynamic dispatching to an explicit instantiation.
40
10.9k
template <typename Callback> void invoke(int type, Callback callback) {
41
10.9k
  switch (type) {
42
264
  case 0:
43
264
    callback(bool());
44
264
    break;
45
377
  case 1:
46
377
    callback(char());
47
377
    break;
48
179
  case 2:
49
179
    using sc = signed char;
50
179
    callback(sc());
51
179
    break;
52
112
  case 3:
53
112
    using uc = unsigned char;
54
112
    callback(uc());
55
112
    break;
56
199
  case 4:
57
199
    callback(short());
58
199
    break;
59
127
  case 5:
60
127
    using us = unsigned short;
61
127
    callback(us());
62
127
    break;
63
459
  case 6:
64
459
    callback(int());
65
459
    break;
66
450
  case 7:
67
450
    callback(unsigned());
68
450
    break;
69
1.03k
  case 8:
70
1.03k
    callback(long());
71
1.03k
    break;
72
855
  case 9:
73
855
    using ul = unsigned long;
74
855
    callback(ul());
75
855
    break;
76
2.08k
  case 10:
77
2.08k
    callback(float());
78
2.08k
    break;
79
2.97k
  case 11:
80
2.97k
    callback(double());
81
2.97k
    break;
82
1.84k
  case 12:
83
1.84k
    using LD = long double;
84
1.84k
    callback(LD());
85
1.84k
    break;
86
10.9k
  }
87
10.9k
}
88
89
10.9k
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
90
10.9k
  if (size <= 3) return 0;
91
92
  // Switch types depending on the first byte of the input.
93
10.9k
  const auto type = data[0] & 0x0F;
94
10.9k
  const unsigned arg_name_size = (data[0] & 0xF0) >> 4;
95
10.9k
  data++;
96
10.9k
  size--;
97
98
10.9k
  invoke(type, [=](auto arg) {
99
10.9k
    invoke_fmt<decltype(arg)>(data, size, arg_name_size);
100
10.9k
  });
named-arg.cc:auto LLVMFuzzerTestOneInput::$_0::operator()<bool>(bool) const
Line
Count
Source
98
264
  invoke(type, [=](auto arg) {
99
264
    invoke_fmt<decltype(arg)>(data, size, arg_name_size);
100
264
  });
named-arg.cc:auto LLVMFuzzerTestOneInput::$_0::operator()<char>(char) const
Line
Count
Source
98
377
  invoke(type, [=](auto arg) {
99
377
    invoke_fmt<decltype(arg)>(data, size, arg_name_size);
100
377
  });
named-arg.cc:auto LLVMFuzzerTestOneInput::$_0::operator()<signed char>(signed char) const
Line
Count
Source
98
179
  invoke(type, [=](auto arg) {
99
179
    invoke_fmt<decltype(arg)>(data, size, arg_name_size);
100
179
  });
named-arg.cc:auto LLVMFuzzerTestOneInput::$_0::operator()<unsigned char>(unsigned char) const
Line
Count
Source
98
112
  invoke(type, [=](auto arg) {
99
112
    invoke_fmt<decltype(arg)>(data, size, arg_name_size);
100
112
  });
named-arg.cc:auto LLVMFuzzerTestOneInput::$_0::operator()<short>(short) const
Line
Count
Source
98
199
  invoke(type, [=](auto arg) {
99
199
    invoke_fmt<decltype(arg)>(data, size, arg_name_size);
100
199
  });
named-arg.cc:auto LLVMFuzzerTestOneInput::$_0::operator()<unsigned short>(unsigned short) const
Line
Count
Source
98
127
  invoke(type, [=](auto arg) {
99
127
    invoke_fmt<decltype(arg)>(data, size, arg_name_size);
100
127
  });
named-arg.cc:auto LLVMFuzzerTestOneInput::$_0::operator()<int>(int) const
Line
Count
Source
98
459
  invoke(type, [=](auto arg) {
99
459
    invoke_fmt<decltype(arg)>(data, size, arg_name_size);
100
459
  });
named-arg.cc:auto LLVMFuzzerTestOneInput::$_0::operator()<unsigned int>(unsigned int) const
Line
Count
Source
98
450
  invoke(type, [=](auto arg) {
99
450
    invoke_fmt<decltype(arg)>(data, size, arg_name_size);
100
450
  });
named-arg.cc:auto LLVMFuzzerTestOneInput::$_0::operator()<long>(long) const
Line
Count
Source
98
1.03k
  invoke(type, [=](auto arg) {
99
1.03k
    invoke_fmt<decltype(arg)>(data, size, arg_name_size);
100
1.03k
  });
named-arg.cc:auto LLVMFuzzerTestOneInput::$_0::operator()<unsigned long>(unsigned long) const
Line
Count
Source
98
855
  invoke(type, [=](auto arg) {
99
855
    invoke_fmt<decltype(arg)>(data, size, arg_name_size);
100
855
  });
named-arg.cc:auto LLVMFuzzerTestOneInput::$_0::operator()<float>(float) const
Line
Count
Source
98
2.08k
  invoke(type, [=](auto arg) {
99
2.08k
    invoke_fmt<decltype(arg)>(data, size, arg_name_size);
100
2.08k
  });
named-arg.cc:auto LLVMFuzzerTestOneInput::$_0::operator()<double>(double) const
Line
Count
Source
98
2.97k
  invoke(type, [=](auto arg) {
99
2.97k
    invoke_fmt<decltype(arg)>(data, size, arg_name_size);
100
2.97k
  });
named-arg.cc:auto LLVMFuzzerTestOneInput::$_0::operator()<long double>(long double) const
Line
Count
Source
98
1.84k
  invoke(type, [=](auto arg) {
99
1.84k
    invoke_fmt<decltype(arg)>(data, size, arg_name_size);
100
1.84k
  });
101
10.9k
  return 0;
102
10.9k
}