Coverage Report

Created: 2026-08-22 07:18

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/llama.cpp/fuzzers/fuzz_load_model.cpp
Line
Count
Source
1
/* Copyright 2024 Google LLC
2
Licensed under the Apache License, Version 2.0 (the "License");
3
you may not use this file except in compliance with the License.
4
You may obtain a copy of the License at
5
      http://www.apache.org/licenses/LICENSE-2.0
6
Unless required by applicable law or agreed to in writing, software
7
distributed under the License is distributed on an "AS IS" BASIS,
8
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
9
See the License for the specific language governing permissions and
10
limitations under the License.
11
*/
12
13
#include "llama.h"
14
#include <iostream>
15
#include <setjmp.h>
16
#include <unistd.h>
17
18
const char *model_arch = "llama";
19
const char *gen_arch = "general.architecture";
20
jmp_buf fuzzing_jmp_buf;
21
22
struct llama_model_kv_override fuzz_kv_overrides[2];
23
24
9
extern "C" void __wrap_abort(void) { longjmp(fuzzing_jmp_buf, 1); }
25
26
6.73k
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
27
6.73k
  llama_backend_init();
28
29
6.73k
  char filename[256];
30
6.73k
  sprintf(filename, "/tmp/libfuzzer.%d", getpid());
31
32
6.73k
  FILE *fp = fopen(filename, "wb");
33
6.73k
  if (!fp) {
34
0
    return 0;
35
0
  }
36
6.73k
  fwrite(data, size, 1, fp);
37
6.73k
  fclose(fp);
38
39
6.73k
  auto params = llama_model_default_params();
40
6.73k
  params.load_mode = LLAMA_LOAD_MODE_NONE;
41
6.73k
  params.progress_callback = [](float progress, void *ctx) {
42
0
    (void)ctx;
43
0
    return progress > 0.50;
44
0
  };
45
46
6.73k
  fuzz_kv_overrides[0].tag = LLAMA_KV_OVERRIDE_TYPE_STR;
47
6.73k
  strcpy(fuzz_kv_overrides[0].val_str, model_arch);
48
6.73k
  std::strcpy(fuzz_kv_overrides[0].key, gen_arch);
49
50
6.73k
  params.kv_overrides =
51
6.73k
      (const struct llama_model_kv_override *)fuzz_kv_overrides;
52
53
6.73k
  if (setjmp(fuzzing_jmp_buf) == 0) {
54
6.73k
    auto *model = llama_model_load_from_file(filename, params);
55
6.73k
    if (model != nullptr) {
56
0
      llama_model_free(model);
57
0
    }
58
6.73k
  }
59
6.73k
  llama_backend_free();
60
61
6.73k
  unlink(filename);
62
6.73k
  return 0;
63
6.73k
}