/src/llama.cpp/fuzzers/fuzz_load_model.cpp
Line | Count | Source |
1 | | /* Copyright 2024 Google LLC |
2 | | Licensed under the Apache License, Version 2.0 (the "License"); |
3 | | you may not use this file except in compliance with the License. |
4 | | You may obtain a copy of the License at |
5 | | http://www.apache.org/licenses/LICENSE-2.0 |
6 | | Unless required by applicable law or agreed to in writing, software |
7 | | distributed under the License is distributed on an "AS IS" BASIS, |
8 | | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
9 | | See the License for the specific language governing permissions and |
10 | | limitations under the License. |
11 | | */ |
12 | | |
13 | | #include "llama.h" |
14 | | #include <iostream> |
15 | | #include <setjmp.h> |
16 | | #include <unistd.h> |
17 | | |
18 | | const char *model_arch = "llama"; |
19 | | const char *gen_arch = "general.architecture"; |
20 | | jmp_buf fuzzing_jmp_buf; |
21 | | |
22 | | struct llama_model_kv_override fuzz_kv_overrides[2]; |
23 | | |
24 | 9 | extern "C" void __wrap_abort(void) { longjmp(fuzzing_jmp_buf, 1); } |
25 | | |
26 | 6.73k | extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { |
27 | 6.73k | llama_backend_init(); |
28 | | |
29 | 6.73k | char filename[256]; |
30 | 6.73k | sprintf(filename, "/tmp/libfuzzer.%d", getpid()); |
31 | | |
32 | 6.73k | FILE *fp = fopen(filename, "wb"); |
33 | 6.73k | if (!fp) { |
34 | 0 | return 0; |
35 | 0 | } |
36 | 6.73k | fwrite(data, size, 1, fp); |
37 | 6.73k | fclose(fp); |
38 | | |
39 | 6.73k | auto params = llama_model_default_params(); |
40 | 6.73k | params.load_mode = LLAMA_LOAD_MODE_NONE; |
41 | 6.73k | params.progress_callback = [](float progress, void *ctx) { |
42 | 0 | (void)ctx; |
43 | 0 | return progress > 0.50; |
44 | 0 | }; |
45 | | |
46 | 6.73k | fuzz_kv_overrides[0].tag = LLAMA_KV_OVERRIDE_TYPE_STR; |
47 | 6.73k | strcpy(fuzz_kv_overrides[0].val_str, model_arch); |
48 | 6.73k | std::strcpy(fuzz_kv_overrides[0].key, gen_arch); |
49 | | |
50 | 6.73k | params.kv_overrides = |
51 | 6.73k | (const struct llama_model_kv_override *)fuzz_kv_overrides; |
52 | | |
53 | 6.73k | if (setjmp(fuzzing_jmp_buf) == 0) { |
54 | 6.73k | auto *model = llama_model_load_from_file(filename, params); |
55 | 6.73k | if (model != nullptr) { |
56 | 0 | llama_model_free(model); |
57 | 0 | } |
58 | 6.73k | } |
59 | 6.73k | llama_backend_free(); |
60 | | |
61 | 6.73k | unlink(filename); |
62 | 6.73k | return 0; |
63 | 6.73k | } |