Line | Count | Source |
1 | | /* Copyright 2026 Google LLC |
2 | | |
3 | | Licensed under the Apache License, Version 2.0 (the "License"); |
4 | | you may not use this file except in compliance with the License. |
5 | | You may obtain a copy of the License at |
6 | | |
7 | | http://www.apache.org/licenses/LICENSE-2.0 |
8 | | |
9 | | Unless required by applicable law or agreed to in writing, software |
10 | | distributed under the License is distributed on an "AS IS" BASIS, |
11 | | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
12 | | See the License for the specific language governing permissions and |
13 | | limitations under the License. |
14 | | */ |
15 | | |
16 | | #include <stdint.h> |
17 | | #include <stdio.h> |
18 | | #include <string.h> |
19 | | #include <vector> |
20 | | #include <string> |
21 | | |
22 | | #include "muParserDLL.h" |
23 | | |
24 | | // Callbacks |
25 | 0 | muFloat_t MyFun1(muFloat_t v) { return v * 2; } |
26 | 0 | muFloat_t MyFun2(muFloat_t v1, muFloat_t v2) { return v1 + v2; } |
27 | 0 | muFloat_t MyInfixFun(muFloat_t v) { return -v; } |
28 | 0 | muFloat_t MyPostfixFun(muFloat_t v) { return v + 1; } |
29 | 0 | muFloat_t MyOprtFun(muFloat_t v1, muFloat_t v2) { return v1 * v2 + 1; } |
30 | | |
31 | 0 | muFloat_t* MyVarFactory(const muChar_t* name, void* pUserData) { |
32 | 0 | static muFloat_t v[10]; |
33 | 0 | return v; |
34 | 0 | } |
35 | | |
36 | 0 | muInt_t MyIdentFun(const muChar_t* name, muInt_t* pos, muFloat_t* val) { |
37 | 0 | if (strncmp(name, "test", 4) == 0) { |
38 | 0 | *val = 123.0; |
39 | 0 | *pos += 4; |
40 | 0 | return 1; |
41 | 0 | } |
42 | 0 | return 0; |
43 | 0 | } |
44 | | |
45 | 0 | extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { |
46 | 0 | if (size < 10) return 0; |
47 | | |
48 | | // Use the first few bytes for configuration |
49 | 0 | uint8_t config = data[0]; |
50 | 0 | uint8_t config2 = data[1]; |
51 | 0 | int base_type = (config & 0x01) ? muBASETYPE_INT : muBASETYPE_FLOAT; |
52 | | |
53 | 0 | muParserHandle_t hParser = mupCreate(base_type); |
54 | 0 | if (!hParser) return 0; |
55 | | |
56 | | // Remaining data as expression |
57 | 0 | size_t expr_size = (size - 2) / 2; |
58 | 0 | std::string expr((char *)(data + 2), expr_size); |
59 | 0 | mupSetExpr(hParser, expr.c_str()); |
60 | |
|
61 | 0 | std::string custom_chars((char *)(data + 2 + expr_size), size - 2 - expr_size); |
62 | | |
63 | | // Conditional configurations based on config bits |
64 | 0 | if (config & 0x02) { |
65 | 0 | mupDefineInfixOprt(hParser, "!", MyInfixFun, 0, 1); |
66 | 0 | } |
67 | 0 | if (config & 0x04) { |
68 | 0 | mupDefinePostfixOprt(hParser, "!!", MyPostfixFun, 1); |
69 | 0 | } |
70 | 0 | if (config & 0x08) { |
71 | 0 | mupDefineOprt(hParser, "shr", MyOprtFun, 0, muOPRT_ASCT_LEFT, 1); |
72 | 0 | } |
73 | 0 | if (config & 0x10) { |
74 | 0 | mupSetVarFactory(hParser, MyVarFactory, NULL); |
75 | 0 | } |
76 | 0 | if (config & 0x20) { |
77 | 0 | mupAddValIdent(hParser, MyIdentFun); |
78 | 0 | } |
79 | | |
80 | 0 | if (!custom_chars.empty()) { |
81 | 0 | if (config & 0x40) { |
82 | 0 | mupDefineNameChars(hParser, custom_chars.c_str()); |
83 | 0 | } |
84 | 0 | if (config & 0x80) { |
85 | 0 | mupDefineOprtChars(hParser, custom_chars.c_str()); |
86 | 0 | } |
87 | 0 | } |
88 | | |
89 | | // Set some common things anyway |
90 | 0 | muFloat_t v1[10] = {1.0}; |
91 | 0 | mupDefineVar(hParser, "v1", v1); |
92 | 0 | mupDefineConst(hParser, "c1", 3.14); |
93 | 0 | mupDefineStrConst(hParser, "s1", "hello"); |
94 | | |
95 | | // From c_api_fuzzer.cc |
96 | 0 | mupDefineFun1(hParser, "f1", MyFun1, 1); |
97 | 0 | mupDefineFun2(hParser, "f2", MyFun2, 1); |
98 | | |
99 | | // Evaluate |
100 | 0 | try { |
101 | 0 | if (config2 & 0x01) { |
102 | | // Bulk mode evaluation |
103 | 0 | muFloat_t results[10]; |
104 | 0 | mupEvalBulk(hParser, results, 10); |
105 | 0 | } else { |
106 | 0 | mupEval(hParser); |
107 | | |
108 | | // Try mupEvalMulti only if no error occurred in mupEval |
109 | 0 | if (!mupError(hParser)) { |
110 | 0 | int nNum; |
111 | 0 | mupEvalMulti(hParser, &nNum); |
112 | 0 | } |
113 | 0 | } |
114 | 0 | } catch (...) { |
115 | 0 | } |
116 | | |
117 | | // Error handling |
118 | 0 | if (mupError(hParser)) { |
119 | 0 | mupGetErrorCode(hParser); |
120 | 0 | mupGetErrorPos(hParser); |
121 | 0 | mupGetErrorMsg(hParser); |
122 | 0 | mupGetErrorToken(hParser); |
123 | 0 | } |
124 | |
|
125 | 0 | mupRelease(hParser); |
126 | 0 | return 0; |
127 | 0 | } |