Coverage Report

Created: 2025-08-31 07:02

/src/fuzz_buffer.c
Line
Count
Source (jump to first uncovered line)
1
/* Copyright 2021 Google LLC
2
Licensed under the Apache License, Version 2.0 (the "License");
3
you may not use this file except in compliance with the License.
4
You may obtain a copy of the License at
5
      http://www.apache.org/licenses/LICENSE-2.0
6
Unless required by applicable law or agreed to in writing, software
7
distributed under the License is distributed on an "AS IS" BASIS,
8
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
9
See the License for the specific language governing permissions and
10
limitations under the License.
11
*/
12
13
14
#include "config.h"
15
#include "syshead.h"
16
#include "misc.h"
17
#include "buffer.h"
18
19
#include "fuzz_randomizer.h"
20
21
7
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
22
7
  fuzz_random_init(data,size);
23
24
7
  struct gc_arena gc;
25
7
  struct buffer *bufp;
26
7
  struct buffer buf, buf2;
27
7
  struct buffer_list *buflistp = NULL;
28
7
  ssize_t generic_ssizet, _size;
29
7
  char *tmp;
30
7
  char *tmp2;
31
7
  char match;
32
33
7
  gc = gc_new();
34
7
  bufp = NULL;
35
36
7
  int total_to_fuzz = fuzz_randomizer_get_int(1, 20);
37
79
  for (int i = 0; i < total_to_fuzz; i++) {
38
72
    if (bufp == NULL) {
39
7
      generic_ssizet = fuzz_randomizer_get_int(0, 1);
40
7
      if (generic_ssizet == 0) {
41
3
        _size = fuzz_randomizer_get_int(0, 100);
42
3
        buf = alloc_buf_gc(_size, &gc);
43
3
        bufp = &buf;
44
4
      } else {
45
4
        tmp = get_random_string();
46
4
        buf = string_alloc_buf(tmp, &gc);
47
4
        bufp = &buf;
48
4
        free(tmp);
49
4
        tmp = NULL;
50
4
      }
51
65
    } else {
52
65
#define NUM_TARGETS 31
53
65
      generic_ssizet = fuzz_randomizer_get_int(0, NUM_TARGETS);
54
65
      switch (generic_ssizet) {
55
24
      case 0:
56
24
        buf_clear(bufp);
57
24
        break;
58
5
      case 1:
59
5
        buf2 = clone_buf(bufp);
60
5
        free_buf(&buf2);
61
5
        break;
62
2
      case 2:
63
2
        buf_defined(bufp);
64
2
        break;
65
1
      case 3:
66
1
        buf_valid(bufp);
67
1
        break;
68
1
      case 4:
69
1
        buf_bptr(bufp);
70
1
        break;
71
3
      case 5:
72
3
        buf_len(bufp);
73
3
        break;
74
1
      case 6:
75
1
        buf_bend(bufp);
76
1
        break;
77
0
      case 7:
78
0
        buf_blast(bufp);
79
0
        break;
80
1
      case 8:
81
1
        buf_str(bufp);
82
1
        break;
83
1
      case 9:
84
1
        generic_ssizet = fuzz_randomizer_get_int(0, 255);
85
1
        buf_rmtail(bufp, (uint8_t)generic_ssizet);
86
1
        break;
87
1
      case 10:
88
1
        buf_chomp(bufp);
89
1
        break;
90
1
      case 11:
91
1
        tmp = get_random_string();
92
1
        skip_leading_whitespace(tmp);
93
1
        free(tmp);
94
1
        tmp = NULL;
95
1
        break;
96
0
      case 12:
97
0
        tmp = get_random_string();
98
0
        chomp(tmp);
99
0
        free(tmp);
100
0
        tmp = NULL;
101
0
        break;
102
0
      case 13:
103
0
        tmp = get_random_string();
104
0
        tmp2 = get_random_string();
105
0
        rm_trailing_chars(tmp, tmp2);
106
0
        free(tmp);
107
0
        free(tmp2);
108
0
        tmp = NULL;
109
0
        tmp2 = NULL;
110
0
        break;
111
0
      case 14:
112
0
        tmp = get_random_string();
113
0
        string_clear(tmp);
114
0
        free(tmp);
115
0
        tmp = NULL;
116
0
        break;
117
3
      case 15:
118
3
        tmp = get_random_string();
119
3
        buf_string_match_head_str(bufp, tmp);
120
3
        free(tmp);
121
3
        tmp = NULL;
122
3
        break;
123
5
      case 16:
124
5
        tmp = get_random_string();
125
5
        buf_string_compare_advance(bufp, tmp);
126
5
        free(tmp);
127
5
        tmp = NULL;
128
5
        break;
129
1
      case 17:
130
1
        generic_ssizet = fuzz_randomizer_get_int(0, 255);
131
132
1
        tmp = get_random_string();
133
1
        if (strlen(tmp) > 0) {
134
1
          buf_parse(bufp, (int)generic_ssizet, tmp, strlen(tmp));
135
1
        }
136
137
1
        free(tmp);
138
1
        tmp = NULL;
139
1
        break;
140
1
      case 18:
141
1
        tmp = get_random_string();
142
1
        string_mod(tmp, fuzz_randomizer_get_int(0, 12312),
143
1
                   fuzz_randomizer_get_int(0, 23141234),
144
1
                   (char)fuzz_randomizer_get_int(0, 255));
145
146
1
        free(tmp);
147
1
        tmp = NULL;
148
1
        break;
149
3
      case 19:
150
3
        tmp = get_random_string();
151
3
        match = (char)fuzz_randomizer_get_int(0, 255);
152
3
        if (match != 0) {
153
3
          string_replace_leading(tmp, match, (char)fuzz_randomizer_get_int(0, 255));
154
3
        }
155
156
3
        free(tmp);
157
3
        tmp = NULL;
158
3
        break;
159
0
      case 20:
160
0
        tmp = get_random_string();
161
0
        buf_write(bufp, tmp, strlen(tmp));
162
163
0
        free(tmp);
164
0
        tmp = NULL;
165
0
        break;
166
1
      case 21:
167
1
        tmp = get_random_string();
168
169
1
        buf_write_prepend(bufp, tmp, strlen(tmp));
170
171
1
        free(tmp);
172
1
        tmp = NULL;
173
1
        break;
174
2
      case 22:
175
2
        buf_write_u8(bufp, fuzz_randomizer_get_int(0, 255));
176
2
        break;
177
5
      case 23:
178
5
        buf_write_u16(bufp, fuzz_randomizer_get_int(0, 1024));
179
5
        break;
180
1
      case 24:
181
1
        buf_write_u32(bufp, fuzz_randomizer_get_int(0, 12312));
182
1
        break;
183
0
      case 25:
184
0
        tmp = get_random_string();
185
0
        buf_catrunc(bufp, tmp);
186
0
        free(tmp);
187
0
        tmp = NULL;
188
0
        break;
189
0
      case 26:
190
0
        tmp = get_random_string();
191
0
        buf_puts(bufp, tmp);
192
0
        free(tmp);
193
0
        tmp = NULL;
194
0
        break;
195
0
      case 27:
196
0
        buf_advance(bufp, fuzz_randomizer_get_int(0, 25523));
197
0
        break;
198
1
      case 28:
199
1
        buf_prepend(bufp, fuzz_randomizer_get_int(0, 251235));
200
1
        break;
201
0
      case 29:
202
0
        buf_reverse_capacity(bufp);
203
0
        break;
204
0
      case 30:
205
0
        buf_forward_capacity_total(bufp);
206
0
        break;
207
1
      case 31:
208
1
        buf_forward_capacity(bufp);
209
1
        break;
210
65
      }
211
65
    }
212
213
72
    if (buflistp == NULL) {
214
22
      buflistp = buffer_list_new();
215
50
    } else {
216
50
#define NUM_LIST_TARGETS 6
217
50
      generic_ssizet = fuzz_randomizer_get_int(0, NUM_LIST_TARGETS);
218
50
      switch (generic_ssizet) {
219
16
      case 0:
220
16
        buffer_list_free(buflistp);
221
16
        buflistp = NULL;
222
16
        break;
223
7
      case 1:
224
7
        buffer_list_defined(buflistp);
225
7
        break;
226
5
      case 2:
227
5
        tmp = get_random_string();
228
5
        if (strlen(tmp) < BUF_SIZE_MAX) {
229
5
          buffer_list_push(buflistp, tmp);
230
5
        }
231
5
        free(tmp);
232
5
        tmp = NULL;
233
5
        break;
234
5
      case 3:
235
5
        buffer_list_peek(buflistp);
236
5
        break;
237
8
      case 4:
238
8
        buffer_list_pop(buflistp);
239
8
        break;
240
4
      case 5:
241
4
        tmp = get_random_string();
242
4
        buffer_list_aggregate_separator(
243
4
            buflistp, fuzz_randomizer_get_int(0, 1024), tmp);
244
245
4
        free(tmp);
246
4
        tmp = NULL;
247
4
        break;
248
5
      case 6:
249
5
        buffer_list_aggregate(buflistp,
250
5
                              fuzz_randomizer_get_int(0, 1024));
251
5
        break;
252
50
      }
253
50
    }
254
72
  }
255
256
  // Cleanup
257
7
  buffer_list_free(buflistp);
258
7
  gc_free(&gc);
259
260
7
  fuzz_random_destroy();
261
262
7
  return 0;
263
7
}