Coverage Report

Created: 2025-12-31 06:13

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/fuzz_buffer.c
Line
Count
Source
1
/* Copyright 2021 Google LLC
2
Licensed under the Apache License, Version 2.0 (the "License");
3
you may not use this file except in compliance with the License.
4
You may obtain a copy of the License at
5
      http://www.apache.org/licenses/LICENSE-2.0
6
Unless required by applicable law or agreed to in writing, software
7
distributed under the License is distributed on an "AS IS" BASIS,
8
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
9
See the License for the specific language governing permissions and
10
limitations under the License.
11
*/
12
13
14
#include "config.h"
15
#include "syshead.h"
16
#include "misc.h"
17
#include "buffer.h"
18
19
#include "fuzz_randomizer.h"
20
21
12
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
22
12
  fuzz_random_init(data,size);
23
24
12
  struct gc_arena gc;
25
12
  struct buffer *bufp;
26
12
  struct buffer buf, buf2;
27
12
  struct buffer_list *buflistp = NULL;
28
12
  ssize_t generic_ssizet, _size;
29
12
  char *tmp;
30
12
  char *tmp2;
31
12
  char match;
32
33
12
  gc = gc_new();
34
12
  bufp = NULL;
35
36
12
  int total_to_fuzz = fuzz_randomizer_get_int(1, 20);
37
139
  for (int i = 0; i < total_to_fuzz; i++) {
38
127
    if (bufp == NULL) {
39
12
      generic_ssizet = fuzz_randomizer_get_int(0, 1);
40
12
      if (generic_ssizet == 0) {
41
7
        _size = fuzz_randomizer_get_int(0, 100);
42
7
        buf = alloc_buf_gc(_size, &gc);
43
7
        bufp = &buf;
44
7
      } else {
45
5
        tmp = get_random_string();
46
5
        buf = string_alloc_buf(tmp, &gc);
47
5
        bufp = &buf;
48
5
        free(tmp);
49
5
        tmp = NULL;
50
5
      }
51
115
    } else {
52
115
#define NUM_TARGETS 31
53
115
      generic_ssizet = fuzz_randomizer_get_int(0, NUM_TARGETS);
54
115
      switch (generic_ssizet) {
55
37
      case 0:
56
37
        buf_clear(bufp);
57
37
        break;
58
5
      case 1:
59
5
        buf2 = clone_buf(bufp);
60
5
        free_buf(&buf2);
61
5
        break;
62
3
      case 2:
63
3
        buf_defined(bufp);
64
3
        break;
65
1
      case 3:
66
1
        buf_valid(bufp);
67
1
        break;
68
1
      case 4:
69
1
        buf_bptr(bufp);
70
1
        break;
71
5
      case 5:
72
5
        buf_len(bufp);
73
5
        break;
74
5
      case 6:
75
5
        buf_bend(bufp);
76
5
        break;
77
3
      case 7:
78
3
        buf_blast(bufp);
79
3
        break;
80
1
      case 8:
81
1
        buf_str(bufp);
82
1
        break;
83
3
      case 9:
84
3
        generic_ssizet = fuzz_randomizer_get_int(0, 255);
85
3
        buf_rmtail(bufp, (uint8_t)generic_ssizet);
86
3
        break;
87
2
      case 10:
88
2
        buf_chomp(bufp);
89
2
        break;
90
1
      case 11:
91
1
        tmp = get_random_string();
92
1
        skip_leading_whitespace(tmp);
93
1
        free(tmp);
94
1
        tmp = NULL;
95
1
        break;
96
0
      case 12:
97
0
        tmp = get_random_string();
98
0
        chomp(tmp);
99
0
        free(tmp);
100
0
        tmp = NULL;
101
0
        break;
102
0
      case 13:
103
0
        tmp = get_random_string();
104
0
        tmp2 = get_random_string();
105
0
        rm_trailing_chars(tmp, tmp2);
106
0
        free(tmp);
107
0
        free(tmp2);
108
0
        tmp = NULL;
109
0
        tmp2 = NULL;
110
0
        break;
111
0
      case 14:
112
0
        tmp = get_random_string();
113
0
        string_clear(tmp);
114
0
        free(tmp);
115
0
        tmp = NULL;
116
0
        break;
117
3
      case 15:
118
3
        tmp = get_random_string();
119
3
        buf_string_match_head_str(bufp, tmp);
120
3
        free(tmp);
121
3
        tmp = NULL;
122
3
        break;
123
4
      case 16:
124
4
        tmp = get_random_string();
125
4
        buf_string_compare_advance(bufp, tmp);
126
4
        free(tmp);
127
4
        tmp = NULL;
128
4
        break;
129
2
      case 17:
130
2
        generic_ssizet = fuzz_randomizer_get_int(0, 255);
131
132
2
        tmp = get_random_string();
133
2
        if (strlen(tmp) > 0) {
134
2
          buf_parse(bufp, (int)generic_ssizet, tmp, strlen(tmp));
135
2
        }
136
137
2
        free(tmp);
138
2
        tmp = NULL;
139
2
        break;
140
1
      case 18:
141
1
        tmp = get_random_string();
142
1
        string_mod(tmp, fuzz_randomizer_get_int(0, 12312),
143
1
                   fuzz_randomizer_get_int(0, 23141234),
144
1
                   (char)fuzz_randomizer_get_int(0, 255));
145
146
1
        free(tmp);
147
1
        tmp = NULL;
148
1
        break;
149
2
      case 19:
150
2
        tmp = get_random_string();
151
2
        match = (char)fuzz_randomizer_get_int(0, 255);
152
2
        if (match != 0) {
153
2
          string_replace_leading(tmp, match, (char)fuzz_randomizer_get_int(0, 255));
154
2
        }
155
156
2
        free(tmp);
157
2
        tmp = NULL;
158
2
        break;
159
2
      case 20:
160
2
        tmp = get_random_string();
161
2
        buf_write(bufp, tmp, strlen(tmp));
162
163
2
        free(tmp);
164
2
        tmp = NULL;
165
2
        break;
166
7
      case 21:
167
7
        tmp = get_random_string();
168
169
7
        buf_write_prepend(bufp, tmp, strlen(tmp));
170
171
7
        free(tmp);
172
7
        tmp = NULL;
173
7
        break;
174
2
      case 22:
175
2
        buf_write_u8(bufp, fuzz_randomizer_get_int(0, 255));
176
2
        break;
177
20
      case 23:
178
20
        buf_write_u16(bufp, fuzz_randomizer_get_int(0, 1024));
179
20
        break;
180
1
      case 24:
181
1
        buf_write_u32(bufp, fuzz_randomizer_get_int(0, 12312));
182
1
        break;
183
0
      case 25:
184
0
        tmp = get_random_string();
185
0
        buf_catrunc(bufp, tmp);
186
0
        free(tmp);
187
0
        tmp = NULL;
188
0
        break;
189
0
      case 26:
190
0
        tmp = get_random_string();
191
0
        buf_puts(bufp, tmp);
192
0
        free(tmp);
193
0
        tmp = NULL;
194
0
        break;
195
0
      case 27:
196
0
        buf_advance(bufp, fuzz_randomizer_get_int(0, 25523));
197
0
        break;
198
2
      case 28:
199
2
        buf_prepend(bufp, fuzz_randomizer_get_int(0, 251235));
200
2
        break;
201
0
      case 29:
202
0
        buf_reverse_capacity(bufp);
203
0
        break;
204
1
      case 30:
205
1
        buf_forward_capacity_total(bufp);
206
1
        break;
207
1
      case 31:
208
1
        buf_forward_capacity(bufp);
209
1
        break;
210
115
      }
211
115
    }
212
213
127
    if (buflistp == NULL) {
214
36
      buflistp = buffer_list_new();
215
91
    } else {
216
91
#define NUM_LIST_TARGETS 6
217
91
      generic_ssizet = fuzz_randomizer_get_int(0, NUM_LIST_TARGETS);
218
91
      switch (generic_ssizet) {
219
28
      case 0:
220
28
        buffer_list_free(buflistp);
221
28
        buflistp = NULL;
222
28
        break;
223
7
      case 1:
224
7
        buffer_list_defined(buflistp);
225
7
        break;
226
4
      case 2:
227
4
        tmp = get_random_string();
228
4
        if (strlen(tmp) < BUF_SIZE_MAX) {
229
4
          buffer_list_push(buflistp, tmp);
230
4
        }
231
4
        free(tmp);
232
4
        tmp = NULL;
233
4
        break;
234
12
      case 3:
235
12
        buffer_list_peek(buflistp);
236
12
        break;
237
9
      case 4:
238
9
        buffer_list_pop(buflistp);
239
9
        break;
240
6
      case 5:
241
6
        tmp = get_random_string();
242
6
        buffer_list_aggregate_separator(
243
6
            buflistp, fuzz_randomizer_get_int(0, 1024), tmp);
244
245
6
        free(tmp);
246
6
        tmp = NULL;
247
6
        break;
248
25
      case 6:
249
25
        buffer_list_aggregate(buflistp,
250
25
                              fuzz_randomizer_get_int(0, 1024));
251
25
        break;
252
91
      }
253
91
    }
254
127
  }
255
256
  // Cleanup
257
12
  buffer_list_free(buflistp);
258
12
  gc_free(&gc);
259
260
12
  fuzz_random_destroy();
261
262
12
  return 0;
263
12
}