/proc/self/cwd/pw_protobuf/decoder_fuzzer.cc

Source (jump to first uncovered line)
// Copyright 2022 The Pigweed Authors
//
// Licensed under the Apache License, Version 2.0 (the "License"); you may not
// use this file except in compliance with the License. You may obtain a copy of
// the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
// WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
// License for the specific language governing permissions and limitations under
// the License.

#include <algorithm>
#include <cstddef>
#include <cstdint>
#include <cstring>
#include <vector>

#include "fuzz.h"
#include "pw_fuzzer/fuzzed_data_provider.h"
#include "pw_protobuf/stream_decoder.h"
#include "pw_span/span.h"
#include "pw_status/status.h"
#include "pw_status/status_with_size.h"
#include "pw_stream/memory_stream.h"
#include "pw_stream/stream.h"

namespace pw::protobuf::fuzz {
namespace {

void RecursiveFuzzedDecode(FuzzedDataProvider& provider,
                           StreamDecoder& decoder,
                           uint32_t depth = 0) {
  constexpr size_t kMaxRepeatedRead = 256;
  constexpr size_t kMaxDepth = 3;

  if (depth > kMaxDepth) {
    return;
  }
  while (provider.remaining_bytes() != 0 && decoder.Next().ok()) {
    FieldType field_type = provider.ConsumeEnum<FieldType>();
    switch (field_type) {
      case kUint32:
        if (!decoder.ReadUint32().status().ok()) {
          return;
        }
        break;
      case kPackedUint32: {
        uint32_t packed[kMaxRepeatedRead] = {0};
        if (!decoder.ReadPackedUint32(packed).status().ok()) {
          return;
        }
      } break;
      case kUint64:
        if (!decoder.ReadUint64().status().ok()) {
          return;
        }
        break;
      case kPackedUint64: {
        uint64_t packed[kMaxRepeatedRead] = {0};
        if (!decoder.ReadPackedUint64(packed).status().ok()) {
          return;
        }
      } break;
      case kInt32:
        if (!decoder.ReadInt32().status().ok()) {
          return;
        }
        break;
      case kPackedInt32: {
        int32_t packed[kMaxRepeatedRead] = {0};
        if (!decoder.ReadPackedInt32(packed).status().ok()) {
          return;
        }
      } break;
      case kInt64:
        if (!decoder.ReadInt64().status().ok()) {
          return;
        }
        break;
      case kPackedInt64: {
        int64_t packed[kMaxRepeatedRead] = {0};
        if (!decoder.ReadPackedInt64(packed).status().ok()) {
          return;
        }
      } break;
      case kSint32:
        if (!decoder.ReadSint32().status().ok()) {
          return;
        }
        break;
      case kPackedSint32: {
        int32_t packed[kMaxRepeatedRead] = {0};
        if (!decoder.ReadPackedSint32(packed).status().ok()) {
          return;
        }
      } break;
      case kSint64:
        if (!decoder.ReadSint64().status().ok()) {
          return;
        }
        break;
      case kPackedSint64: {
        int64_t packed[kMaxRepeatedRead] = {0};
        if (!decoder.ReadPackedSint64(packed).status().ok()) {
          return;
        }
      } break;
      case kBool:
        if (!decoder.ReadBool().status().ok()) {
          return;
        }
        break;
      case kFixed32:
        if (!decoder.ReadFixed32().status().ok()) {
          return;
        }
        break;
      case kPackedFixed32: {
        uint32_t packed[kMaxRepeatedRead] = {0};
        if (!decoder.ReadPackedFixed32(packed).status().ok()) {
          return;
        }
      } break;
      case kFixed64:
        if (!decoder.ReadFixed64().status().ok()) {
          return;
        }
        break;
      case kPackedFixed64: {
        uint64_t packed[kMaxRepeatedRead] = {0};
        if (!decoder.ReadPackedFixed64(packed).status().ok()) {
          return;
        }
      } break;
      case kSfixed32:
        if (!decoder.ReadSfixed32().status().ok()) {
          return;
        }
        break;
      case kPackedSfixed32: {
        int32_t packed[kMaxRepeatedRead] = {0};
        if (!decoder.ReadPackedSfixed32(packed).status().ok()) {
          return;
        }
      } break;
      case kSfixed64:
        if (!decoder.ReadSfixed64().status().ok()) {
          return;
        }
        break;
      case kPackedSfixed64: {
        int64_t packed[kMaxRepeatedRead] = {0};
        if (!decoder.ReadPackedSfixed64(packed).status().ok()) {
          return;
        }
      } break;
      case kFloat:
        if (!decoder.ReadFloat().status().ok()) {
          return;
        }
        break;
      case kPackedFloat: {
        float packed[kMaxRepeatedRead] = {0};
        if (!decoder.ReadPackedFloat(packed).status().ok()) {
          return;
        }
      } break;
      case kDouble:
        if (!decoder.ReadDouble().status().ok()) {
          return;
        }
        break;
      case kPackedDouble: {
        double packed[kMaxRepeatedRead] = {0};
        if (!decoder.ReadPackedDouble(packed).status().ok()) {
          return;
        }
      } break;
      case kBytes: {
        std::byte bytes[kMaxRepeatedRead] = {std::byte{0}};
        if (!decoder.ReadBytes(bytes).status().ok()) {
          return;
        }
      } break;
      case kString: {
        char str[kMaxRepeatedRead] = {0};
        if (!decoder.ReadString(str).status().ok()) {
          return;
        }
      } break;
      case kPush: {
        StreamDecoder nested_decoder = decoder.GetNestedDecoder();
        RecursiveFuzzedDecode(provider, nested_decoder, depth + 1);
      } break;
      case kPop:
        if (depth > 0) {
          // Special "field". The marks the end of a nested message.
          return;
        }
    }
  }
}

void TestOneInput(FuzzedDataProvider& provider) {
  constexpr size_t kMaxFuzzedProtoSize = 4096;
  std::vector<std::byte> proto_message_data = provider.ConsumeBytes<std::byte>(
      provider.ConsumeIntegralInRange<size_t>(0, kMaxFuzzedProtoSize));
  stream::MemoryReader memory_reader(proto_message_data);
  StreamDecoder decoder(memory_reader);
  RecursiveFuzzedDecode(provider, decoder);
}

}  // namespace
}  // namespace pw::protobuf::fuzz

extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
  FuzzedDataProvider provider(data, size);
  pw::protobuf::fuzz::TestOneInput(provider);
  return 0;
}

Coverage Report

Created: 2024-04-15 06:29

Line	Count	Source (jump to first uncovered line)
1		// Copyright 2022 The Pigweed Authors
2		//
3		// Licensed under the Apache License, Version 2.0 (the "License"); you may not
4		// use this file except in compliance with the License. You may obtain a copy of
5		// the License at
6		//
7		// https://www.apache.org/licenses/LICENSE-2.0
8		//
9		// Unless required by applicable law or agreed to in writing, software
10		// distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
11		// WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
12		// License for the specific language governing permissions and limitations under
13		// the License.
14
15		#include <algorithm>
16		#include <cstddef>
17		#include <cstdint>
18		#include <cstring>
19		#include <vector>
20
21		#include "fuzz.h"
22		#include "pw_fuzzer/fuzzed_data_provider.h"
23		#include "pw_protobuf/stream_decoder.h"
24		#include "pw_span/span.h"
25		#include "pw_status/status.h"
26		#include "pw_status/status_with_size.h"
27		#include "pw_stream/memory_stream.h"
28		#include "pw_stream/stream.h"
29
30		namespace pw::protobuf::fuzz {
31		namespace {
32
33		void RecursiveFuzzedDecode(FuzzedDataProvider& provider,
34		StreamDecoder& decoder,
35	5.15k	uint32_t depth = 0) {
36	5.15k	constexpr size_t kMaxRepeatedRead = 256;
37	5.15k	constexpr size_t kMaxDepth = 3;
38
39	5.15k	if (depth > kMaxDepth) {
40	724	return;
41	724	}
42	14.8k	while (provider.remaining_bytes() != 0 && decoder.Next().ok()) {
43	12.0k	FieldType field_type = provider.ConsumeEnum<FieldType>();
44	12.0k	switch (field_type) {
45	434	case kUint32:
46	434	if (!decoder.ReadUint32().status().ok()) {
47	141	return;
48	141	}
49	293	break;
50	423	case kPackedUint32: {
51	423	uint32_t packed[kMaxRepeatedRead] = {0};
52	423	if (!decoder.ReadPackedUint32(packed).status().ok()) {
53	122	return;
54	122	}
55	423	} break;
56	301	case kUint64:
57	224	if (!decoder.ReadUint64().status().ok()) {
58	25	return;
59	25	}
60	199	break;
61	446	case kPackedUint64: {
62	446	uint64_t packed[kMaxRepeatedRead] = {0};
63	446	if (!decoder.ReadPackedUint64(packed).status().ok()) {
64	80	return;
65	80	}
66	446	} break;
67	493	case kInt32:
68	493	if (!decoder.ReadInt32().status().ok()) {
69	192	return;
70	192	}
71	301	break;
72	314	case kPackedInt32: {
73	314	int32_t packed[kMaxRepeatedRead] = {0};
74	314	if (!decoder.ReadPackedInt32(packed).status().ok()) {
75	45	return;
76	45	}
77	314	} break;
78	269	case kInt64:
79	234	if (!decoder.ReadInt64().status().ok()) {
80	33	return;
81	33	}
82	201	break;
83	289	case kPackedInt64: {
84	289	int64_t packed[kMaxRepeatedRead] = {0};
85	289	if (!decoder.ReadPackedInt64(packed).status().ok()) {
86	43	return;
87	43	}
88	289	} break;
89	406	case kSint32:
90	406	if (!decoder.ReadSint32().status().ok()) {
91	109	return;
92	109	}
93	297	break;
94	434	case kPackedSint32: {
95	434	int32_t packed[kMaxRepeatedRead] = {0};
96	434	if (!decoder.ReadPackedSint32(packed).status().ok()) {
97	141	return;
98	141	}
99	434	} break;
100	293	case kSint64:
101	249	if (!decoder.ReadSint64().status().ok()) {
102	45	return;
103	45	}
104	204	break;
105	300	case kPackedSint64: {
106	300	int64_t packed[kMaxRepeatedRead] = {0};
107	300	if (!decoder.ReadPackedSint64(packed).status().ok()) {
108	43	return;
109	43	}
110	300	} break;
111	265	case kBool:
112	265	if (!decoder.ReadBool().status().ok()) {
113	189	return;
114	189	}
115	76	break;
116	351	case kFixed32:
117	351	if (!decoder.ReadFixed32().status().ok()) {
118	8	return;
119	8	}
120	343	break;
121	440	case kPackedFixed32: {
122	440	uint32_t packed[kMaxRepeatedRead] = {0};
123	440	if (!decoder.ReadPackedFixed32(packed).status().ok()) {
124	45	return;
125	45	}
126	440	} break;
127	395	case kFixed64:
128	212	if (!decoder.ReadFixed64().status().ok()) {
129	15	return;
130	15	}
131	197	break;
132	321	case kPackedFixed64: {
133	321	uint64_t packed[kMaxRepeatedRead] = {0};
134	321	if (!decoder.ReadPackedFixed64(packed).status().ok()) {
135	43	return;
136	43	}
137	321	} break;
138	416	case kSfixed32:
139	416	if (!decoder.ReadSfixed32().status().ok()) {
140	8	return;
141	8	}
142	408	break;
143	408	case kPackedSfixed32: {
144	341	int32_t packed[kMaxRepeatedRead] = {0};
145	341	if (!decoder.ReadPackedSfixed32(packed).status().ok()) {
146	42	return;
147	42	}
148	341	} break;
149	299	case kSfixed64:
150	207	if (!decoder.ReadSfixed64().status().ok()) {
151	7	return;
152	7	}
153	200	break;
154	412	case kPackedSfixed64: {
155	412	int64_t packed[kMaxRepeatedRead] = {0};
156	412	if (!decoder.ReadPackedSfixed64(packed).status().ok()) {
157	26	return;
158	26	}
159	412	} break;
160	386	case kFloat:
161	253	if (!decoder.ReadFloat().status().ok()) {
162	10	return;
163	10	}
164	243	break;
165	320	case kPackedFloat: {
166	320	float packed[kMaxRepeatedRead] = {0};
167	320	if (!decoder.ReadPackedFloat(packed).status().ok()) {
168	30	return;
169	30	}
170	320	} break;
171	290	case kDouble:
172	207	if (!decoder.ReadDouble().status().ok()) {
173	5	return;
174	5	}
175	202	break;
176	255	case kPackedDouble: {
177	255	double packed[kMaxRepeatedRead] = {0};
178	255	if (!decoder.ReadPackedDouble(packed).status().ok()) {
179	20	return;
180	20	}
181	255	} break;
182	512	case kBytes: {
183	512	std::byte bytes[kMaxRepeatedRead] = {std::byte{0}};
184	512	if (!decoder.ReadBytes(bytes).status().ok()) {
185	45	return;
186	45	}
187	512	} break;
188	492	case kString: {
189	492	char str[kMaxRepeatedRead] = {0};
190	492	if (!decoder.ReadString(str).status().ok()) {
191	58	return;
192	58	}
193	492	} break;
194	2.77k	case kPush: {
195	2.77k	StreamDecoder nested_decoder = decoder.GetNestedDecoder();
196	2.77k	RecursiveFuzzedDecode(provider, nested_decoder, depth + 1);
197	2.77k	} break;
198	0	case kPop:
199	0	if (depth > 0) {
200		// Special "field". The marks the end of a nested message.
201	0	return;
202	0	}
203	12.0k	}
204	12.0k	}
205	4.43k	}
206
207	2.37k	void TestOneInput(FuzzedDataProvider& provider) {
208	2.37k	constexpr size_t kMaxFuzzedProtoSize = 4096;
209	2.37k	std::vector<std::byte> proto_message_data = provider.ConsumeBytes<std::byte>(
210	2.37k	provider.ConsumeIntegralInRange<size_t>(0, kMaxFuzzedProtoSize));
211	2.37k	stream::MemoryReader memory_reader(proto_message_data);
212	2.37k	StreamDecoder decoder(memory_reader);
213	2.37k	RecursiveFuzzedDecode(provider, decoder);
214	2.37k	}
215
216		} // namespace
217		} // namespace pw::protobuf::fuzz
218
219	6.62k	extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
220	6.62k	FuzzedDataProvider provider(data, size);
221	6.62k	pw::protobuf::fuzz::TestOneInput(provider);
222	6.62k	return 0;
223	6.62k	}