Coverage Report

Created: 2026-08-31 06:18

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/model_load_fuzzer.cc
Line
Count
Source
1
// Copyright 2026 Google LLC
2
//
3
// Licensed under the Apache License, Version 2.0 (the "License");
4
// you may not use this file except in compliance with the License.
5
// You may obtain a copy of the License at
6
//
7
//      http://www.apache.org/licenses/LICENSE-2.0
8
//
9
// Unless required by applicable law or agreed to in writing, software
10
// distributed under the License is distributed on an "AS IS" BASIS,
11
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
// See the License for the specific language governing permissions and
13
// limitations under the License.
14
15
// Fuzzer for SentencePiece model loading and post-load operations.
16
// Feeds arbitrary binary data as a serialized ModelProto, then exercises
17
// encoding/decoding if the model loads successfully.
18
19
#include <cstddef>
20
#include <cstdint>
21
#include <string>
22
#include <vector>
23
24
#include <fuzzer/FuzzedDataProvider.h>
25
#include "sentencepiece_processor.h"
26
27
0
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
28
0
  if (size < 4)
29
0
    return 0;
30
31
0
  FuzzedDataProvider fdp(data, size);
32
33
  // Split data: most goes to model, some to test text
34
0
  std::string model_data = fdp.ConsumeRandomLengthString(size);
35
0
  std::string test_text = fdp.ConsumeRemainingBytesAsString();
36
37
0
  sentencepiece::SentencePieceProcessor processor;
38
39
  // Try loading fuzz data as a serialized model proto
40
0
  auto status = processor.LoadFromSerializedProto(model_data);
41
0
  if (!status.ok())
42
0
    return 0;
43
44
  // Model loaded successfully - exercise all major operations
45
46
  // Basic encoding
47
0
  std::vector<std::string> pieces;
48
0
  processor.Encode(test_text, &pieces);
49
50
  // Encode to IDs
51
0
  std::vector<int> ids;
52
0
  processor.Encode(test_text, &ids);
53
54
  // Decode from pieces
55
0
  if (!pieces.empty()) {
56
0
    std::string decoded;
57
0
    processor.Decode(pieces, &decoded);
58
0
  }
59
60
  // Decode from IDs
61
0
  if (!ids.empty()) {
62
0
    std::string decoded;
63
0
    processor.Decode(ids, &decoded);
64
0
  }
65
66
  // Normalization
67
0
  std::string normalized;
68
0
  processor.Normalize(test_text, &normalized);
69
70
  // Vocabulary operations
71
0
  int vocab_size = processor.GetPieceSize();
72
0
  if (vocab_size > 0) {
73
    // PieceToId / IdToPiece round-trip
74
0
    for (int i = 0; i < vocab_size && i < 10; i++) {
75
0
      std::string piece = processor.IdToPiece(i);
76
0
      processor.PieceToId(piece);
77
0
      processor.GetScore(i);
78
0
      processor.IsUnknown(i);
79
0
      processor.IsControl(i);
80
0
      processor.IsUnused(i);
81
0
      processor.IsByte(i);
82
0
    }
83
84
    // Try lookup with test_text as a piece
85
0
    processor.PieceToId(test_text);
86
0
  }
87
88
  // Special token IDs
89
0
  processor.unk_id();
90
0
  processor.bos_id();
91
0
  processor.eos_id();
92
0
  processor.pad_id();
93
94
  // NBest encoding (with small nbest_size to avoid slowness)
95
0
  std::vector<std::vector<std::string>> nbest_pieces;
96
0
  processor.NBestEncode(test_text, 2, &nbest_pieces);
97
98
  // Sample encoding
99
0
  std::vector<std::string> sampled;
100
0
  processor.SampleEncode(test_text, 1, 0.5, &sampled);
101
102
  // Upstream dropped EncodeAsSerializedProto/SampleEncodeAsSerializedProto.
103
  // The piece-returning overloads reach the same encode paths; they are
104
  // [[nodiscard]], so keep the results alive.
105
0
  const auto encoded_pieces = processor.EncodeAsPieces(test_text);
106
0
  const auto sampled_pieces = processor.SampleEncodeAsPieces(test_text, 1, 0.5);
107
0
  (void)encoded_pieces.size();
108
0
  (void)sampled_pieces.size();
109
110
  // Get serialized model
111
0
  processor.serialized_model_proto();
112
113
0
  return 0;
114
0
}