Coverage Report

Created: 2026-10-17 06:37

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/model_load_fuzzer.cc
Line
Count
Source
1
// Copyright 2026 Google LLC
2
//
3
// Licensed under the Apache License, Version 2.0 (the "License");
4
// you may not use this file except in compliance with the License.
5
// You may obtain a copy of the License at
6
//
7
//      http://www.apache.org/licenses/LICENSE-2.0
8
//
9
// Unless required by applicable law or agreed to in writing, software
10
// distributed under the License is distributed on an "AS IS" BASIS,
11
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
// See the License for the specific language governing permissions and
13
// limitations under the License.
14
15
// Fuzzer for SentencePiece model loading and post-load operations.
16
// Feeds arbitrary binary data as a serialized ModelProto, then exercises
17
// encoding/decoding if the model loads successfully.
18
19
#include <cstddef>
20
#include <cstdint>
21
#include <string>
22
#include <vector>
23
24
#include <fuzzer/FuzzedDataProvider.h>
25
#include "sentencepiece_processor.h"
26
27
10.1k
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
28
10.1k
  if (size < 4)
29
2
    return 0;
30
31
10.1k
  FuzzedDataProvider fdp(data, size);
32
33
  // Split data: most goes to model, some to test text
34
10.1k
  std::string model_data = fdp.ConsumeRandomLengthString(size);
35
10.1k
  std::string test_text = fdp.ConsumeRemainingBytesAsString();
36
37
10.1k
  sentencepiece::SentencePieceProcessor processor;
38
39
  // Try loading fuzz data as a serialized model proto
40
10.1k
  auto status = processor.LoadFromSerializedProto(model_data);
41
10.1k
  if (!status.ok())
42
4.81k
    return 0;
43
44
  // Model loaded successfully - exercise all major operations
45
46
  // Basic encoding
47
5.32k
  std::vector<std::string> pieces;
48
5.32k
  processor.Encode(test_text, &pieces);
49
50
  // Encode to IDs
51
5.32k
  std::vector<int> ids;
52
5.32k
  processor.Encode(test_text, &ids);
53
54
  // Decode from pieces
55
5.32k
  if (!pieces.empty()) {
56
4.58k
    std::string decoded;
57
4.58k
    processor.Decode(pieces, &decoded);
58
4.58k
  }
59
60
  // Decode from IDs
61
5.32k
  if (!ids.empty()) {
62
4.58k
    std::string decoded;
63
4.58k
    processor.Decode(ids, &decoded);
64
4.58k
  }
65
66
  // Normalization
67
5.32k
  std::string normalized;
68
5.32k
  processor.Normalize(test_text, &normalized);
69
70
  // Vocabulary operations
71
5.32k
  int vocab_size = processor.GetPieceSize();
72
5.32k
  if (vocab_size > 0) {
73
    // PieceToId / IdToPiece round-trip
74
32.8k
    for (int i = 0; i < vocab_size && i < 10; i++) {
75
27.5k
      std::string piece = processor.IdToPiece(i);
76
27.5k
      processor.PieceToId(piece);
77
27.5k
      processor.GetScore(i);
78
27.5k
      processor.IsUnknown(i);
79
27.5k
      processor.IsControl(i);
80
27.5k
      processor.IsUnused(i);
81
27.5k
      processor.IsByte(i);
82
27.5k
    }
83
84
    // Try lookup with test_text as a piece
85
5.32k
    processor.PieceToId(test_text);
86
5.32k
  }
87
88
  // Special token IDs
89
5.32k
  processor.unk_id();
90
5.32k
  processor.bos_id();
91
5.32k
  processor.eos_id();
92
5.32k
  processor.pad_id();
93
94
  // NBest encoding (with small nbest_size to avoid slowness)
95
5.32k
  std::vector<std::vector<std::string>> nbest_pieces;
96
5.32k
  processor.NBestEncode(test_text, 2, &nbest_pieces);
97
98
  // Sample encoding
99
5.32k
  std::vector<std::string> sampled;
100
5.32k
  processor.SampleEncode(test_text, 1, 0.5, &sampled);
101
102
  // Upstream dropped EncodeAsSerializedProto/SampleEncodeAsSerializedProto.
103
  // The piece-returning overloads reach the same encode paths; they are
104
  // [[nodiscard]], so keep the results alive.
105
5.32k
  const auto encoded_pieces = processor.EncodeAsPieces(test_text);
106
5.32k
  const auto sampled_pieces = processor.SampleEncodeAsPieces(test_text, 1, 0.5);
107
5.32k
  (void)encoded_pieces.size();
108
5.32k
  (void)sampled_pieces.size();
109
110
  // Get serialized model
111
5.32k
  processor.serialized_model_proto();
112
113
5.32k
  return 0;
114
10.1k
}