Coverage Report

Created: 2026-06-10 06:31

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/tmux/fuzz/format-fuzzer.c
Line
Count
Source
1
/*
2
 * Copyright (c) 2026 David Korczynski <david@adalogics.com>
3
 *
4
 * Permission to use, copy, modify, and distribute this software for any
5
 * purpose with or without fee is hereby granted, provided that the above
6
 * copyright notice and this permission notice appear in all copies.
7
 *
8
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12
 * WHATSOEVER RESULTING FROM LOSS OF MIND, USE, DATA OR PROFITS, WHETHER
13
 * IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
14
 * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15
 */
16
17
/*
18
 * Fuzz the tmux format string expander (format_expand).
19
 *
20
 * This exercises:
21
 *   - format.c (format parsing, modifier chains, conditionals, math, regex)
22
 *   - colour.c (colour name and RGB parsing within formats)
23
 *   - utf8.c (UTF-8 width calculations in format padding)
24
 */
25
26
#include <stddef.h>
27
#include <string.h>
28
29
#include "tmux.h"
30
31
struct event_base *libevent;
32
33
int
34
LLVMFuzzerTestOneInput(const u_char *data, size_t size)
35
3.55k
{
36
3.55k
  struct format_tree  *ft;
37
3.55k
  char      *buf, *expanded;
38
39
3.55k
  if (size > 2048 || size == 0)
40
0
    return 0;
41
42
  /* Null-terminate the input for format_expand. */
43
3.55k
  buf = malloc(size + 1);
44
3.55k
  if (buf == NULL)
45
0
    return 0;
46
3.55k
  memcpy(buf, data, size);
47
3.55k
  buf[size] = '\0';
48
49
3.55k
  ft = format_create(NULL, NULL, 0, FORMAT_NOJOBS);
50
3.55k
  format_add(ft, "session_name", "%s", "fuzz-session");
51
3.55k
  format_add(ft, "window_index", "%d", 0);
52
3.55k
  format_add(ft, "window_name", "%s", "fuzz-window");
53
3.55k
  format_add(ft, "pane_index", "%d", 0);
54
3.55k
  format_add(ft, "pane_id", "%s", "%%0");
55
3.55k
  format_add(ft, "host", "%s", "fuzzhost");
56
3.55k
  format_add(ft, "pane_width", "%d", 80);
57
3.55k
  format_add(ft, "pane_height", "%d", 25);
58
59
3.55k
  expanded = format_expand(ft, buf);
60
3.55k
  free(expanded);
61
3.55k
  format_free(ft);
62
63
3.55k
  free(buf);
64
3.55k
  return 0;
65
3.55k
}
66
67
int
68
LLVMFuzzerInitialize(__unused int *argc, __unused char ***argv)
69
7
{
70
7
  const struct options_table_entry  *oe;
71
72
7
  global_environ = environ_create();
73
7
  global_options = options_create(NULL);
74
7
  global_s_options = options_create(NULL);
75
7
  global_w_options = options_create(NULL);
76
1.56k
  for (oe = options_table; oe->name != NULL; oe++) {
77
1.55k
    if (oe->scope & OPTIONS_TABLE_SERVER)
78
175
      options_default(global_options, oe);
79
1.55k
    if (oe->scope & OPTIONS_TABLE_SESSION)
80
784
      options_default(global_s_options, oe);
81
1.55k
    if (oe->scope & OPTIONS_TABLE_WINDOW)
82
595
      options_default(global_w_options, oe);
83
1.55k
  }
84
7
  libevent = osdep_event_init();
85
7
  socket_path = xstrdup("dummy");
86
87
7
  return 0;
88
7
}