fuzzer-common.h 2.4 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677
  1. // Copyright (c) 2019, Paul Dreik
  2. // For the license information refer to format.h.
  3. #ifndef FUZZER_COMMON_H
  4. #define FUZZER_COMMON_H
  5. #include <fmt/core.h>
  6. #include <cstdint> // std::uint8_t
  7. #include <cstring> // memcpy
  8. #include <vector>
  9. // One can format to either a string, or a buffer. The latter is faster, but
  10. // one may be interested in formatting to a string instead to verify it works
  11. // as intended. To avoid a combinatoric explosion, select this at compile time
  12. // instead of dynamically from the fuzz data.
  13. #define FMT_FUZZ_FORMAT_TO_STRING 0
  14. // If {fmt} is given a buffer that is separately allocated, chances that address
  15. // sanitizer detects out of bound reads is much higher. However, it slows down
  16. // the fuzzing.
  17. #define FMT_FUZZ_SEPARATE_ALLOCATION 1
  18. // The size of the largest possible type in use.
  19. // To let the the fuzzer mutation be efficient at cross pollinating between
  20. // different types, use a fixed size format. The same bit pattern, interpreted
  21. // as another type, is likely interesting.
  22. constexpr auto fixed_size = 16;
  23. // Casts data to a char pointer.
  24. template <typename T> inline const char* as_chars(const T* data) {
  25. return reinterpret_cast<const char*>(data);
  26. }
  27. // Casts data to a byte pointer.
  28. template <typename T> inline const std::uint8_t* as_bytes(const T* data) {
  29. return reinterpret_cast<const std::uint8_t*>(data);
  30. }
  31. // Blits bytes from data to form an (assumed trivially constructible) object
  32. // of type Item.
  33. template <class Item> inline Item assign_from_buf(const std::uint8_t* data) {
  34. auto item = Item();
  35. std::memcpy(&item, data, sizeof(Item));
  36. return item;
  37. }
  38. // Reads a boolean value by looking at the first byte from data.
  39. template <> inline bool assign_from_buf<bool>(const std::uint8_t* data) {
  40. return *data != 0;
  41. }
  42. struct data_to_string {
  43. #if FMT_FUZZ_SEPARATE_ALLOCATION
  44. std::vector<char> buffer;
  45. data_to_string(const uint8_t* data, size_t size, bool add_terminator = false)
  46. : buffer(size + (add_terminator ? 1 : 0)) {
  47. if (size) {
  48. std::memcpy(buffer.data(), data, size);
  49. }
  50. }
  51. fmt::string_view get() const { return {buffer.data(), buffer.size()}; }
  52. #else
  53. fmt::string_view sv;
  54. data_to_string(const uint8_t* data, size_t size, bool = false)
  55. : str(as_chars(data), size) {}
  56. fmt::string_view get() const { return sv; }
  57. #endif
  58. const char* data() const { return get().data(); }
  59. };
  60. #endif // FUZZER_COMMON_H