1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
|
/*
* Copyright 2020 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include <functional>
#include "fuzzer/FuzzedDataProvider.h"
#include "utils/BitSet.h"
static constexpr uint8_t MAX_OPERATIONS = 50;
// We need to handle both 32 and 64 bit bitsets, so we use a function template
// here. Sadly, std::function can't be generic, so we generate a vector of
// std::functions using this function.
template <typename T>
std::vector<std::function<void(T, uint32_t)>> getOperationsForType() {
return {
[](T bs, uint32_t val) -> void { bs.markBit(val); },
[](T bs, uint32_t val) -> void { bs.valueForBit(val); },
[](T bs, uint32_t val) -> void { bs.hasBit(val); },
[](T bs, uint32_t val) -> void { bs.clearBit(val); },
[](T bs, uint32_t val) -> void { bs.getIndexOfBit(val); },
[](T bs, uint32_t) -> void { bs.clearFirstMarkedBit(); },
[](T bs, uint32_t) -> void { bs.markFirstUnmarkedBit(); },
[](T bs, uint32_t) -> void { bs.clearLastMarkedBit(); },
[](T bs, uint32_t) -> void { bs.clear(); },
[](T bs, uint32_t) -> void { bs.count(); },
[](T bs, uint32_t) -> void { bs.isEmpty(); },
[](T bs, uint32_t) -> void { bs.isFull(); },
[](T bs, uint32_t) -> void { bs.firstMarkedBit(); },
[](T bs, uint32_t) -> void { bs.lastMarkedBit(); },
};
}
// Our operations for 32 and 64 bit bitsets
static const std::vector<std::function<void(android::BitSet32, uint32_t)>> thirtyTwoBitOps =
getOperationsForType<android::BitSet32>();
static const std::vector<std::function<void(android::BitSet64, uint32_t)>> sixtyFourBitOps =
getOperationsForType<android::BitSet64>();
void runOperationFor32Bit(android::BitSet32 bs, uint32_t bit, uint8_t operation) {
thirtyTwoBitOps[operation](bs, bit);
}
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
FuzzedDataProvider dataProvider(data, size);
uint32_t thirty_two_base = dataProvider.ConsumeIntegral<uint32_t>();
uint64_t sixty_four_base = dataProvider.ConsumeIntegral<uint64_t>();
android::BitSet32 b1 = android::BitSet32(thirty_two_base);
android::BitSet64 b2 = android::BitSet64(sixty_four_base);
size_t opsRun = 0;
while (dataProvider.remaining_bytes() > 0 && opsRun++ < MAX_OPERATIONS) {
uint32_t bit = dataProvider.ConsumeIntegral<uint32_t>();
uint8_t op = dataProvider.ConsumeIntegral<uint8_t>();
thirtyTwoBitOps[op % thirtyTwoBitOps.size()](b1, bit);
sixtyFourBitOps[op % sixtyFourBitOps.size()](b2, bit);
}
return 0;
}
|
