1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
|
// Copyright 2023 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef CHROME_TEST_FUZZING_IN_PROCESS_PROTO_FUZZER_H_
#define CHROME_TEST_FUZZING_IN_PROCESS_PROTO_FUZZER_H_
#include "chrome/test/fuzzing/in_process_fuzzer.h"
#include "testing/libfuzzer/proto/lpm_interface.h"
#define DEFINE_PROTO_FUZZER_IN_PROCESS_IMPL(use_binary, arg) \
static void TestOneProtoInput(arg); \
using FuzzerProtoType = \
protobuf_mutator::libfuzzer::macro_internal::GetFirstParam< \
decltype(&TestOneProtoInput)>::type; \
DEFINE_CUSTOM_PROTO_MUTATOR_IMPL(use_binary, FuzzerProtoType) \
DEFINE_CUSTOM_PROTO_CROSSOVER_IMPL(use_binary, FuzzerProtoType) \
DEFINE_POST_PROCESS_PROTO_MUTATION_IMPL(FuzzerProtoType)
// Register a text-based proto in process fuzzer.
// The argument should be a class implementing InProcessTextProtoFuzzer,
// parameterized by the <protobuf fuzz case type>
#define REGISTER_TEXT_PROTO_IN_PROCESS_FUZZER(arg) \
REGISTER_IN_PROCESS_FUZZER(arg) \
DEFINE_PROTO_FUZZER_IN_PROCESS_IMPL(false, arg::FuzzCase testcase)
// Same as REGISTER_TEXT_PROTO_IN_PROCESS_FUZZER but uses a binary
// protobuf. The argument should be a class implementing
// InProcessBinaryProtoFuzzer. May offer speed advantages at the expense of
// corpus clarity, but that's not currently clear.
#define REGISTER_BINARY_PROTO_IN_PROCESS_FUZZER(arg) \
REGISTER_IN_PROCESS_FUZZER(arg) \
DEFINE_PROTO_FUZZER_IN_PROCESS_IMPL(true, arg::FuzzCase testcase)
template <typename Proto>
class InProcessTextProtoFuzzer : public InProcessFuzzer {
public:
using FuzzCase = Proto;
// Constructor. Optionally pass options through to the InProcessFuzzer
// constructor.
// NOLINTNEXTLINE(runtime/explicit)
InProcessTextProtoFuzzer(InProcessFuzzerOptions options = {})
: InProcessFuzzer(options) {}
protected:
int Fuzz(const uint8_t* data, size_t size) override {
using protobuf_mutator::libfuzzer::LoadProtoInput;
FuzzCase fuzz_case;
if (!LoadProtoInput(/*binary=*/false, data, size, &fuzz_case)) {
return -1;
}
return Fuzz(fuzz_case);
}
// Execute a fuzz case using the given input.
virtual int Fuzz(const FuzzCase& fuzz_case) = 0;
};
template <typename Proto>
class InProcessBinaryProtoFuzzer : public InProcessFuzzer {
public:
using FuzzCase = Proto;
// Constructor. Optionally pass options through to the InProcessFuzzer
// constructor.
// NOLINTNEXTLINE(runtime/explicit)
InProcessBinaryProtoFuzzer(InProcessFuzzerOptions options = {})
: InProcessFuzzer(options) {}
protected:
int Fuzz(const uint8_t* data, size_t size) override {
using protobuf_mutator::libfuzzer::LoadProtoInput;
FuzzCase fuzz_case;
if (!LoadProtoInput(/*binary=*/true, data, size, &fuzz_case)) {
return -1;
}
return Fuzz(fuzz_case);
}
// Execute a fuzz case using the given input.
virtual int Fuzz(const FuzzCase& fuzz_case) = 0;
};
#endif // CHROME_TEST_FUZZING_IN_PROCESS_PROTO_FUZZER_H_
|
