1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
|
//===-- yaml-parser-fuzzer.cpp - Fuzzer for YAML parser -------------------===//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//
#include "llvm/ADT/StringRef.h"
#include "llvm/Support/YAMLParser.h"
using namespace llvm;
static bool isValidYaml(const uint8_t *Data, size_t Size) {
SourceMgr SM;
yaml::Stream Stream(StringRef(reinterpret_cast<const char *>(Data), Size),
SM);
return Stream.validate();
}
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
std::vector<uint8_t> Input(Data, Data + Size);
// Ensure we don't crash on any arbitrary byte string.
isValidYaml(Input.data(), Input.size());
// Ensure we don't crash on byte strings with no null characters.
llvm::erase_value(Input, 0);
Input.shrink_to_fit();
bool IsValidWithout0s = isValidYaml(Input.data(), Input.size());
// Ensure we don't crash on byte strings where the only null character is
// one-past-the-end of the actual input to the parser.
Input.push_back(0);
Input.shrink_to_fit();
bool IsValidWhen0Terminated = isValidYaml(Input.data(), Input.size() - 1);
// Ensure we don't crash on byte strings with no null characters, but with
// an invalid character one-past-the-end of the actual input to the parser.
Input.back() = 1;
bool IsValidWhen1Terminated = isValidYaml(Input.data(), Input.size() - 1);
// The parser should either accept all of these inputs, or reject all of
// them, because the parser sees an identical byte string in each case. This
// should hopefully catch some cases where the parser is sensitive to what is
// present one-past-the-end of the actual input.
if (IsValidWithout0s != IsValidWhen0Terminated ||
IsValidWhen0Terminated != IsValidWhen1Terminated)
LLVM_BUILTIN_TRAP;
return 0;
}
|
