Dylan Katz | 9d5845b | 2020-05-11 15:44:01 -0700 | [diff] [blame] | 1 | /* |
| 2 | * Copyright 2020 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | #include <iostream> |
| 17 | |
| 18 | #include "fuzzer/FuzzedDataProvider.h" |
| 19 | #include "utils/String16.h" |
| 20 | static constexpr int MAX_STRING_BYTES = 256; |
| 21 | static constexpr uint8_t MAX_OPERATIONS = 50; |
| 22 | |
| 23 | std::vector<std::function<void(FuzzedDataProvider&, android::String16, android::String16)>> |
| 24 | operations = { |
| 25 | |
| 26 | // Bytes and size |
| 27 | ([](FuzzedDataProvider&, android::String16 str1, android::String16) -> void { |
| 28 | str1.string(); |
| 29 | }), |
| 30 | ([](FuzzedDataProvider&, android::String16 str1, android::String16) -> void { |
| 31 | str1.isStaticString(); |
| 32 | }), |
| 33 | ([](FuzzedDataProvider&, android::String16 str1, android::String16) -> void { |
| 34 | str1.size(); |
| 35 | }), |
| 36 | |
Dylan Katz | 9d5845b | 2020-05-11 15:44:01 -0700 | [diff] [blame] | 37 | // Comparison |
| 38 | ([](FuzzedDataProvider&, android::String16 str1, android::String16 str2) -> void { |
| 39 | str1.startsWith(str2); |
| 40 | }), |
| 41 | ([](FuzzedDataProvider&, android::String16 str1, android::String16 str2) -> void { |
| 42 | str1.contains(str2.string()); |
| 43 | }), |
| 44 | ([](FuzzedDataProvider&, android::String16 str1, android::String16 str2) -> void { |
| 45 | str1.compare(str2); |
| 46 | }), |
| 47 | |
| 48 | // Append and format |
| 49 | ([](FuzzedDataProvider&, android::String16 str1, android::String16 str2) -> void { |
| 50 | str1.append(str2); |
| 51 | }), |
| 52 | ([](FuzzedDataProvider& dataProvider, android::String16 str1, |
| 53 | android::String16 str2) -> void { |
| 54 | int pos = dataProvider.ConsumeIntegralInRange<int>(0, str1.size()); |
| 55 | str1.insert(pos, str2.string()); |
| 56 | }), |
| 57 | |
| 58 | // Find and replace operations |
| 59 | ([](FuzzedDataProvider& dataProvider, android::String16 str1, |
| 60 | android::String16) -> void { |
| 61 | char16_t findChar = dataProvider.ConsumeIntegral<char16_t>(); |
| 62 | str1.findFirst(findChar); |
| 63 | }), |
| 64 | ([](FuzzedDataProvider& dataProvider, android::String16 str1, |
| 65 | android::String16) -> void { |
| 66 | char16_t findChar = dataProvider.ConsumeIntegral<char16_t>(); |
| 67 | str1.findLast(findChar); |
| 68 | }), |
| 69 | ([](FuzzedDataProvider& dataProvider, android::String16 str1, |
| 70 | android::String16) -> void { |
| 71 | char16_t findChar = dataProvider.ConsumeIntegral<char16_t>(); |
| 72 | char16_t replaceChar = dataProvider.ConsumeIntegral<char16_t>(); |
| 73 | str1.replaceAll(findChar, replaceChar); |
| 74 | }), |
Dylan Katz | 9d5845b | 2020-05-11 15:44:01 -0700 | [diff] [blame] | 75 | }; |
| 76 | |
| 77 | void callFunc(uint8_t index, FuzzedDataProvider& dataProvider, android::String16 str1, |
| 78 | android::String16 str2) { |
| 79 | operations[index](dataProvider, str1, str2); |
| 80 | } |
| 81 | |
| 82 | extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { |
| 83 | FuzzedDataProvider dataProvider(data, size); |
| 84 | // We're generating two char vectors. |
| 85 | // First, generate lengths. |
| 86 | const size_t kVecOneLen = dataProvider.ConsumeIntegralInRange<size_t>(1, MAX_STRING_BYTES); |
| 87 | const size_t kVecTwoLen = dataProvider.ConsumeIntegralInRange<size_t>(1, MAX_STRING_BYTES); |
| 88 | |
| 89 | // Next, populate the vectors |
| 90 | std::vector<char> vec = dataProvider.ConsumeBytesWithTerminator<char>(kVecOneLen); |
| 91 | std::vector<char> vec_two = dataProvider.ConsumeBytesWithTerminator<char>(kVecTwoLen); |
| 92 | |
| 93 | // Get pointers to their data |
| 94 | char* char_one = vec.data(); |
| 95 | char* char_two = vec_two.data(); |
| 96 | |
| 97 | // Create UTF16 representations |
| 98 | android::String16 str_one_utf16 = android::String16(char_one); |
| 99 | android::String16 str_two_utf16 = android::String16(char_two); |
| 100 | |
| 101 | // Run operations against strings |
| 102 | int opsRun = 0; |
| 103 | while (dataProvider.remaining_bytes() > 0 && opsRun++ < MAX_OPERATIONS) { |
| 104 | uint8_t op = dataProvider.ConsumeIntegralInRange<uint8_t>(0, operations.size() - 1); |
| 105 | callFunc(op, dataProvider, str_one_utf16, str_two_utf16); |
| 106 | } |
| 107 | |
Dylan Katz | 9d5845b | 2020-05-11 15:44:01 -0700 | [diff] [blame] | 108 | return 0; |
| 109 | } |