diff options
Diffstat (limited to 'fuzzers')
-rw-r--r-- | fuzzers/BUILD.gn | 18 | ||||
-rw-r--r-- | fuzzers/testdata/raw_or_ztf_gen_fuzzer/seed_proto.bin (renamed from fuzzers/testdata/raw_gen_fuzzer/seed_proto.bin) | 0 | ||||
-rw-r--r-- | fuzzers/ztf_gen_fuzzer.cc | 59 |
3 files changed, 75 insertions, 2 deletions
diff --git a/fuzzers/BUILD.gn b/fuzzers/BUILD.gn index 7afe6db..e11efc4 100644 --- a/fuzzers/BUILD.gn +++ b/fuzzers/BUILD.gn @@ -72,7 +72,7 @@ if (current_toolchain == host_toolchain && !is_win) { fuzzer_test("zucchini_raw_apply_fuzzer") { sources = [ - "raw_gen_fuzzer.cc", + "raw_apply_fuzzer.cc", ] deps = [ ":zucchini_file_pair_proto", @@ -95,6 +95,20 @@ if (current_toolchain == host_toolchain && !is_win) { "//components/zucchini:zucchini_lib", "//third_party/libprotobuf-mutator", ] - seed_corpus = "testdata/raw_gen_fuzzer" + seed_corpus = "testdata/raw_or_ztf_gen_fuzzer" + } + + # ZTF Gen Fuzzer: + fuzzer_test("zucchini_ztf_gen_fuzzer") { + sources = [ + "ztf_gen_fuzzer.cc", + ] + deps = [ + ":zucchini_file_pair_proto", + "//base", + "//components/zucchini:zucchini_lib", + "//third_party/libprotobuf-mutator", + ] + seed_corpus = "testdata/raw_or_ztf_gen_fuzzer" } } diff --git a/fuzzers/testdata/raw_gen_fuzzer/seed_proto.bin b/fuzzers/testdata/raw_or_ztf_gen_fuzzer/seed_proto.bin index 5939c72..5939c72 100644 --- a/fuzzers/testdata/raw_gen_fuzzer/seed_proto.bin +++ b/fuzzers/testdata/raw_or_ztf_gen_fuzzer/seed_proto.bin diff --git a/fuzzers/ztf_gen_fuzzer.cc b/fuzzers/ztf_gen_fuzzer.cc new file mode 100644 index 0000000..413d841 --- /dev/null +++ b/fuzzers/ztf_gen_fuzzer.cc @@ -0,0 +1,59 @@ +// Copyright 2018 The Chromium Authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +#include <stdint.h> + +#include <iostream> + +#include "base/environment.h" +#include "base/logging.h" +#include "components/zucchini/buffer_view.h" +#include "components/zucchini/fuzzers/file_pair.pb.h" +#include "components/zucchini/patch_writer.h" +#include "components/zucchini/zucchini_gen.h" +#include "testing/libfuzzer/proto/lpm_interface.h" + +namespace { + +constexpr int kMinImageSize = 16; +constexpr int kMaxImageSize = 1024; + +} // namespace + +struct Environment { + Environment() { + logging::SetMinLogLevel(logging::LOG_FATAL); // Disable console spamming. + } +}; + +Environment* env = new Environment(); + +DEFINE_BINARY_PROTO_FUZZER(const zucchini::fuzzers::FilePair& file_pair) { + // Dump code for debugging. + if (base::Environment::Create()->HasVar("LPM_DUMP_NATIVE_INPUT")) { + std::cout << "Old File: " << file_pair.old_file() << std::endl + << "New File: " << file_pair.new_or_patch_file() << std::endl; + } + + // Prepare data. These are originally Zucchini Text Format (ZTF) files but may + // in relatively unlikely circumstances mutate into other formats. + zucchini::ConstBufferView old_image( + reinterpret_cast<const uint8_t*>(file_pair.old_file().data()), + file_pair.old_file().size()); + zucchini::ConstBufferView new_image( + reinterpret_cast<const uint8_t*>(file_pair.new_or_patch_file().data()), + file_pair.new_or_patch_file().size()); + + // Restrict image sizes to speed up fuzzing. + if (old_image.size() < kMinImageSize || old_image.size() > kMaxImageSize || + new_image.size() < kMinImageSize || new_image.size() > kMaxImageSize) { + return; + } + + // Generate a patch writer. + zucchini::EnsemblePatchWriter patch_writer(old_image, new_image); + + // Fuzz Target. + zucchini::GenerateEnsemble(old_image, new_image, &patch_writer); +} |