[libc] Add basic fuzz target for the printf parser

[michaelrj]

Summary

The goal is to fuzz the entirety of printf, but the plan is to do it in
pieces for simplicity. This test fuzzes just the parser, while later
tests will fuzz the converters. This also adds a mock version of the
arg_list class.

[sivachandra]

I think the main fuzzer file is missing.

[michaelrj]

include main fuzzer file that I forgot

[sivachandra]

libc/fuzzing/stdio/mock_arg_list.h

18

It's not clear to me as to how this MockArgList is helping the fuzzer. Can please add comments explaining this?

33

This is not a virtual function. So, who/what is supposed to make use of this method?

libc/fuzzing/stdio/printf_parser_fuzz.cpp

20

Please add a detailed comment about the fuzzing strategy that is being employed here.

[michaelrj]

Add comment about how the fuzzer is intended to work.
Redo mock arg list so that it actually works.

[sivachandra]

libc/fuzzing/stdio/printf_parser_fuzz.cpp

41

Other than passing it to the Parser constructor, I don't see mock_arg_list being used anywhere. What am I missing?

libc/src/__support/arg_list.h

37 ↗

(On Diff #497471)

I am assuming that the use of this class is to get the number of args read out from the list. So, my suggestion is as follows. I would really not add a comment referencing printf or fuzz testing here. Also, you can add a mock class here unconditionally. The condition should be at the usage-site, which is the Parser class and the fuzzer, something like:

#ifdef LIBC_COPT_PRINTF_PARSER_WITH_MOCK_ARGS // Or a better name
using ArgProvider = MockArgList;
#else
using ArgProvider = ArgList;
#endif

Update Parser to take ArgProvider.

66 ↗

(On Diff #497471)

Since it is a mock, you can just return T(); and avoid implicit type casts and the void* specialization. Also, instead of overloading next_var to read the args fetched, you can add a new method, say:

size_t read_count() const { return arg_counter; }

[michaelrj]

move ArgList changes to https://reviews.llvm.org/D144145

libc/fuzzing/stdio/printf_parser_fuzz.cpp

41

You're not missing anything. The mock arg list is just there so that the program doesn't crash when the parser starts requesting arguments. It needs to respond with some value, but what that value actually is doesn't matter right now. Later I'll hopefully add a separate fuzz test that does check that the arguments were read in the right order, but this works for now.

libc/src/__support/arg_list.h

37 ↗

(On Diff #497471)

This seemed to be getting larger than should be in this patch, so I've split the ArgList changes into this other patch: https://reviews.llvm.org/D144145

[michaelrj]

rebase

libc/fuzzing/CMakeLists.txt

 set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fsanitize=fuzzer")
 add_custom_target(libc-fuzzer)
 
 add_subdirectory(math)
 add_subdirectory(stdlib)
+add_subdirectory(stdio)
 add_subdirectory(string)

libc/fuzzing/stdio/CMakeLists.txt

+add_header_library(
+  mock_arg_list
+  HDRS
+    mock_arg_list.h
+  DEPENDS
+    libc.src.__support.arg_list
+    libc.src.__support.common
+)
+
+add_libc_fuzzer(
+  printf_parser_fuzz
+  SRCS
+    printf_parser_fuzz.cpp
+  DEPENDS
+    libc.src.stdio.printf_core.parser
+    .mock_arg_list
+)

libc/fuzzing/stdio/mock_arg_list.h

+//===-- Mock arg list -------------------------------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_LIBC_FUZZING_STDIO_MOCK_ARG_LIST_H
+#define LLVM_LIBC_FUZZING_STDIO_MOCK_ARG_LIST_H
+
+#include "src/__support/common.h"
+
+#include "src/__support/arg_list.h"
+
+namespace __llvm_libc {
+namespace internal {
+class MockArgList : public ArgList {
+  int arg_counter = 0;
+
+public:
+  LIBC_INLINE MockArgList(ArgList any_arg_list) : ArgList(any_arg_list){};
+  LIBC_INLINE MockArgList(MockArgList &other) : ArgList(other) {
+    this->arg_counter = other.arg_counter;
+  }
+  LIBC_INLINE ~MockArgList() = default;
+
+  LIBC_INLINE MockArgList &operator=(MockArgList &rhs) {
+    arg_counter = rhs.arg_counter;
+    return *this;
+  }
+
+  template <class T> LIBC_INLINE T next_var() {
+    ++arg_counter;
+    return static_cast<T>(arg_counter);
+  }
+};
+
+} // namespace internal
+} // namespace __llvm_libc
+
+#endif // LLVM_LIBC_FUZZING_STDIO_MOCK_ARG_LIST_H

libc/fuzzing/stdio/printf_parser_fuzz.cpp

+//===-- printf_parser_fuzz.cpp --------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+///
+/// Fuzzing test for llvm-libc qsort implementation.
+///
+//===----------------------------------------------------------------------===//
+
+#include "mock_arg_list.h"
+#include "src/stdio/printf_core/parser.h"
+
+#include <stdarg.h>
+#include <stdint.h>
+
+using namespace __llvm_libc;
+
+int arglist_func(const char *in_str, size_t size, ...) {
+
+  va_list vlist;
+  va_start(vlist, size);
+  auto arg_list = internal::ArgList(vlist);
+  va_end(vlist);
+
+  auto mock_arg_list = internal::MockArgList(arg_list);
+
+  auto parser = printf_core::Parser(in_str, mock_arg_list);
+
+  int str_percent_count = 0;
+
+  for (size_t i = 0; i < size && in_str[i] != '\0'; ++i) {
+    if (in_str[i] == '%') {
+      ++str_percent_count;
+    }
+  }
+
+  int section_percent_count = 0;
+
+  for (printf_core::FormatSection cur_section = parser.get_next_section();
+       !cur_section.raw_string.empty();
+       cur_section = parser.get_next_section()) {
+    if (cur_section.has_conv) {
+      ++section_percent_count;
+      if (cur_section.conv_name == '%') {
+        ++section_percent_count;
+      }
+    } else if (cur_section.raw_string[0] == '%') {
+      // If the conversion would be undefined, it's instead raw, but it still
+      // starts with a %.
+      ++section_percent_count;
+    }
+  }
+
+  if (str_percent_count != section_percent_count) {
+    __builtin_trap();
+  }
+  return 0;
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  char *in_str = new char[size + 1];
+
+  for (size_t i = 0; i < size; ++i)
+    in_str[i] = data[i];
+
+  in_str[size] = '\0';
+
+  int ret_val = arglist_func(in_str, size);
+
+  delete[] in_str;
+  return ret_val;
+}