[libc] Add strcspn fuzz test

[michaelrj]

libc/fuzzing/string/strcspn_fuzz.cpp

23

afaik it's best practice to use a segment of the data passed to the fuzzer if you need a random number, so that the test is more repeatable. For an example you can see how the base is selected in strtointeger_fuzz.cpp.

libc/fuzzing/string/CMakeLists.txt

SRCS
     strcpy_fuzz.cpp
   DEPENDS
     libc.src.string.memcpy
     libc.src.string.strcpy
     libc.src.string.strlen
 )
 
 add_libc_fuzzer(
+  strcspn_fuzz
+  SRCS
+    strcspn_fuzz.cpp
+  DEPENDS
+    libc.src.string.strcspn
+)
+
+add_libc_fuzzer(
   strstr_fuzz
   SRCS
     strstr_fuzz.cpp
   DEPENDS
     libc.src.string.strstr
     libc.src.string.strlen
 )

libc/fuzzing/string/strcspn_fuzz.cpp

+//===-- strcspn_fuzx.cpp -------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+///
+/// Fuzzing test for llvm-libc strcspn implementation.
+///
+//===----------------------------------------------------------------------===//
+
+#include "src/string/strcspn.h"
+#include <stddef.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  if (size == 0)
+    return 0;
+
+  size_t delim_size = (rand() % size);
+  char *reject_str = new char[delim_size + 1];
+  memcpy(reject_str, data, delim_size);
+  reject_str[delim_size] = 0;
+  size -= delim_size;
+  data += delim_size;
+
+  char *input_str = new char[size + 1];
+  memcpy(input_str, data, size);
+  input_str[size] = '\0';
+
+  size_t result = __llvm_libc::strcspn(input_str, reject_str);
+  if (result > size)
+    __builtin_trap();
+
+  delete[] input_str;
+  delete[] reject_str;
+
+  return 0;
+}