diff --git a/libc/fuzzing/string/CMakeLists.txt b/libc/fuzzing/string/CMakeLists.txt --- a/libc/fuzzing/string/CMakeLists.txt +++ b/libc/fuzzing/string/CMakeLists.txt @@ -1,3 +1,11 @@ +add_libc_fuzzer( + strcmp_fuzz + SRCS + strcmp_fuzz.cpp + DEPENDS + libc.src.string.strcmp +) + add_libc_fuzzer( strcpy_fuzz SRCS @@ -9,9 +17,10 @@ ) add_libc_fuzzer( - strcmp_fuzz + strstr_fuzz SRCS - strcmp_fuzz.cpp + strstr_fuzz.cpp DEPENDS - libc.src.string.strcmp + libc.src.string.strstr + libc.src.string.strlen ) diff --git a/libc/fuzzing/string/strstr_fuzz.cpp b/libc/fuzzing/string/strstr_fuzz.cpp new file mode 100644 --- /dev/null +++ b/libc/fuzzing/string/strstr_fuzz.cpp @@ -0,0 +1,98 @@ +//===-- strstr_fuzz.cpp ---------------------------------------------------===// +// +// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. +// See https://llvm.org/LICENSE.txt for license information. +// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception +// +//===----------------------------------------------------------------------===// +/// +/// Fuzzing test for llvm-libc strstr implementation. +/// +//===----------------------------------------------------------------------===// + +#include "src/string/strcmp.h" +#include "src/string/strlen.h" +#include "src/string/strstr.h" +#include +#include + +// The general structure is to take the value of the first byte, set size1 to +// that value, and add the null terminator. size2 will then contain the rest of +// the bytes in data. +// For example, with inputs (data={2, 6, 4, 8, 0}, size=5): +// size1: data[0] = 2 +// data1: {2, 6} + '\0' = {2, 6, '\0'} +// size2: size - size1 = 3 +// data2: {4, 8, '\0'} +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + // Verify the size is at least 1 and the data is null terminated. + if (!size || data[size - 1] != '\0') + return 0; + + const size_t size1 = (data[0] <= size ? data[0] : size); + const size_t size2 = size - size1; + + // The first size will always be at least 1 since + // we need to append the null terminator. The second size + // needs to be checked since it must also contain the null + // terminator. + if (!size2) + return 0; + + // Copy the data into new containers. + // Add one to data1 for null terminator. + uint8_t *data1 = new uint8_t[size1 + 1]; + uint8_t *data2 = new uint8_t[size2]; + if (!data1 || !data2) + __builtin_trap(); + + size_t i; + for (i = 0; i < size1; ++i) + data1[i] = data[i]; + data1[size1] = '\0'; // Add null terminator to data1. + + for (size_t j = 0; j < size2; ++j) + data2[j] = data[i++]; + + const char *needle = reinterpret_cast(data1); + const char *haystack = reinterpret_cast(data2); + const char *actual_result = __llvm_libc::strstr(haystack, needle); + + // A null terminator may exist earlier. + const size_t haystack_size = __llvm_libc::strlen(haystack); + const size_t needle_size = __llvm_libc::strlen(needle); + + if (actual_result) { + // Verify that the first N characters of the result match the needle, + // where N is the length of needle. + for (size_t i = 0; i < needle_size; ++i) { + if (actual_result[i] != needle[i]) + __builtin_trap(); + } + const char *haystack_ptr = haystack; + // Verify that the result is the first occurence of the needle. + for (; haystack_ptr != actual_result; ++haystack_ptr) { + size_t equal_letter_count = 0; + for (size_t j = 0; j < needle_size && haystack_ptr[j]; ++j) { + equal_letter_count += (haystack_ptr[j] == needle[j]); + } + if (needle_size > 0 && equal_letter_count == needle_size) + __builtin_trap(); // There was an earlier occurence of the needle. + } + } else { + // No result was found. Verify that the needle doesn't exist within the + // haystack. + for (size_t i = 0; i + needle_size < haystack_size; ++i) { + size_t equal_letter_count = 0; + for (size_t j = 0; j < needle_size; ++j) { + equal_letter_count += (haystack[i + j] == needle[j]); + } + if (needle_size > 0 && equal_letter_count == needle_size) + __builtin_trap(); // There was an earlier occurence of the needle. + } + } + + delete[] data1; + delete[] data2; + return 0; +}