Extend fuzzing set up
Adds a parse function ins `jv_parse.c` that enables parsing using custom flags for the parser. This is then used by two fuzzers added as well. This is to make sure fuzzing hits various code parts currently not fuzzed, e.g. `stream_token`: https://storage.googleapis.com/oss-fuzz-coverage/jq/reports/20231125/linux/src/jq/src/jv_parse.c.html#L241 Signed-off-by: David Korczynski <david@adalogics.com>
This commit is contained in:
1 parent
88f01a741c
commit
44300e4310
4 files changed
+94
No files matched your search
@@ -0,0 +1,29 @@
|
||||
#include <stdint.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
#include "jv.h"
|
||||
|
||||
int LLVMFuzzerTestOneInput(uint8_t *data, size_t size) {
|
||||
if (size < 4) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
int fuzz_flags = *(int*)data;
|
||||
data += 4;
|
||||
size -= 4;
|
||||
|
||||
// Creat null-terminated string
|
||||
char *null_terminated = (char *)malloc(size + 1);
|
||||
memcpy(null_terminated, (char *)data, size);
|
||||
null_terminated[size] = '\0';
|
||||
|
||||
// Fuzzer entrypoint
|
||||
jv res = jv_parse_custom_flags(null_terminated, fuzz_flags);
|
||||
jv_free(res);
|
||||
|
||||
// Free the null-terminated string
|
||||
free(null_terminated);
|
||||
|
||||
return 0;
|
||||
}
|
||||
@@ -0,0 +1,21 @@
|
||||
#include <stdint.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
#include "jv.h"
|
||||
|
||||
int LLVMFuzzerTestOneInput(uint8_t *data, size_t size) {
|
||||
// Creat null-terminated string
|
||||
char *null_terminated = (char *)malloc(size + 1);
|
||||
memcpy(null_terminated, (char *)data, size);
|
||||
null_terminated[size] = '\0';
|
||||
|
||||
// Fuzzer entrypoint
|
||||
jv res = jv_parse_custom_flags(null_terminated, JV_PARSE_STREAMING);
|
||||
jv_free(res);
|
||||
|
||||
// Free the null-terminated string
|
||||
free(null_terminated);
|
||||
|
||||
return 0;
|
||||
}
|
||||
Reference in new issue
Block a user