Extend fuzzing set up

Adds a parse function ins `jv_parse.c` that enables parsing using custom
flags for the parser. This is then used by two fuzzers added as well.

This is to make sure fuzzing hits various code parts currently not
fuzzed, e.g. `stream_token`:
https://storage.googleapis.com/oss-fuzz-coverage/jq/reports/20231125/linux/src/jq/src/jv_parse.c.html#L241

Signed-off-by: David Korczynski <david@adalogics.com>
This commit is contained in:
David Korczynski authored and Emanuele Torre committed 2023-11-28 20:36:59 +01:00
1 parent 88f01a741c
commit 44300e4310
4 files changed
+94

No files matched your search

+29
View File
@@ -0,0 +1,29 @@
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include "jv.h"
int LLVMFuzzerTestOneInput(uint8_t *data, size_t size) {
if (size < 4) {
return 0;
}
int fuzz_flags = *(int*)data;
data += 4;
size -= 4;
// Creat null-terminated string
char *null_terminated = (char *)malloc(size + 1);
memcpy(null_terminated, (char *)data, size);
null_terminated[size] = '\0';
// Fuzzer entrypoint
jv res = jv_parse_custom_flags(null_terminated, fuzz_flags);
jv_free(res);
// Free the null-terminated string
free(null_terminated);
return 0;
}
+21
View File
@@ -0,0 +1,21 @@
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include "jv.h"
int LLVMFuzzerTestOneInput(uint8_t *data, size_t size) {
// Creat null-terminated string
char *null_terminated = (char *)malloc(size + 1);
memcpy(null_terminated, (char *)data, size);
null_terminated[size] = '\0';
// Fuzzer entrypoint
jv res = jv_parse_custom_flags(null_terminated, JV_PARSE_STREAMING);
jv_free(res);
// Free the null-terminated string
free(null_terminated);
return 0;
}