You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
79 lines
2.7 KiB
79 lines
2.7 KiB
//===-- strcmp_fuzz.cpp ---------------------------------------------------===//
|
|
//
|
|
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
|
|
// See https://llvm.org/LICENSE.txt for license information.
|
|
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
///
|
|
/// Fuzzing test for llvm-libc strcmp implementation.
|
|
///
|
|
//===----------------------------------------------------------------------===//
|
|
#include "src/string/strcmp.h"
|
|
#include <stddef.h>
|
|
#include <stdint.h>
|
|
|
|
// The general structure is to take the value of the first byte, set size1 to
|
|
// that value, and add the null terminator. size2 will then contain the rest of
|
|
// the bytes in data.
|
|
// For example, with inputs (data={2, 6, 4, 8, 0}, size=5):
|
|
// size1: data[0] = 2
|
|
// data1: {2, 6} + '\0' = {2, 6, '\0'}
|
|
// size2: size - size1 = 3
|
|
// data2: {4, 8, '\0'}
|
|
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
|
// Verify the size is at least 1 and the data is null terminated.
|
|
if (!size || data[size - 1] != '\0')
|
|
return 0;
|
|
|
|
const size_t size1 = (data[0] <= size ? data[0] : size);
|
|
const size_t size2 = size - size1;
|
|
|
|
// The first size will always be at least 1 since
|
|
// we need to append the null terminator. The second size
|
|
// needs to be checked since it must also contain the null
|
|
// terminator.
|
|
if (!size2)
|
|
return 0;
|
|
|
|
// Copy the data into new containers.
|
|
// Add one to data1 for null terminator.
|
|
uint8_t *data1 = new uint8_t[size1 + 1];
|
|
uint8_t *data2 = new uint8_t[size2];
|
|
if (!data1 || !data2)
|
|
__builtin_trap();
|
|
|
|
size_t i;
|
|
for (i = 0; i < size1; ++i)
|
|
data1[i] = data[i];
|
|
data1[size1] = '\0'; // Add null terminator to data1.
|
|
|
|
for (size_t j = 0; j < size2; ++j)
|
|
data2[j] = data[i++];
|
|
|
|
const char *s1 = reinterpret_cast<const char *>(data1);
|
|
const char *s2 = reinterpret_cast<const char *>(data2);
|
|
size_t k = 0;
|
|
// Iterate until a null terminator is hit or the character comparison is
|
|
// different.
|
|
while (s1[k] && s2[k] && s1[k] == s2[k])
|
|
++k;
|
|
|
|
const unsigned char ch1 = static_cast<unsigned char>(s1[k]);
|
|
const unsigned char ch2 = static_cast<unsigned char>(s2[k]);
|
|
// The expected result should be the difference between the first non-equal
|
|
// characters of s1 and s2. If all characters are equal, the expected result
|
|
// should be '\0' - '\0' = 0.
|
|
if (__llvm_libc::strcmp(s1, s2) != ch1 - ch2)
|
|
__builtin_trap();
|
|
|
|
// Verify reversed operands. This should be the negated value of the previous
|
|
// result, except of course if the previous result was zero.
|
|
if (__llvm_libc::strcmp(s2, s1) != ch2 - ch1)
|
|
__builtin_trap();
|
|
|
|
delete[] data1;
|
|
delete[] data2;
|
|
return 0;
|
|
}
|