1 files changed, 49 insertions, 0 deletions
diff --git a/test/fuzzer/MagicSeparatorTest.cpp b/test/fuzzer/MagicSeparatorTest.cpp
new file mode 100644
index 000000000..2c0fbc90c
--- /dev/null
+++ b/test/fuzzer/MagicSeparatorTest.cpp
@@ -0,0 +1,49 @@
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+
+// Simple test for a fuzzer.
+// This is a sample fuzz target for a custom serialization format that uses
+// a magic separator to split the input into several independent buffers.
+// The fuzzer must find the input consisting of 2 subinputs: "Fuzz" and "me".
+#include <cassert>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+
+#include <algorithm>
+#include <vector>
+
+// Splits [data,data+size) into a vector of strings using a "magic" Separator.
+std::vector<std::vector<uint8_t>> SplitInput(const uint8_t *Data, size_t Size,
+                                     const uint8_t *Separator,
+                                     size_t SeparatorSize) {
+  std::vector<std::vector<uint8_t>> Res;
+  assert(SeparatorSize > 0);
+  auto Beg = Data;
+  auto End = Data + Size;
+  // Using memmem here. std::search may be harder for libFuzzer today.
+  while (const uint8_t *Pos = (const uint8_t *)memmem(Beg, End - Beg,
+                                     Separator, SeparatorSize)) {
+    Res.push_back({Beg, Pos});
+    Beg = Pos + SeparatorSize;
+  }
+  if (Beg < End)
+    Res.push_back({Beg, End});
+  return Res;
+}
+
+static volatile int *Nil = nullptr;
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+  if (Size > 10) return 0;  // To make the test quick.
+  const uint8_t Separator[] = {0xDE, 0xAD, 0xBE, 0xEF};
+  auto Inputs = SplitInput(Data, Size, Separator, sizeof(Separator));
+  std::vector<uint8_t> Fuzz({'F', 'u', 'z', 'z'});
+  std::vector<uint8_t> Me({'m', 'e'});
+  if (Inputs.size() == 2 && Inputs[0] == Fuzz && Inputs[1] == Me)
+    *Nil = 42;  // crash.
+  return 0;
+}
+