cr50_fuzz: Add libprotobuf-mutator support.

This uses protocol buffers to model what actions can be taken with
pinweaver at a higher level of abstraction than the raw requests to
greatly increase the coverage that can be achieved by fuzzing, while
still allowing for invalid inputs to be checked.

BRANCH=none
BUG=chromium:876582
TEST=sudo emerge libprotobuf-mutator &&
  make -j buildfuzztests && ./build/host/cr50_fuzz/cr50_fuzz.exe

Change-Id: Ie7ce569650ca06866f277f36eae61df2684de60c
Signed-off-by: Allen Webb <allenwebb@google.com>
Reviewed-on: https://chromium-review.googlesource.com/1184107
Reviewed-by: Mattias Nissler <mnissler@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

1 files changed, 56 insertions, 0 deletions

diff --git a/fuzz/span.h b/fuzz/span.h
new file mode 100644
index 0000000000..531df832a3
--- /dev/null
+++ b/fuzz/span.h
@@ -0,0 +1,56 @@
+// Copyright 2018 The Chromium OS Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef __FUZZ_SPAN_H
+#define __FUZZ_SPAN_H
+
+#include <unistd.h>
+
+#include <algorithm>
+
+namespace fuzz {
+
+template <typename T>
+class span {
+ public:
+  typedef T value_type;
+
+  constexpr span() : span<T>(nullptr, nullptr) {}
+  constexpr span(T* begin, size_t size) : begin_(begin), end_(begin + size) {}
+  constexpr span(T* begin, T* end) : begin_(begin), end_(end) {}
+
+  template <class Container>
+  constexpr span(Container& container)
+      : begin_(container.begin()), end_(container.end()){};
+
+  constexpr T* begin() const { return begin_; }
+  constexpr T* end() const { return end_; }
+
+  constexpr T* data() const { return begin_; }
+
+  constexpr bool empty() const { return begin_ == end_; }
+  constexpr size_t size() const { return end_ - begin_; }
+
+ private:
+  T* begin_;
+  T* end_;
+};
+
+template <typename Source, typename Destination>
+size_t CopyWithPadding(Source source,
+                       Destination destination,
+                       typename Destination::value_type fill_value) {
+  if (source.size() >= destination.size()) {
+    std::copy(source.begin(), source.begin() + destination.size(),
+              destination.begin());
+    return destination.size();
+  }
+  std::copy(source.begin(), source.end(), destination.begin());
+  std::fill(destination.begin() + source.size(), destination.end(), fill_value);
+  return source.size();
+}
+
+}  // namespace fuzz
+
+#endif  // __FUZZ_SPAN_H