diff options
author | Michael Jones <michaelrj@google.com> | 2022-12-15 16:36:59 -0800 |
---|---|---|
committer | Michael Jones <michaelrj@google.com> | 2022-12-20 10:48:34 -0800 |
commit | f1990feb35e835ab81d6351dd4b6ef3dccc4aca5 (patch) | |
tree | a7463a4f88ce1fa279268be9d18ad5cde7bbb490 /libc/fuzzing | |
parent | 4c13af22b4d40506ff756c1d48c5e57701d59e13 (diff) | |
download | llvm-f1990feb35e835ab81d6351dd4b6ef3dccc4aca5.tar.gz |
[libc] add fuzz target for strtointeger functions
The string to integer conversion functions are well suited to
differential fuzzing, and this patch adds a target to enable just that.
It also fixes a bug in the fuzzing comparison logic and changes atoi
slightly to match the behavior described in the C standard.
Reviewed By: sivachandra, lntue
Differential Revision: https://reviews.llvm.org/D140178
Diffstat (limited to 'libc/fuzzing')
-rw-r--r-- | libc/fuzzing/math/Compare.h | 2 | ||||
-rw-r--r-- | libc/fuzzing/stdlib/CMakeLists.txt | 33 | ||||
-rw-r--r-- | libc/fuzzing/stdlib/StringParserOutputDiff.h | 24 | ||||
-rw-r--r-- | libc/fuzzing/stdlib/strtointeger_differential_fuzz.cpp | 81 |
4 files changed, 139 insertions, 1 deletions
diff --git a/libc/fuzzing/math/Compare.h b/libc/fuzzing/math/Compare.h index 7a194383f4df..e690e5168d27 100644 --- a/libc/fuzzing/math/Compare.h +++ b/libc/fuzzing/math/Compare.h @@ -28,7 +28,7 @@ ValuesEqual(T x1, T x2) { template <typename T> __llvm_libc::cpp::enable_if_t<__llvm_libc::cpp::is_integral_v<T>, bool> ValuesEqual(T x1, T x2) { - return x1 == x1; + return x1 == x2; } #endif // LLVM_LIBC_FUZZING_MATH_COMPARE_H diff --git a/libc/fuzzing/stdlib/CMakeLists.txt b/libc/fuzzing/stdlib/CMakeLists.txt index 0016f4f7ccbf..d28a0d52ad17 100644 --- a/libc/fuzzing/stdlib/CMakeLists.txt +++ b/libc/fuzzing/stdlib/CMakeLists.txt @@ -16,3 +16,36 @@ add_libc_fuzzer( libc.src.stdlib.atof ) +add_libc_fuzzer( + strtointeger_differential_fuzz + SRCS + strtointeger_differential_fuzz.cpp + HDRS + StringParserOutputDiff.h + DEPENDS + libc.src.stdlib.atoi + libc.src.stdlib.atol + libc.src.stdlib.atoll + libc.src.stdlib.strtol + libc.src.stdlib.strtoll + libc.src.stdlib.strtoul + libc.src.stdlib.strtoull +) + +add_libc_fuzzer( + strtointeger_differential_fuzz_cleaner + SRCS + strtointeger_differential_fuzz.cpp + HDRS + StringParserOutputDiff.h + DEPENDS + libc.src.stdlib.atoi + libc.src.stdlib.atol + libc.src.stdlib.atoll + libc.src.stdlib.strtol + libc.src.stdlib.strtoll + libc.src.stdlib.strtoul + libc.src.stdlib.strtoull + COMPILE_OPTIONS + -DLLVM_LIBC_FUZZ_ATOI_CLEANER_INPUT +) diff --git a/libc/fuzzing/stdlib/StringParserOutputDiff.h b/libc/fuzzing/stdlib/StringParserOutputDiff.h index 457da3b5674b..9e5accfdfc98 100644 --- a/libc/fuzzing/stdlib/StringParserOutputDiff.h +++ b/libc/fuzzing/stdlib/StringParserOutputDiff.h @@ -32,4 +32,28 @@ void StringParserOutputDiff(StringInputSingleOutputFunc<T> func1, __builtin_trap(); } +template <typename T> +using StringToNumberFunc = T (*)(const char *, char **, int); + +template <typename T> +void StringToNumberOutputDiff(StringToNumberFunc<T> func1, + StringToNumberFunc<T> func2, const uint8_t *data, + size_t size) { + if (size < sizeof(T)) + return; + + const char *x = reinterpret_cast<const char *>(data + 1); + int base = data[0] % 36; + base = base + ((base == 0) ? 0 : 1); + + char *outPtr1 = nullptr; + char *outPtr2 = nullptr; + + T result1 = func1(x, &outPtr1, base); + T result2 = func2(x, &outPtr2, base); + + if (!(ValuesEqual(result1, result2) && (*outPtr1 == *outPtr2))) + __builtin_trap(); +} + #endif // LLVM_LIBC_FUZZING_STDLIB_STRING_PARSER_OUTPUT_DIFF_H diff --git a/libc/fuzzing/stdlib/strtointeger_differential_fuzz.cpp b/libc/fuzzing/stdlib/strtointeger_differential_fuzz.cpp new file mode 100644 index 000000000000..45a45cdd5615 --- /dev/null +++ b/libc/fuzzing/stdlib/strtointeger_differential_fuzz.cpp @@ -0,0 +1,81 @@ +//===-- strtointeger_differential_fuzz.cpp --------------------------------===// +// +// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. +// See https://llvm.org/LICENSE.txt for license information. +// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception +// +//===----------------------------------------------------------------------===// +/// +/// Fuzzing test for llvm-libc atof implementation. +/// +//===----------------------------------------------------------------------===// +#include "src/stdlib/atoi.h" +#include "src/stdlib/atol.h" +#include "src/stdlib/atoll.h" +#include "src/stdlib/strtol.h" +#include "src/stdlib/strtoll.h" +#include "src/stdlib/strtoul.h" +#include "src/stdlib/strtoull.h" +#include <stddef.h> +#include <stdint.h> +#include <stdlib.h> + +#include "fuzzing/stdlib/StringParserOutputDiff.h" + +// This list contains (almost) all character that can possibly be accepted by a +// string to integer conversion. Those are: space, tab, +/- signs, any digit, +// and any letter. Technically there are some space characters accepted by +// isspace that aren't in this list, but since space characters are just skipped +// over anyways I'm not really worried. +[[maybe_unused]] constexpr char VALID_CHARS[] = { + ' ', '\t', '-', '+', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', + 'a', 'A', 'b', 'B', 'c', 'C', 'd', 'D', 'e', 'E', 'f', 'F', 'g', 'G', + 'h', 'H', 'i', 'I', 'j', 'J', 'k', 'K', 'l', 'L', 'm', 'M', 'n', 'N', + 'o', 'O', 'p', 'P', 'q', 'Q', 'r', 'R', 's', 'S', 't', 'T', 'u', 'U', + 'v', 'V', 'w', 'W', 'x', 'X', 'y', 'Y', 'z', 'Z'}; + +// This takes the randomized bytes in data and interprets the first byte as the +// base for the string to integer conversion and the rest of them as a string to +// be passed to the string to integer conversion. +// If the CLEANER_INPUT flag is set, the string is modified so that it's only +// made of characters that the string to integer functions could accept. This is +// because every other character is effectively identical, and will be treated +// as the end of the integer. For the fully randomized string this gives a +// greater than 50% chance for each character to end the string, making the odds +// of getting long numbers very low. +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + uint8_t *container = new uint8_t[size + 1]; + if (!container) + __builtin_trap(); + size_t i; + + for (i = 0; i < size; ++i) { +#ifdef LLVM_LIBC_FUZZ_ATOI_CLEANER_INPUT + container[i] = VALID_CHARS[data[i] % sizeof(VALID_CHARS)]; +#else + container[i] = data[i]; +#endif + } + container[size] = '\0'; // Add null terminator to container. + // the first character is interpreted as the base, so it should be fully + // random even when the input is cleaned. + container[0] = data[0]; + + StringParserOutputDiff<int>(&__llvm_libc::atoi, &::atoi, container, size); + StringParserOutputDiff<long>(&__llvm_libc::atol, &::atol, container, size); + StringParserOutputDiff<long long>(&__llvm_libc::atoll, &::atoll, container, + size); + + StringToNumberOutputDiff<long>(&__llvm_libc::strtol, &::strtol, container, + size); + StringToNumberOutputDiff<long long>(&__llvm_libc::strtoll, &::strtoll, + container, size); + + StringToNumberOutputDiff<unsigned long>(&__llvm_libc::strtoul, &::strtoul, + container, size); + StringToNumberOutputDiff<unsigned long long>(&__llvm_libc::strtoull, + &::strtoull, container, size); + + delete[] container; + return 0; +} |