Skip to content

Commit 4da0683

Browse files
pauldreiklemire
pauldreik
authored and
lemire
committed
add new fuzzers for print_json and dump_raw_tape (simdjson#416)
after looking at the coverage report available at https://storage.googleapis.com/oss-fuzz-coverage/simdjson/reports/20191222/linux/src/simdjson/report.html
1 parent 27293cc commit 4da0683

File tree

8 files changed

+154
-60
lines changed

8 files changed

+154
-60
lines changed

‎.github/workflows/fuzzers.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
build:
1515
runs-on: ubuntu-latest
1616
env:
17-
allfuzzers: parser dump
17+
allfuzzers: parser dump dump_raw_tape print_json
1818
artifactsprefix: -artifact_prefix=fuzzfailure/
1919
steps:
2020
- name: Install packages necessary for building

‎fuzz/CMakeLists.txt‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,12 @@ set(SOURCES
2929
fuzz_parser.cpp
3030
# fuzz_minify.cpp # <--- does not pass the build check test on oss-fuzz, says "partially instrumented". help needed!
3131
fuzz_dump.cpp
32+
fuzz_print_json.cpp
33+
fuzz_dump_raw_tape.cpp
34+
)
35+
36+
add_custom_target(print_all_fuzz_targets
37+
COMMAND ${CMAKE_COMMAND} -E echo ${SOURCES}
3238
)
3339

3440
macro(implement_fuzzer sourcefile)

‎fuzz/NullBuffer.h‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
2+
#pragma once
3+
4+
#include <iostream>
5+
6+
// from https://stackoverflow.com/a/8244052
7+
class NulStreambuf : public std::streambuf {
8+
char dummyBuffer[64];
9+
10+
protected:
11+
virtual int overflow(int c) override final{
12+
setp(dummyBuffer, dummyBuffer + sizeof(dummyBuffer));
13+
return (c == traits_type::eof()) ? '\0' : c;
14+
}
15+
};
16+
17+
class NulOStream final : private NulStreambuf, public std::ostream {
18+
public:
19+
NulOStream() : std::ostream(this) {}
20+
NulStreambuf *rdbuf() { return this; }
21+
};

‎fuzz/build_fuzzer_variants.sh‎

Lines changed: 54 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ set -eu
1010

1111
unset CXX CC CFLAGS CXXFLAGS LDFLAGS
1212

13+
me=$(basename $0)
14+
1315
# A reproduce build, without avx but otherwise as plain
1416
# as it gets. No sanitizers or optimization.
1517
variant=plain-noavx
@@ -76,28 +78,32 @@ fi
7678

7779
# a fuzzer with sanitizers, built with avx disabled.
7880
variant=ossfuzz-noavx8
79-
if [ ! -d build-$variant ] ; then
80-
81-
export CC=clang-8
82-
export CXX="clang++-8"
83-
export CFLAGS="-fsanitize=fuzzer-no-link,address,undefined -fno-sanitize-recover=undefined -mno-avx2 -mno-avx "
84-
export CXXFLAGS="-fsanitize=fuzzer-no-link,address,undefined -fno-sanitize-recover=undefined -mno-avx2 -mno-avx"
85-
export LIB_FUZZING_ENGINE="-fsanitize=fuzzer"
86-
87-
mkdir build-$variant
88-
cd build-$variant
89-
90-
cmake .. \
91-
-GNinja \
92-
-DCMAKE_BUILD_TYPE=Debug \
93-
-DSIMDJSON_BUILD_STATIC=On \
94-
-DENABLE_FUZZING=On \
95-
-DSIMDJSON_FUZZ_LINKMAIN=Off \
96-
-DSIMDJSON_FUZZ_LDFLAGS=$LIB_FUZZING_ENGINE \
97-
-DSIMDJSON_DISABLE_AVX=On
98-
99-
ninja
100-
cd ..
81+
if which clang++-8 >/dev/null 2>&1 ; then
82+
if [ ! -d build-$variant ] ; then
83+
84+
export CC=clang-8
85+
export CXX="clang++-8"
86+
export CFLAGS="-fsanitize=fuzzer-no-link,address,undefined -fno-sanitize-recover=undefined -mno-avx2 -mno-avx "
87+
export CXXFLAGS="-fsanitize=fuzzer-no-link,address,undefined -fno-sanitize-recover=undefined -mno-avx2 -mno-avx"
88+
export LIB_FUZZING_ENGINE="-fsanitize=fuzzer"
89+
90+
mkdir build-$variant
91+
cd build-$variant
92+
93+
cmake .. \
94+
-GNinja \
95+
-DCMAKE_BUILD_TYPE=Debug \
96+
-DSIMDJSON_BUILD_STATIC=On \
97+
-DENABLE_FUZZING=On \
98+
-DSIMDJSON_FUZZ_LINKMAIN=Off \
99+
-DSIMDJSON_FUZZ_LDFLAGS=$LIB_FUZZING_ENGINE \
100+
-DSIMDJSON_DISABLE_AVX=On
101+
102+
ninja
103+
cd ..
104+
fi
105+
else
106+
echo "$me: WARNING clang++-8 not found, please install it to build $variant"
101107
fi
102108

103109
# a fuzzer with sanitizers, default built
@@ -127,25 +133,30 @@ fi
127133

128134
# a fast fuzzer, for fast exploration
129135
variant=ossfuzz-fast8
130-
if [ ! -d build-$variant ] ; then
131-
export CC=clang-8
132-
export CXX="clang++-8"
133-
export CFLAGS="-fsanitize=fuzzer-no-link -O3 -g"
134-
export CXXFLAGS="-fsanitize=fuzzer-no-link -O3 -g"
135-
export LIB_FUZZING_ENGINE="-fsanitize=fuzzer"
136-
137-
mkdir build-$variant
138-
cd build-$variant
139-
140-
cmake .. \
141-
-GNinja \
142-
-DCMAKE_BUILD_TYPE= \
143-
-DSIMDJSON_BUILD_STATIC=On \
144-
-DENABLE_FUZZING=On \
145-
-DSIMDJSON_FUZZ_LINKMAIN=Off \
146-
-DSIMDJSON_FUZZ_LDFLAGS=$LIB_FUZZING_ENGINE
147-
148-
ninja
149-
150-
cd ..
136+
if which clang++-8 >/dev/null 2>&1 ; then
137+
if [ ! -d build-$variant ] ; then
138+
export CC=clang-8
139+
export CXX="clang++-8"
140+
export CFLAGS="-fsanitize=fuzzer-no-link -O3 -g"
141+
export CXXFLAGS="-fsanitize=fuzzer-no-link -O3 -g"
142+
export LIB_FUZZING_ENGINE="-fsanitize=fuzzer"
143+
144+
mkdir build-$variant
145+
cd build-$variant
146+
147+
cmake .. \
148+
-GNinja \
149+
-DCMAKE_BUILD_TYPE= \
150+
-DSIMDJSON_BUILD_STATIC=On \
151+
-DENABLE_FUZZING=On \
152+
-DSIMDJSON_FUZZ_LINKMAIN=Off \
153+
-DSIMDJSON_FUZZ_LDFLAGS=$LIB_FUZZING_ENGINE
154+
155+
ninja
156+
157+
cd ..
158+
fi
159+
else
160+
echo "$me: WARNING clang++-8 not found, please install it to build $variant"
151161
fi
162+

‎fuzz/fuzz_dump.cpp‎

Lines changed: 1 addition & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -4,22 +4,7 @@
44
#include <iostream>
55
#include <string>
66

7-
// from https://stackoverflow.com/a/8244052
8-
class NulStreambuf : public std::streambuf {
9-
char dummyBuffer[64];
10-
11-
protected:
12-
virtual int overflow(int c) {
13-
setp(dummyBuffer, dummyBuffer + sizeof(dummyBuffer));
14-
return (c == traits_type::eof()) ? '\0' : c;
15-
}
16-
};
17-
18-
class NulOStream : private NulStreambuf, public std::ostream {
19-
public:
20-
NulOStream() : std::ostream(this) {}
21-
NulStreambuf *rdbuf() { return this; }
22-
};
7+
#include "NullBuffer.h"
238

249
// from the README on the front page
2510
void compute_dump(simdjson::ParsedJson::Iterator &pjh) {

‎fuzz/fuzz_dump_raw_tape.cpp‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#include "simdjson/jsonparser.h"
2+
#include <cstddef>
3+
#include <cstdint>
4+
#include <iostream>
5+
#include <string>
6+
7+
#include "NullBuffer.h"
8+
9+
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
10+
11+
try {
12+
auto pj = simdjson::build_parsed_json(Data, Size);
13+
NulOStream os;
14+
bool ignored=pj.dump_raw_tape(os);
15+
} catch (...) {
16+
}
17+
return 0;
18+
}

‎fuzz/fuzz_print_json.cpp‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#include "simdjson/jsonparser.h"
2+
#include <cstddef>
3+
#include <cstdint>
4+
#include <string>
5+
6+
#include "NullBuffer.h"
7+
8+
9+
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
10+
11+
try {
12+
auto pj = simdjson::build_parsed_json(Data, Size);
13+
NulOStream os;
14+
bool ignored=pj.print_json(os);
15+
(void)ignored;
16+
} catch (...) {
17+
}
18+
return 0;
19+
}

‎fuzz/measure_coverage.sh‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
#!/bin/sh
2+
#
3+
# makes a coverage build.
4+
#
5+
# To measure and display the coverage:
6+
#
7+
#cd build-coverage
8+
#fuzz/fuzz_parser path/to/corpus/* # repeat with other fuzzers
9+
#gcovr -r . --html --html-details --sort-uncovered -o out.html
10+
# and view the results in out.html
11+
12+
bdir=build-coverage
13+
if [ ! -d $bdir ] ; then
14+
mkdir -p $bdir
15+
cd $bdir
16+
17+
export CC=gcc
18+
export CXX="g++"
19+
export CFLAGS="-fprofile-arcs -ftest-coverage"
20+
export CXXFLAGS="-fprofile-arcs -ftest-coverage"
21+
export LDFLAGS="-fprofile-arcs -ftest-coverage"
22+
23+
cmake .. \
24+
-GNinja \
25+
-DCMAKE_BUILD_TYPE=Debug \
26+
-DSIMDJSON_BUILD_STATIC=On \
27+
-DENABLE_FUZZING=On \
28+
-DSIMDJSON_FUZZ_LINKMAIN=On
29+
ninja
30+
cd ..
31+
fi
32+
33+
34+

0 commit comments

Comments
 (0)