about summary refs log tree commit diff
path: root/users/zseri/store-ref-scanner/fuzz/fuzz_targets
diff options
context:
space:
mode:
authorzseri <zseri.devel@ytrizja.de>2021-12-25T02·17+0100
committerzseri <zseri.devel@ytrizja.de>2021-12-25T05·03+0000
commitf4dddea4c375dd0dc472d8879cc4fc506dd77d8c (patch)
tree544f2b746743d35501d978396fe6ba5ad53dbdf2 /users/zseri/store-ref-scanner/fuzz/fuzz_targets
parent5f2b37bdb07f5b931ac555939710ce681472e04d (diff)
fix(zseri/store-ref-scanner): no_std support and runtime panics r/3385
This also changes the fuzzing infrastructure from proptest to cargo-fuzz,
and this lead to the discovery of two mishandlings of edge-cases:

* when a "path_to_store" is at the end of the input, it tried to access
  the input slice out-of-bounds (the `just_store` test covers that now)
* non-ASCII characters lead to an out-of-bounds access in HalfBytesMask
  (the `non_ascii` test covers that now)

Change-Id: Icaa2518dcd93e1789a2c0da4cf0fec46016d3bad
Reviewed-on: https://cl.tvl.fyi/c/depot/+/4604
Tested-by: BuildkiteCI
Reviewed-by: zseri <zseri.devel@ytrizja.de>
Diffstat (limited to 'users/zseri/store-ref-scanner/fuzz/fuzz_targets')
-rw-r--r--users/zseri/store-ref-scanner/fuzz/fuzz_targets/hbm-roundtrip.rs13
-rw-r--r--users/zseri/store-ref-scanner/fuzz/fuzz_targets/nocrash.rs9
2 files changed, 22 insertions, 0 deletions
diff --git a/users/zseri/store-ref-scanner/fuzz/fuzz_targets/hbm-roundtrip.rs b/users/zseri/store-ref-scanner/fuzz/fuzz_targets/hbm-roundtrip.rs
new file mode 100644
index 000000000000..0738da68b77d
--- /dev/null
+++ b/users/zseri/store-ref-scanner/fuzz/fuzz_targets/hbm-roundtrip.rs
@@ -0,0 +1,13 @@
+#![no_main]
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    use core::convert::TryInto;
+    use store_ref_scanner::HalfBytesMask;
+    for i in data.chunks_exact(16) {
+        let a = HalfBytesMask(i.try_into().unwrap());
+        let b = a.into_expanded();
+        let c = HalfBytesMask::from_expanded(b);
+        assert_eq!(a, c);
+    }
+});
diff --git a/users/zseri/store-ref-scanner/fuzz/fuzz_targets/nocrash.rs b/users/zseri/store-ref-scanner/fuzz/fuzz_targets/nocrash.rs
new file mode 100644
index 000000000000..48100a628d7a
--- /dev/null
+++ b/users/zseri/store-ref-scanner/fuzz/fuzz_targets/nocrash.rs
@@ -0,0 +1,9 @@
+#![no_main]
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    use store_ref_scanner::{StoreRefScanner, StoreSpec};
+
+    StoreRefScanner::new(&data[..], &StoreSpec::DFL_NIX2).count();
+    StoreRefScanner::new(&data[..], &StoreSpec::DFL_YZIX1).count();
+});