use fixed size input

pauldreik · Jun 14, 2019 · 02afb12 · 02afb12
1 parent 35f84c8
commit 02afb12
Show file tree

Hide file tree

Showing 4 changed files with 30 additions and 25 deletions.
diff --git a/test/fuzzing/named_arg.cpp b/test/fuzzing/named_arg.cpp
@@ -12,7 +12,8 @@
 template <typename Item1>
 void invoke_fmt(const uint8_t* Data, std::size_t Size, int argsize) {
   constexpr auto N1 = sizeof(Item1);
-  if (Size <= N1) {
+  static_assert (N1<=fmt_fuzzer::Nfixed,"Nfixed too small");
+  if (Size <= fmt_fuzzer::Nfixed) {
     return;
   }
   Item1 item1{};
@@ -21,8 +22,8 @@ void invoke_fmt(const uint8_t* Data, std::size_t Size, int argsize) {
   } else {
     std::memcpy(&item1, Data, N1);
   }
-  Data += N1;
-  Size -= N1;
+  Data += fmt_fuzzer::Nfixed;
+  Size -= fmt_fuzzer::Nfixed;
 
   // how many chars should be used for the argument name?
   if (argsize <= 0 || argsize >= Size) {

diff --git a/test/fuzzing/one_arg.cpp b/test/fuzzing/one_arg.cpp
@@ -10,10 +10,13 @@
 #include <fmt/chrono.h>
 #include "fuzzer_common.h"
 
+using fmt_fuzzer::Nfixed;
+
 template <typename Item>
 void invoke_fmt(const uint8_t* Data, std::size_t Size) {
   constexpr auto N = sizeof(Item);
-  if (Size <= N) {
+  static_assert (N<=Nfixed,"Nfixed is too small");
+  if (Size <= Nfixed) {
     return;
   }
   Item item{};
@@ -22,8 +25,8 @@ void invoke_fmt(const uint8_t* Data, std::size_t Size) {
   } else {
     std::memcpy(&item, Data, N);
   }
-  Data += N;
-  Size -= N;
+  Data += Nfixed;
+  Size -= Nfixed;
 
 #if FMT_FUZZ_SEPARATE_ALLOCATION
   // allocates as tight as possible, making it easier to catch buffer overruns.
@@ -45,13 +48,14 @@ void invoke_fmt(const uint8_t* Data, std::size_t Size) {
 void invoke_fmt_time(const uint8_t* Data, std::size_t Size) {
   using Item = std::time_t;
   constexpr auto N = sizeof(Item);
-  if (Size <= N) {
+  static_assert (N<=Nfixed,"Nfixed too small");
+  if (Size <= Nfixed) {
     return;
   }
   Item item{};
   std::memcpy(&item, Data, N);
-  Data += N;
-  Size -= N;
+  Data += Nfixed;
+  Size -= Nfixed;
 #if FMT_FUZZ_SEPARATE_ALLOCATION
   // allocates as tight as possible, making it easier to catch buffer overruns.
   std::vector<char> fmtstringbuffer(Size);

diff --git a/test/fuzzing/sprintf.cpp b/test/fuzzing/sprintf.cpp
@@ -7,7 +7,7 @@
 
 #include "fuzzer_common.h"
 
-constexpr auto Nmax=fmt_fuzzer::Nfixed;
+using fmt_fuzzer::Nfixed;
 
 template <class Item>
 Item assignFromBuf(const uint8_t* Data, std::size_t Size) {
@@ -24,18 +24,18 @@ template <typename Item1, typename Item2>
 void invoke_fmt(const uint8_t* Data, std::size_t Size) {
   constexpr auto N1 = sizeof(Item1);
   constexpr auto N2 = sizeof(Item2);
-  static_assert(N1 <= Nmax, "size1 exceeded");
-  static_assert(N2 <= Nmax, "size2 exceeded");
-  if (Size <= Nmax + Nmax) {
+  static_assert(N1 <= Nfixed, "size1 exceeded");
+  static_assert(N2 <= Nfixed, "size2 exceeded");
+  if (Size <= Nfixed + Nfixed) {
     return;
   }
   Item1 item1 = assignFromBuf<Item1>(Data, Size);
-  Data += Nmax;
-  Size -= Nmax;
+  Data += Nfixed;
+  Size -= Nfixed;
 
   Item2 item2 = assignFromBuf<Item2>(Data, Size);
-  Data += Nmax;
-  Size -= Nmax;
+  Data += Nfixed;
+  Size -= Nfixed;
 
   auto fmtstring = fmt::string_view((const char*)Data, Size);
 

diff --git a/test/fuzzing/two_args.cpp b/test/fuzzing/two_args.cpp
@@ -7,15 +7,15 @@
 
 #include "fuzzer_common.h"
 
-constexpr auto Nmax=fmt_fuzzer::Nfixed;
+constexpr auto Nfixed=fmt_fuzzer::Nfixed;
 
 template <typename Item1, typename Item2>
 void invoke_fmt(const uint8_t* Data, std::size_t Size) {
   constexpr auto N1 = sizeof(Item1);
   constexpr auto N2 = sizeof(Item2);
-  static_assert(N1 <= Nmax, "size1 exceeded");
-  static_assert(N2 <= Nmax, "size2 exceeded");
-  if (Size <= Nmax + Nmax) {
+  static_assert(N1 <= Nfixed, "size1 exceeded");
+  static_assert(N2 <= Nfixed, "size2 exceeded");
+  if (Size <= Nfixed + Nfixed) {
     return;
   }
   Item1 item1{};
@@ -24,17 +24,17 @@ void invoke_fmt(const uint8_t* Data, std::size_t Size) {
   } else {
     std::memcpy(&item1, Data, N1);
   }
-  Data += Nmax;
-  Size -= Nmax;
+  Data += Nfixed;
+  Size -= Nfixed;
 
   Item2 item2{};
   if /*constexpr*/ (std::is_same<Item2, bool>::value) {
     item2 = !!Data[0];
   } else {
     std::memcpy(&item2, Data, N2);
   }
-  Data += Nmax;
-  Size -= Nmax;
+  Data += Nfixed;
+  Size -= Nfixed;
 
   auto fmtstring = fmt::string_view((const char*)Data, Size);