libc/fuzzing/string/strcmp_fuzz.cpp

   1 //===-- strcmp_fuzz.cpp ---------------------------------------------------===//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8 ///
   9 /// Fuzzing test for llvm-libc strcmp implementation.
  10 ///
  11 //===----------------------------------------------------------------------===//
  12 #include "src/string/strcmp.h"
  13 #include <stddef.h>
  14 #include <stdint.h>
  15
  16 // The general structure is to take the value of the first byte, set size1 to
  17 // that value, and add the null terminator. size2 will then contain the rest of
  18 // the bytes in data.
  19 // For example, with inputs (data={2, 6, 4, 8, 0}, size=5):
  20 //         size1: data[0] = 2
  21 //         data1: {2, 6} + '\0' = {2, 6, '\0'}
  22 //         size2: size - size1 = 3
  23 //         data2: {4, 8, '\0'}
  24 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  25   // Verify the size is at least 1 and the data is null terminated.
  26   if (!size || data[size - 1] != '\0')
  27     return 0;
  28
  29   const size_t size1 = (data[0] <= size ? data[0] : size);
  30   const size_t size2 = size - size1;
  31
  32   // The first size will always be at least 1 since
  33   // we need to append the null terminator. The second size
  34   // needs to be checked since it must also contain the null
  35   // terminator.
  36   if (!size2)
  37     return 0;
  38
  39   // Copy the data into new containers.
  40   // Add one to data1 for null terminator.
  41   uint8_t *data1 = new uint8_t[size1 + 1];
  42   uint8_t *data2 = new uint8_t[size2];
  43   if (!data1 || !data2)
  44     __builtin_trap();
  45
  46   size_t i;
  47   for (i = 0; i < size1; ++i)
  48     data1[i] = data[i];
  49   data1[size1] = '\0'; // Add null terminator to data1.
  50
  51   for (size_t j = 0; j < size2; ++j)
  52     data2[j] = data[i++];
  53
  54   const char *s1 = reinterpret_cast<const char *>(data1);
  55   const char *s2 = reinterpret_cast<const char *>(data2);
  56   size_t k = 0;
  57   // Iterate until a null terminator is hit or the character comparison is
  58   // different.
  59   while (s1[k] && s2[k] && s1[k] == s2[k])
  60     ++k;
  61
  62   const unsigned char ch1 = static_cast<unsigned char>(s1[k]);
  63   const unsigned char ch2 = static_cast<unsigned char>(s2[k]);
  64   // The expected result should be the difference between the first non-equal
  65   // characters of s1 and s2. If all characters are equal, the expected result
  66   // should be '\0' - '\0' = 0.
  67   if (LIBC_NAMESPACE::strcmp(s1, s2) != ch1 - ch2)
  68     __builtin_trap();
  69
  70   // Verify reversed operands. This should be the negated value of the previous
  71   // result, except of course if the previous result was zero.
  72   if (LIBC_NAMESPACE::strcmp(s2, s1) != ch2 - ch1)
  73     __builtin_trap();
  74
  75   delete[] data1;
  76   delete[] data2;
  77   return 0;
  78 }