Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 /* | 1 /* |
| 2 * Copyright 2016 Google Inc. | 2 * Copyright 2016 Google Inc. |
| 3 * | 3 * |
| 4 * Use of this source code is governed by a BSD-style license that can be | 4 * Use of this source code is governed by a BSD-style license that can be |
| 5 * found in the LICENSE file. | 5 * found in the LICENSE file. |
| 6 */ | 6 */ |
| 7 | 7 |
| 8 #include "Fuzz.h" | 8 #include "Fuzz.h" |
| 9 #include "SkCommandLineFlags.h" | |
| 10 #include <signal.h> | |
| 9 #include <stdlib.h> | 11 #include <stdlib.h> |
| 10 #include <signal.h> | 12 |
| 13 DEFINE_string2(bytes, b, "", "A path to a file containing fuzzed bytes."); | |
| 14 DEFINE_string2(match, m, "", "The usual --match, applied to DEF_FUZZ names."); | |
| 11 | 15 |
| 12 int main(int argc, char** argv) { | 16 int main(int argc, char** argv) { |
| 13 if (argc < 3) { | 17 SkCommandLineFlags::Parse(argc, argv); |
| 14 SkDebugf("Usage: %s <fuzz name> <path/to/fuzzed.data>\n", argv[0]); | 18 |
| 19 if (FLAGS_bytes.isEmpty()) { | |
| 20 SkDebugf("Usage: %s -b <path/to/fuzzed.data> [-m pattern]\n", argv[0]); | |
|
kjlubick
2016/01/15 14:05:20
Protip: afl-fuzz also has a -m flag. It can be co
| |
| 15 return 1; | 21 return 1; |
| 16 } | 22 } |
| 17 const char* name = argv[1]; | 23 SkAutoTUnref<SkData> bytes(SkData::NewFromFileName(FLAGS_bytes[0])); |
| 18 const char* path = argv[2]; | |
| 19 | |
| 20 SkAutoTUnref<SkData> bytes(SkData::NewFromFileName(path)); | |
| 21 Fuzz fuzz(bytes); | |
| 22 | 24 |
| 23 for (auto r = SkTRegistry<Fuzzable>::Head(); r; r = r->next()) { | 25 for (auto r = SkTRegistry<Fuzzable>::Head(); r; r = r->next()) { |
| 24 auto fuzzable = r->factory(); | 26 auto fuzzable = r->factory(); |
| 25 if (0 == strcmp(name, fuzzable.name)) { | 27 if (!SkCommandLineFlags::ShouldSkip(FLAGS_match, fuzzable.name)) { |
| 26 SkDebugf("Running %s\n", fuzzable.name); | 28 SkDebugf("Fuzzing %s...\n", fuzzable.name); |
| 29 Fuzz fuzz(bytes); | |
| 27 fuzzable.fn(&fuzz); | 30 fuzzable.fn(&fuzz); |
| 28 return 0; | |
| 29 } | 31 } |
| 30 } | 32 } |
| 31 return 1; | 33 return 0; |
| 32 } | 34 } |
| 33 | 35 |
| 34 | 36 |
| 35 Fuzz::Fuzz(SkData* bytes) : fBytes(SkSafeRef(bytes)), fNextByte(0) {} | 37 Fuzz::Fuzz(SkData* bytes) : fBytes(SkSafeRef(bytes)), fNextByte(0) {} |
| 36 | 38 |
| 37 void Fuzz::signalBug () { raise(SIGSEGV); } | 39 void Fuzz::signalBug () { raise(SIGSEGV); } |
| 38 void Fuzz::signalBoring() { exit(0); } | 40 void Fuzz::signalBoring() { exit(0); } |
| 39 | 41 |
| 40 template <typename T> | 42 template <typename T> |
| 41 T Fuzz::nextT() { | 43 T Fuzz::nextT() { |
| 42 if (fNextByte + sizeof(T) > fBytes->size()) { | 44 if (fNextByte + sizeof(T) > fBytes->size()) { |
| 43 this->signalBoring(); | 45 this->signalBoring(); |
| 44 } | 46 } |
| 45 | 47 |
| 46 T val; | 48 T val; |
| 47 memcpy(&val, fBytes->bytes() + fNextByte, sizeof(T)); | 49 memcpy(&val, fBytes->bytes() + fNextByte, sizeof(T)); |
| 48 fNextByte += sizeof(T); | 50 fNextByte += sizeof(T); |
| 49 return val; | 51 return val; |
| 50 } | 52 } |
| 51 | 53 |
| 52 uint8_t Fuzz::nextB() { return this->nextT<uint8_t >(); } | 54 uint8_t Fuzz::nextB() { return this->nextT<uint8_t >(); } |
| 53 uint32_t Fuzz::nextU() { return this->nextT<uint32_t>(); } | 55 uint32_t Fuzz::nextU() { return this->nextT<uint32_t>(); } |
| 54 float Fuzz::nextF() { return this->nextT<float >(); } | 56 float Fuzz::nextF() { return this->nextT<float >(); } |
| 55 | 57 |
| OLD | NEW |