OLD | NEW |
---|---|
1 /* | 1 /* |
2 * Copyright 2016 Google Inc. | 2 * Copyright 2016 Google Inc. |
3 * | 3 * |
4 * Use of this source code is governed by a BSD-style license that can be | 4 * Use of this source code is governed by a BSD-style license that can be |
5 * found in the LICENSE file. | 5 * found in the LICENSE file. |
6 */ | 6 */ |
7 | 7 |
8 #include "Fuzz.h" | 8 #include "Fuzz.h" |
9 #include "SkCommandLineFlags.h" | |
10 #include <signal.h> | |
9 #include <stdlib.h> | 11 #include <stdlib.h> |
10 #include <signal.h> | 12 |
13 DEFINE_string2(bytes, b, "", "A path to a file containing fuzzed bytes."); | |
14 DEFINE_string2(match, m, "", "The usual --match, applied to DEF_FUZZ names."); | |
11 | 15 |
12 int main(int argc, char** argv) { | 16 int main(int argc, char** argv) { |
13 if (argc < 3) { | 17 SkCommandLineFlags::Parse(argc, argv); |
14 SkDebugf("Usage: %s <fuzz name> <path/to/fuzzed.data>\n", argv[0]); | 18 |
19 if (FLAGS_bytes.isEmpty()) { | |
20 SkDebugf("Usage: %s -b <path/to/fuzzed.data> [-m pattern]\n", argv[0]); | |
kjlubick
2016/01/15 14:05:20
Protip: afl-fuzz also has a -m flag. It can be co
| |
15 return 1; | 21 return 1; |
16 } | 22 } |
17 const char* name = argv[1]; | 23 SkAutoTUnref<SkData> bytes(SkData::NewFromFileName(FLAGS_bytes[0])); |
18 const char* path = argv[2]; | |
19 | |
20 SkAutoTUnref<SkData> bytes(SkData::NewFromFileName(path)); | |
21 Fuzz fuzz(bytes); | |
22 | 24 |
23 for (auto r = SkTRegistry<Fuzzable>::Head(); r; r = r->next()) { | 25 for (auto r = SkTRegistry<Fuzzable>::Head(); r; r = r->next()) { |
24 auto fuzzable = r->factory(); | 26 auto fuzzable = r->factory(); |
25 if (0 == strcmp(name, fuzzable.name)) { | 27 if (!SkCommandLineFlags::ShouldSkip(FLAGS_match, fuzzable.name)) { |
26 SkDebugf("Running %s\n", fuzzable.name); | 28 SkDebugf("Fuzzing %s...\n", fuzzable.name); |
29 Fuzz fuzz(bytes); | |
27 fuzzable.fn(&fuzz); | 30 fuzzable.fn(&fuzz); |
28 return 0; | |
29 } | 31 } |
30 } | 32 } |
31 return 1; | 33 return 0; |
32 } | 34 } |
33 | 35 |
34 | 36 |
35 Fuzz::Fuzz(SkData* bytes) : fBytes(SkSafeRef(bytes)), fNextByte(0) {} | 37 Fuzz::Fuzz(SkData* bytes) : fBytes(SkSafeRef(bytes)), fNextByte(0) {} |
36 | 38 |
37 void Fuzz::signalBug () { raise(SIGSEGV); } | 39 void Fuzz::signalBug () { raise(SIGSEGV); } |
38 void Fuzz::signalBoring() { exit(0); } | 40 void Fuzz::signalBoring() { exit(0); } |
39 | 41 |
40 template <typename T> | 42 template <typename T> |
41 T Fuzz::nextT() { | 43 T Fuzz::nextT() { |
42 if (fNextByte + sizeof(T) > fBytes->size()) { | 44 if (fNextByte + sizeof(T) > fBytes->size()) { |
43 this->signalBoring(); | 45 this->signalBoring(); |
44 } | 46 } |
45 | 47 |
46 T val; | 48 T val; |
47 memcpy(&val, fBytes->bytes() + fNextByte, sizeof(T)); | 49 memcpy(&val, fBytes->bytes() + fNextByte, sizeof(T)); |
48 fNextByte += sizeof(T); | 50 fNextByte += sizeof(T); |
49 return val; | 51 return val; |
50 } | 52 } |
51 | 53 |
52 uint8_t Fuzz::nextB() { return this->nextT<uint8_t >(); } | 54 uint8_t Fuzz::nextB() { return this->nextT<uint8_t >(); } |
53 uint32_t Fuzz::nextU() { return this->nextT<uint32_t>(); } | 55 uint32_t Fuzz::nextU() { return this->nextT<uint32_t>(); } |
54 float Fuzz::nextF() { return this->nextT<float >(); } | 56 float Fuzz::nextF() { return this->nextT<float >(); } |
55 | 57 |
OLD | NEW |