json parser/writer correctness fuzzer

base/json/base_json_correctness_fuzzer.cc

Index: base/json/base_json_correctness_fuzzer.cc
diff --git a/base/json/base_json_correctness_fuzzer.cc b/base/json/base_json_correctness_fuzzer.cc
new file mode 100644
index 0000000000000000000000000000000000000000..12fc97e3917667d29c6bc3e1daa3fc914f40dc1f
--- /dev/null
+++ b/base/json/base_json_correctness_fuzzer.cc
@@ -0,0 +1,53 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.

[danakj, 2016/10/28 01:50:56]

2016

[aizatsky, 2016/10/31 19:56:18]

done

+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// A fuzzer that checks correctness of json parser/writer.
+// The fuzzer input is passed through parsing twice,
+// so that presumably valdid json is parsed/written again.

[danakj, 2016/10/28 01:50:56]

valid

[aizatsky, 2016/10/31 19:56:18]

done

+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <string>
+
+#include "base/json/json_reader.h"
+#include "base/json/json_writer.h"
+#include "base/json/string_escape.h"
+#include "base/logging.h"
+#include "base/values.h"
+
+// Entry point for LibFuzzer.
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  if (size < 1)

[danakj, 2016/10/28 01:50:56]

if (!size) is the usual way to write this, but don't you need at least 2 bytes?
cuz 1 byte would be an empty string with options

[aizatsky, 2016/10/31 19:56:18]

done. Agree, less than 2 bytes is pointless.

+    return 0;
+
+  int error_code, error_line, error_column;
+  std::string error_message;
+
+  const std::string input_string(reinterpret_cast<const char*>(data), size - 1);
+  const int options = data[size - 1];

[danakj, 2016/10/28 01:50:56]

Where is this format documented?

[aizatsky, 2016/10/31 19:56:18]

It is not. It is each fuzzer's decision on how to interpret input from fuzzer
engine. Using a byte or two for config is common pattern.

+  auto input_value = base::JSONReader::ReadAndReturnError(

[danakj, 2016/10/28 01:50:56]

parsed_value?

[aizatsky, 2016/10/31 19:56:18]

done

+      input_string, options, &error_code, &error_message, &error_line,
+      &error_column);
+  if (!input_value)
+    return 0;
+
+  std::string output1;

[danakj, 2016/10/28 01:50:56]

parsed_output?

[aizatsky, 2016/10/31 19:56:18]

done

+  bool b = base::JSONWriter::Write(*input_value, &output1);
+  LOG_ASSERT(b);
+
+  auto value2 = base::JSONReader::ReadAndReturnError(

[danakj, 2016/10/28 01:50:56]

double_parsed_value?

[aizatsky, 2016/10/31 19:56:18]

done

+      output1, options, &error_code, &error_message, &error_line,
+      &error_column);
+  LOG_ASSERT(value2);
+  std::string output2;

[danakj, 2016/10/28 01:50:56]

double_parsed_output?

using numbers to distinguish variable names isn't my fave

[aizatsky, 2016/10/31 19:56:18]

done

+  bool b2 = base::JSONWriter::Write(*value2, &output2);
+  LOG_ASSERT(b2);
+
+  LOG_ASSERT(output1 == output2) << "Parser/Writer mismatch."
+    "\nInput=" << base::GetQuotedJSONString(output1) <<
+    "\nOutput=" << base::GetQuotedJSONString(output2);
+
+  return 0;
+}