1 // Copyright 2017 Google Inc. All rights reserved.
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include "src/libfuzzer/libfuzzer_mutator.h"
16
17 #include <string.h>
18
19 #include <algorithm>
20 #include <cassert>
21 #include <memory>
22 #include <string>
23
24 #include "port/protobuf.h"
25 #include "src/mutator.h"
26
27 // see compiler-rt/lib/sanitizer-common/sanitizer_internal_defs.h; usage same as
28 // SANITIZER_INTERFACE_WEAK_DEF with some functionality removed
29 #ifdef _MSC_VER
30 #if defined(_M_IX86) || defined(__i386__)
31 #define WIN_SYM_PREFIX "_"
32 #else
33 #define WIN_SYM_PREFIX
34 #endif
35
36 #define STRINGIFY_(A) #A
37 #define STRINGIFY(A) STRINGIFY_(A)
38
39 #define WEAK_DEFAULT_NAME(Name) Name##__def
40
41 // clang-format off
42 #define LIB_PROTO_MUTATOR_WEAK_DEF(ReturnType, Name, ...) \
43 __pragma(comment(linker, "/alternatename:" \
44 WIN_SYM_PREFIX STRINGIFY(Name) "=" \
45 WIN_SYM_PREFIX STRINGIFY(WEAK_DEFAULT_NAME(Name))))\
46 extern "C" ReturnType Name(__VA_ARGS__); \
47 extern "C" ReturnType WEAK_DEFAULT_NAME(Name)(__VA_ARGS__)
48 // clang-format on
49 #else
50 #define LIB_PROTO_MUTATOR_WEAK_DEF(ReturnType, Name, ...) \
51 extern "C" __attribute__((weak)) ReturnType Name(__VA_ARGS__)
52 #endif
53
LIB_PROTO_MUTATOR_WEAK_DEF(size_t,LLVMFuzzerMutate,uint8_t *,size_t,size_t)54 LIB_PROTO_MUTATOR_WEAK_DEF(size_t, LLVMFuzzerMutate, uint8_t*, size_t, size_t) {
55 return 0;
56 }
57
58 namespace protobuf_mutator {
59 namespace libfuzzer {
60
61 namespace {
62
63 template <class T>
MutateValue(T v)64 T MutateValue(T v) {
65 size_t size =
66 LLVMFuzzerMutate(reinterpret_cast<uint8_t*>(&v), sizeof(v), sizeof(v));
67 memset(reinterpret_cast<uint8_t*>(&v) + size, 0, sizeof(v) - size);
68 return v;
69 }
70
71 } // namespace
72
MutateInt32(int32_t value)73 int32_t Mutator::MutateInt32(int32_t value) { return MutateValue(value); }
74
MutateInt64(int64_t value)75 int64_t Mutator::MutateInt64(int64_t value) { return MutateValue(value); }
76
MutateUInt32(uint32_t value)77 uint32_t Mutator::MutateUInt32(uint32_t value) { return MutateValue(value); }
78
MutateUInt64(uint64_t value)79 uint64_t Mutator::MutateUInt64(uint64_t value) { return MutateValue(value); }
80
MutateFloat(float value)81 float Mutator::MutateFloat(float value) { return MutateValue(value); }
82
MutateDouble(double value)83 double Mutator::MutateDouble(double value) { return MutateValue(value); }
84
MutateString(const std::string & value,int size_increase_hint)85 std::string Mutator::MutateString(const std::string& value,
86 int size_increase_hint) {
87 // Randomly return empty strings as LLVMFuzzerMutate does not produce them.
88 // Use uint16_t because on Windows, uniform_int_distribution does not support
89 // any 8 bit types.
90 if (!std::uniform_int_distribution<uint16_t>(0, 20)(*random())) return {};
91 std::string result = value;
92 int new_size = value.size() + size_increase_hint;
93 result.resize(std::max(1, new_size));
94 result.resize(LLVMFuzzerMutate(reinterpret_cast<uint8_t*>(&result[0]),
95 value.size(), result.size()));
96 return result;
97 }
98
99 } // namespace libfuzzer
100 } // namespace protobuf_mutator
101