1 /*
2 * Copyright 2020 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16 #include <iostream>
17
18 #include "fuzzer/FuzzedDataProvider.h"
19 #include "utils/String16.h"
20 static constexpr int MAX_STRING_BYTES = 256;
21 static constexpr uint8_t MAX_OPERATIONS = 50;
22
23 std::vector<std::function<void(FuzzedDataProvider&, android::String16, android::String16)>>
24 operations = {
25
26 // Bytes and size
__anone967d5860102() 27 ([](FuzzedDataProvider&, android::String16 str1, android::String16) -> void {
28 str1.string();
29 }),
__anone967d5860202() 30 ([](FuzzedDataProvider&, android::String16 str1, android::String16) -> void {
31 str1.isStaticString();
32 }),
__anone967d5860302() 33 ([](FuzzedDataProvider&, android::String16 str1, android::String16) -> void {
34 str1.size();
35 }),
36
37 // Comparison
__anone967d5860402() 38 ([](FuzzedDataProvider&, android::String16 str1, android::String16 str2) -> void {
39 str1.startsWith(str2);
40 }),
__anone967d5860502() 41 ([](FuzzedDataProvider&, android::String16 str1, android::String16 str2) -> void {
42 str1.contains(str2.string());
43 }),
__anone967d5860602() 44 ([](FuzzedDataProvider&, android::String16 str1, android::String16 str2) -> void {
45 str1.compare(str2);
46 }),
47
48 // Append and format
__anone967d5860702() 49 ([](FuzzedDataProvider&, android::String16 str1, android::String16 str2) -> void {
50 str1.append(str2);
51 }),
52 ([](FuzzedDataProvider& dataProvider, android::String16 str1,
__anone967d5860802() 53 android::String16 str2) -> void {
54 int pos = dataProvider.ConsumeIntegralInRange<int>(0, str1.size());
55 str1.insert(pos, str2.string());
56 }),
57
58 // Find and replace operations
59 ([](FuzzedDataProvider& dataProvider, android::String16 str1,
__anone967d5860902() 60 android::String16) -> void {
61 char16_t findChar = dataProvider.ConsumeIntegral<char16_t>();
62 str1.findFirst(findChar);
63 }),
64 ([](FuzzedDataProvider& dataProvider, android::String16 str1,
__anone967d5860a02() 65 android::String16) -> void {
66 char16_t findChar = dataProvider.ConsumeIntegral<char16_t>();
67 str1.findLast(findChar);
68 }),
69 ([](FuzzedDataProvider& dataProvider, android::String16 str1,
__anone967d5860b02() 70 android::String16) -> void {
71 char16_t findChar = dataProvider.ConsumeIntegral<char16_t>();
72 char16_t replaceChar = dataProvider.ConsumeIntegral<char16_t>();
73 str1.replaceAll(findChar, replaceChar);
74 }),
75 };
76
callFunc(uint8_t index,FuzzedDataProvider & dataProvider,android::String16 str1,android::String16 str2)77 void callFunc(uint8_t index, FuzzedDataProvider& dataProvider, android::String16 str1,
78 android::String16 str2) {
79 operations[index](dataProvider, str1, str2);
80 }
81
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)82 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
83 FuzzedDataProvider dataProvider(data, size);
84 // We're generating two char vectors.
85 // First, generate lengths.
86 const size_t kVecOneLen = dataProvider.ConsumeIntegralInRange<size_t>(1, MAX_STRING_BYTES);
87 const size_t kVecTwoLen = dataProvider.ConsumeIntegralInRange<size_t>(1, MAX_STRING_BYTES);
88
89 // Next, populate the vectors
90 std::vector<char> vec = dataProvider.ConsumeBytesWithTerminator<char>(kVecOneLen);
91 std::vector<char> vec_two = dataProvider.ConsumeBytesWithTerminator<char>(kVecTwoLen);
92
93 // Get pointers to their data
94 char* char_one = vec.data();
95 char* char_two = vec_two.data();
96
97 // Create UTF16 representations
98 android::String16 str_one_utf16 = android::String16(char_one);
99 android::String16 str_two_utf16 = android::String16(char_two);
100
101 // Run operations against strings
102 int opsRun = 0;
103 while (dataProvider.remaining_bytes() > 0 && opsRun++ < MAX_OPERATIONS) {
104 uint8_t op = dataProvider.ConsumeIntegralInRange<uint8_t>(0, operations.size() - 1);
105 callFunc(op, dataProvider, str_one_utf16, str_two_utf16);
106 }
107
108 return 0;
109 }
110