1 // Copyright 2018 The Chromium Authors 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include "base/json/string_escape.h" 6 7 #include <memory> 8 #include <string_view> 9 10 #include "base/compiler_specific.h" 11 #include "base/containers/heap_array.h" 12 #include "base/containers/span.h" 13 14 // Entry point for LibFuzzer. LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)15extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { 16 if (size < 2) 17 return 0; 18 19 // SAFETY: required from fuzzer. 20 auto all_input = UNSAFE_BUFFERS(base::span<const uint8_t>(data, size)); 21 22 const bool put_in_quotes = all_input[size - 1]; 23 24 // Create a copy of input buffer, as otherwise we don't catch 25 // overflow that touches the last byte (which is used in put_in_quotes). 26 auto input = base::HeapArray<char>::CopiedFrom( 27 base::as_chars(all_input.first(size - 1))); 28 29 std::string_view input_string = base::as_string_view(input.as_span()); 30 std::string escaped_string; 31 base::EscapeJSONString(input_string, put_in_quotes, &escaped_string); 32 33 // Test for wide-strings if available size is even. 34 if (input.size() & 1) { 35 return 0; 36 } 37 38 size_t actual_size_char16 = input.size() / 2; 39 std::u16string_view input_string16(reinterpret_cast<char16_t*>(input.data()), 40 actual_size_char16); 41 escaped_string.clear(); 42 base::EscapeJSONString(input_string16, put_in_quotes, &escaped_string); 43 44 return 0; 45 } 46