1 /*
2 * Copyright 2020 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16 #include <functional>
17 #include <iostream>
18 #include <vector>
19
20 #include "fuzzer/FuzzedDataProvider.h"
21 #include "utils/String16.h"
22 static constexpr int MAX_STRING_BYTES = 256;
23 static constexpr uint8_t MAX_OPERATIONS = 50;
24
25 std::vector<std::function<void(FuzzedDataProvider&, android::String16, android::String16)>>
26 operations = {
27
28 // Bytes and size
__anonb525b0380102() 29 ([](FuzzedDataProvider&, android::String16 str1, android::String16) -> void {
30 str1.c_str();
31 }),
__anonb525b0380202() 32 ([](FuzzedDataProvider&, android::String16 str1, android::String16) -> void {
33 str1.isStaticString();
34 }),
__anonb525b0380302() 35 ([](FuzzedDataProvider&, android::String16 str1, android::String16) -> void {
36 str1.size();
37 }),
38
39 // Comparison
__anonb525b0380402() 40 ([](FuzzedDataProvider&, android::String16 str1, android::String16 str2) -> void {
41 str1.startsWith(str2);
42 }),
__anonb525b0380502() 43 ([](FuzzedDataProvider&, android::String16 str1, android::String16 str2) -> void {
44 str1.contains(str2.c_str());
45 }),
__anonb525b0380602() 46 ([](FuzzedDataProvider&, android::String16 str1, android::String16 str2) -> void {
47 str1.compare(str2);
48 }),
49
50 // Append and format
__anonb525b0380702() 51 ([](FuzzedDataProvider&, android::String16 str1, android::String16 str2) -> void {
52 str1.append(str2);
53 }),
54 ([](FuzzedDataProvider& dataProvider, android::String16 str1,
__anonb525b0380802() 55 android::String16 str2) -> void {
56 int pos = dataProvider.ConsumeIntegralInRange<int>(0, str1.size());
57 str1.insert(pos, str2.c_str());
58 }),
59
60 // Find and replace operations
61 ([](FuzzedDataProvider& dataProvider, android::String16 str1,
__anonb525b0380902() 62 android::String16) -> void {
63 char16_t findChar = dataProvider.ConsumeIntegral<char16_t>();
64 str1.findFirst(findChar);
65 }),
66 ([](FuzzedDataProvider& dataProvider, android::String16 str1,
__anonb525b0380a02() 67 android::String16) -> void {
68 char16_t findChar = dataProvider.ConsumeIntegral<char16_t>();
69 str1.findLast(findChar);
70 }),
71 ([](FuzzedDataProvider& dataProvider, android::String16 str1,
__anonb525b0380b02() 72 android::String16) -> void {
73 char16_t findChar = dataProvider.ConsumeIntegral<char16_t>();
74 char16_t replaceChar = dataProvider.ConsumeIntegral<char16_t>();
75 str1.replaceAll(findChar, replaceChar);
76 }),
77 };
78
callFunc(uint8_t index,FuzzedDataProvider & dataProvider,android::String16 str1,android::String16 str2)79 void callFunc(uint8_t index, FuzzedDataProvider& dataProvider, android::String16 str1,
80 android::String16 str2) {
81 operations[index](dataProvider, str1, str2);
82 }
83
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)84 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
85 FuzzedDataProvider dataProvider(data, size);
86 // We're generating two char vectors.
87 // First, generate lengths.
88 const size_t kVecOneLen = dataProvider.ConsumeIntegralInRange<size_t>(1, MAX_STRING_BYTES);
89 const size_t kVecTwoLen = dataProvider.ConsumeIntegralInRange<size_t>(1, MAX_STRING_BYTES);
90
91 // Next, populate the vectors
92 std::vector<char> vec = dataProvider.ConsumeBytesWithTerminator<char>(kVecOneLen);
93 std::vector<char> vec_two = dataProvider.ConsumeBytesWithTerminator<char>(kVecTwoLen);
94
95 // Get pointers to their data
96 char* char_one = vec.data();
97 char* char_two = vec_two.data();
98
99 // Create UTF16 representations
100 android::String16 str_one_utf16 = android::String16(char_one);
101 android::String16 str_two_utf16 = android::String16(char_two);
102
103 // Run operations against strings
104 int opsRun = 0;
105 while (dataProvider.remaining_bytes() > 0 && opsRun++ < MAX_OPERATIONS) {
106 uint8_t op = dataProvider.ConsumeIntegralInRange<uint8_t>(0, operations.size() - 1);
107 callFunc(op, dataProvider, str_one_utf16, str_two_utf16);
108 }
109
110 return 0;
111 }
112