1*9880d681SAndroid Build Coastguard Worker // This file is distributed under the University of Illinois Open Source
2*9880d681SAndroid Build Coastguard Worker // License. See LICENSE.TXT for details.
3*9880d681SAndroid Build Coastguard Worker
4*9880d681SAndroid Build Coastguard Worker // Avoid ODR violations (LibFuzzer is built without ASan and this test is built
5*9880d681SAndroid Build Coastguard Worker // with ASan) involving C++ standard library types when using libcxx.
6*9880d681SAndroid Build Coastguard Worker #define _LIBCPP_HAS_NO_ASAN
7*9880d681SAndroid Build Coastguard Worker
8*9880d681SAndroid Build Coastguard Worker #include "FuzzerInternal.h"
9*9880d681SAndroid Build Coastguard Worker #include "gtest/gtest.h"
10*9880d681SAndroid Build Coastguard Worker #include <memory>
11*9880d681SAndroid Build Coastguard Worker #include <set>
12*9880d681SAndroid Build Coastguard Worker
13*9880d681SAndroid Build Coastguard Worker using namespace fuzzer;
14*9880d681SAndroid Build Coastguard Worker
15*9880d681SAndroid Build Coastguard Worker // For now, have LLVMFuzzerTestOneInput just to make it link.
16*9880d681SAndroid Build Coastguard Worker // Later we may want to make unittests that actually call LLVMFuzzerTestOneInput.
LLVMFuzzerTestOneInput(const uint8_t * Data,size_t Size)17*9880d681SAndroid Build Coastguard Worker extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
18*9880d681SAndroid Build Coastguard Worker abort();
19*9880d681SAndroid Build Coastguard Worker }
20*9880d681SAndroid Build Coastguard Worker
TEST(Fuzzer,CrossOver)21*9880d681SAndroid Build Coastguard Worker TEST(Fuzzer, CrossOver) {
22*9880d681SAndroid Build Coastguard Worker std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
23*9880d681SAndroid Build Coastguard Worker fuzzer::EF = t.get();
24*9880d681SAndroid Build Coastguard Worker Random Rand(0);
25*9880d681SAndroid Build Coastguard Worker MutationDispatcher MD(Rand, {});
26*9880d681SAndroid Build Coastguard Worker Unit A({0, 1, 2}), B({5, 6, 7});
27*9880d681SAndroid Build Coastguard Worker Unit C;
28*9880d681SAndroid Build Coastguard Worker Unit Expected[] = {
29*9880d681SAndroid Build Coastguard Worker { 0 },
30*9880d681SAndroid Build Coastguard Worker { 0, 1 },
31*9880d681SAndroid Build Coastguard Worker { 0, 5 },
32*9880d681SAndroid Build Coastguard Worker { 0, 1, 2 },
33*9880d681SAndroid Build Coastguard Worker { 0, 1, 5 },
34*9880d681SAndroid Build Coastguard Worker { 0, 5, 1 },
35*9880d681SAndroid Build Coastguard Worker { 0, 5, 6 },
36*9880d681SAndroid Build Coastguard Worker { 0, 1, 2, 5 },
37*9880d681SAndroid Build Coastguard Worker { 0, 1, 5, 2 },
38*9880d681SAndroid Build Coastguard Worker { 0, 1, 5, 6 },
39*9880d681SAndroid Build Coastguard Worker { 0, 5, 1, 2 },
40*9880d681SAndroid Build Coastguard Worker { 0, 5, 1, 6 },
41*9880d681SAndroid Build Coastguard Worker { 0, 5, 6, 1 },
42*9880d681SAndroid Build Coastguard Worker { 0, 5, 6, 7 },
43*9880d681SAndroid Build Coastguard Worker { 0, 1, 2, 5, 6 },
44*9880d681SAndroid Build Coastguard Worker { 0, 1, 5, 2, 6 },
45*9880d681SAndroid Build Coastguard Worker { 0, 1, 5, 6, 2 },
46*9880d681SAndroid Build Coastguard Worker { 0, 1, 5, 6, 7 },
47*9880d681SAndroid Build Coastguard Worker { 0, 5, 1, 2, 6 },
48*9880d681SAndroid Build Coastguard Worker { 0, 5, 1, 6, 2 },
49*9880d681SAndroid Build Coastguard Worker { 0, 5, 1, 6, 7 },
50*9880d681SAndroid Build Coastguard Worker { 0, 5, 6, 1, 2 },
51*9880d681SAndroid Build Coastguard Worker { 0, 5, 6, 1, 7 },
52*9880d681SAndroid Build Coastguard Worker { 0, 5, 6, 7, 1 },
53*9880d681SAndroid Build Coastguard Worker { 0, 1, 2, 5, 6, 7 },
54*9880d681SAndroid Build Coastguard Worker { 0, 1, 5, 2, 6, 7 },
55*9880d681SAndroid Build Coastguard Worker { 0, 1, 5, 6, 2, 7 },
56*9880d681SAndroid Build Coastguard Worker { 0, 1, 5, 6, 7, 2 },
57*9880d681SAndroid Build Coastguard Worker { 0, 5, 1, 2, 6, 7 },
58*9880d681SAndroid Build Coastguard Worker { 0, 5, 1, 6, 2, 7 },
59*9880d681SAndroid Build Coastguard Worker { 0, 5, 1, 6, 7, 2 },
60*9880d681SAndroid Build Coastguard Worker { 0, 5, 6, 1, 2, 7 },
61*9880d681SAndroid Build Coastguard Worker { 0, 5, 6, 1, 7, 2 },
62*9880d681SAndroid Build Coastguard Worker { 0, 5, 6, 7, 1, 2 }
63*9880d681SAndroid Build Coastguard Worker };
64*9880d681SAndroid Build Coastguard Worker for (size_t Len = 1; Len < 8; Len++) {
65*9880d681SAndroid Build Coastguard Worker std::set<Unit> FoundUnits, ExpectedUnitsWitThisLength;
66*9880d681SAndroid Build Coastguard Worker for (int Iter = 0; Iter < 3000; Iter++) {
67*9880d681SAndroid Build Coastguard Worker C.resize(Len);
68*9880d681SAndroid Build Coastguard Worker size_t NewSize = MD.CrossOver(A.data(), A.size(), B.data(), B.size(),
69*9880d681SAndroid Build Coastguard Worker C.data(), C.size());
70*9880d681SAndroid Build Coastguard Worker C.resize(NewSize);
71*9880d681SAndroid Build Coastguard Worker FoundUnits.insert(C);
72*9880d681SAndroid Build Coastguard Worker }
73*9880d681SAndroid Build Coastguard Worker for (const Unit &U : Expected)
74*9880d681SAndroid Build Coastguard Worker if (U.size() <= Len)
75*9880d681SAndroid Build Coastguard Worker ExpectedUnitsWitThisLength.insert(U);
76*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(ExpectedUnitsWitThisLength, FoundUnits);
77*9880d681SAndroid Build Coastguard Worker }
78*9880d681SAndroid Build Coastguard Worker }
79*9880d681SAndroid Build Coastguard Worker
TEST(Fuzzer,Hash)80*9880d681SAndroid Build Coastguard Worker TEST(Fuzzer, Hash) {
81*9880d681SAndroid Build Coastguard Worker uint8_t A[] = {'a', 'b', 'c'};
82*9880d681SAndroid Build Coastguard Worker fuzzer::Unit U(A, A + sizeof(A));
83*9880d681SAndroid Build Coastguard Worker EXPECT_EQ("a9993e364706816aba3e25717850c26c9cd0d89d", fuzzer::Hash(U));
84*9880d681SAndroid Build Coastguard Worker U.push_back('d');
85*9880d681SAndroid Build Coastguard Worker EXPECT_EQ("81fe8bfe87576c3ecb22426f8e57847382917acf", fuzzer::Hash(U));
86*9880d681SAndroid Build Coastguard Worker }
87*9880d681SAndroid Build Coastguard Worker
88*9880d681SAndroid Build Coastguard Worker typedef size_t (MutationDispatcher::*Mutator)(uint8_t *Data, size_t Size,
89*9880d681SAndroid Build Coastguard Worker size_t MaxSize);
90*9880d681SAndroid Build Coastguard Worker
TestEraseByte(Mutator M,int NumIter)91*9880d681SAndroid Build Coastguard Worker void TestEraseByte(Mutator M, int NumIter) {
92*9880d681SAndroid Build Coastguard Worker std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
93*9880d681SAndroid Build Coastguard Worker fuzzer::EF = t.get();
94*9880d681SAndroid Build Coastguard Worker uint8_t REM0[8] = {0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77};
95*9880d681SAndroid Build Coastguard Worker uint8_t REM1[8] = {0x00, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77};
96*9880d681SAndroid Build Coastguard Worker uint8_t REM2[8] = {0x00, 0x11, 0x33, 0x44, 0x55, 0x66, 0x77};
97*9880d681SAndroid Build Coastguard Worker uint8_t REM3[8] = {0x00, 0x11, 0x22, 0x44, 0x55, 0x66, 0x77};
98*9880d681SAndroid Build Coastguard Worker uint8_t REM4[8] = {0x00, 0x11, 0x22, 0x33, 0x55, 0x66, 0x77};
99*9880d681SAndroid Build Coastguard Worker uint8_t REM5[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x66, 0x77};
100*9880d681SAndroid Build Coastguard Worker uint8_t REM6[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x77};
101*9880d681SAndroid Build Coastguard Worker uint8_t REM7[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66};
102*9880d681SAndroid Build Coastguard Worker Random Rand(0);
103*9880d681SAndroid Build Coastguard Worker MutationDispatcher MD(Rand, {});
104*9880d681SAndroid Build Coastguard Worker int FoundMask = 0;
105*9880d681SAndroid Build Coastguard Worker for (int i = 0; i < NumIter; i++) {
106*9880d681SAndroid Build Coastguard Worker uint8_t T[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77};
107*9880d681SAndroid Build Coastguard Worker size_t NewSize = (MD.*M)(T, sizeof(T), sizeof(T));
108*9880d681SAndroid Build Coastguard Worker if (NewSize == 7 && !memcmp(REM0, T, 7)) FoundMask |= 1 << 0;
109*9880d681SAndroid Build Coastguard Worker if (NewSize == 7 && !memcmp(REM1, T, 7)) FoundMask |= 1 << 1;
110*9880d681SAndroid Build Coastguard Worker if (NewSize == 7 && !memcmp(REM2, T, 7)) FoundMask |= 1 << 2;
111*9880d681SAndroid Build Coastguard Worker if (NewSize == 7 && !memcmp(REM3, T, 7)) FoundMask |= 1 << 3;
112*9880d681SAndroid Build Coastguard Worker if (NewSize == 7 && !memcmp(REM4, T, 7)) FoundMask |= 1 << 4;
113*9880d681SAndroid Build Coastguard Worker if (NewSize == 7 && !memcmp(REM5, T, 7)) FoundMask |= 1 << 5;
114*9880d681SAndroid Build Coastguard Worker if (NewSize == 7 && !memcmp(REM6, T, 7)) FoundMask |= 1 << 6;
115*9880d681SAndroid Build Coastguard Worker if (NewSize == 7 && !memcmp(REM7, T, 7)) FoundMask |= 1 << 7;
116*9880d681SAndroid Build Coastguard Worker }
117*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(FoundMask, 255);
118*9880d681SAndroid Build Coastguard Worker }
119*9880d681SAndroid Build Coastguard Worker
TEST(FuzzerMutate,EraseByte1)120*9880d681SAndroid Build Coastguard Worker TEST(FuzzerMutate, EraseByte1) {
121*9880d681SAndroid Build Coastguard Worker TestEraseByte(&MutationDispatcher::Mutate_EraseByte, 100);
122*9880d681SAndroid Build Coastguard Worker }
TEST(FuzzerMutate,EraseByte2)123*9880d681SAndroid Build Coastguard Worker TEST(FuzzerMutate, EraseByte2) {
124*9880d681SAndroid Build Coastguard Worker TestEraseByte(&MutationDispatcher::Mutate, 1000);
125*9880d681SAndroid Build Coastguard Worker }
126*9880d681SAndroid Build Coastguard Worker
TestInsertByte(Mutator M,int NumIter)127*9880d681SAndroid Build Coastguard Worker void TestInsertByte(Mutator M, int NumIter) {
128*9880d681SAndroid Build Coastguard Worker std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
129*9880d681SAndroid Build Coastguard Worker fuzzer::EF = t.get();
130*9880d681SAndroid Build Coastguard Worker Random Rand(0);
131*9880d681SAndroid Build Coastguard Worker MutationDispatcher MD(Rand, {});
132*9880d681SAndroid Build Coastguard Worker int FoundMask = 0;
133*9880d681SAndroid Build Coastguard Worker uint8_t INS0[8] = {0xF1, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66};
134*9880d681SAndroid Build Coastguard Worker uint8_t INS1[8] = {0x00, 0xF2, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66};
135*9880d681SAndroid Build Coastguard Worker uint8_t INS2[8] = {0x00, 0x11, 0xF3, 0x22, 0x33, 0x44, 0x55, 0x66};
136*9880d681SAndroid Build Coastguard Worker uint8_t INS3[8] = {0x00, 0x11, 0x22, 0xF4, 0x33, 0x44, 0x55, 0x66};
137*9880d681SAndroid Build Coastguard Worker uint8_t INS4[8] = {0x00, 0x11, 0x22, 0x33, 0xF5, 0x44, 0x55, 0x66};
138*9880d681SAndroid Build Coastguard Worker uint8_t INS5[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0xF6, 0x55, 0x66};
139*9880d681SAndroid Build Coastguard Worker uint8_t INS6[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0xF7, 0x66};
140*9880d681SAndroid Build Coastguard Worker uint8_t INS7[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0xF8};
141*9880d681SAndroid Build Coastguard Worker for (int i = 0; i < NumIter; i++) {
142*9880d681SAndroid Build Coastguard Worker uint8_t T[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66};
143*9880d681SAndroid Build Coastguard Worker size_t NewSize = (MD.*M)(T, 7, 8);
144*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(INS0, T, 8)) FoundMask |= 1 << 0;
145*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(INS1, T, 8)) FoundMask |= 1 << 1;
146*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(INS2, T, 8)) FoundMask |= 1 << 2;
147*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(INS3, T, 8)) FoundMask |= 1 << 3;
148*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(INS4, T, 8)) FoundMask |= 1 << 4;
149*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(INS5, T, 8)) FoundMask |= 1 << 5;
150*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(INS6, T, 8)) FoundMask |= 1 << 6;
151*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(INS7, T, 8)) FoundMask |= 1 << 7;
152*9880d681SAndroid Build Coastguard Worker }
153*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(FoundMask, 255);
154*9880d681SAndroid Build Coastguard Worker }
155*9880d681SAndroid Build Coastguard Worker
TEST(FuzzerMutate,InsertByte1)156*9880d681SAndroid Build Coastguard Worker TEST(FuzzerMutate, InsertByte1) {
157*9880d681SAndroid Build Coastguard Worker TestInsertByte(&MutationDispatcher::Mutate_InsertByte, 1 << 15);
158*9880d681SAndroid Build Coastguard Worker }
TEST(FuzzerMutate,InsertByte2)159*9880d681SAndroid Build Coastguard Worker TEST(FuzzerMutate, InsertByte2) {
160*9880d681SAndroid Build Coastguard Worker TestInsertByte(&MutationDispatcher::Mutate, 1 << 17);
161*9880d681SAndroid Build Coastguard Worker }
162*9880d681SAndroid Build Coastguard Worker
TestChangeByte(Mutator M,int NumIter)163*9880d681SAndroid Build Coastguard Worker void TestChangeByte(Mutator M, int NumIter) {
164*9880d681SAndroid Build Coastguard Worker std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
165*9880d681SAndroid Build Coastguard Worker fuzzer::EF = t.get();
166*9880d681SAndroid Build Coastguard Worker Random Rand(0);
167*9880d681SAndroid Build Coastguard Worker MutationDispatcher MD(Rand, {});
168*9880d681SAndroid Build Coastguard Worker int FoundMask = 0;
169*9880d681SAndroid Build Coastguard Worker uint8_t CH0[8] = {0xF0, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77};
170*9880d681SAndroid Build Coastguard Worker uint8_t CH1[8] = {0x00, 0xF1, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77};
171*9880d681SAndroid Build Coastguard Worker uint8_t CH2[8] = {0x00, 0x11, 0xF2, 0x33, 0x44, 0x55, 0x66, 0x77};
172*9880d681SAndroid Build Coastguard Worker uint8_t CH3[8] = {0x00, 0x11, 0x22, 0xF3, 0x44, 0x55, 0x66, 0x77};
173*9880d681SAndroid Build Coastguard Worker uint8_t CH4[8] = {0x00, 0x11, 0x22, 0x33, 0xF4, 0x55, 0x66, 0x77};
174*9880d681SAndroid Build Coastguard Worker uint8_t CH5[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0xF5, 0x66, 0x77};
175*9880d681SAndroid Build Coastguard Worker uint8_t CH6[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0xF5, 0x77};
176*9880d681SAndroid Build Coastguard Worker uint8_t CH7[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0xF7};
177*9880d681SAndroid Build Coastguard Worker for (int i = 0; i < NumIter; i++) {
178*9880d681SAndroid Build Coastguard Worker uint8_t T[9] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77};
179*9880d681SAndroid Build Coastguard Worker size_t NewSize = (MD.*M)(T, 8, 9);
180*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(CH0, T, 8)) FoundMask |= 1 << 0;
181*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(CH1, T, 8)) FoundMask |= 1 << 1;
182*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(CH2, T, 8)) FoundMask |= 1 << 2;
183*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(CH3, T, 8)) FoundMask |= 1 << 3;
184*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(CH4, T, 8)) FoundMask |= 1 << 4;
185*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(CH5, T, 8)) FoundMask |= 1 << 5;
186*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(CH6, T, 8)) FoundMask |= 1 << 6;
187*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(CH7, T, 8)) FoundMask |= 1 << 7;
188*9880d681SAndroid Build Coastguard Worker }
189*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(FoundMask, 255);
190*9880d681SAndroid Build Coastguard Worker }
191*9880d681SAndroid Build Coastguard Worker
TEST(FuzzerMutate,ChangeByte1)192*9880d681SAndroid Build Coastguard Worker TEST(FuzzerMutate, ChangeByte1) {
193*9880d681SAndroid Build Coastguard Worker TestChangeByte(&MutationDispatcher::Mutate_ChangeByte, 1 << 15);
194*9880d681SAndroid Build Coastguard Worker }
TEST(FuzzerMutate,ChangeByte2)195*9880d681SAndroid Build Coastguard Worker TEST(FuzzerMutate, ChangeByte2) {
196*9880d681SAndroid Build Coastguard Worker TestChangeByte(&MutationDispatcher::Mutate, 1 << 17);
197*9880d681SAndroid Build Coastguard Worker }
198*9880d681SAndroid Build Coastguard Worker
TestChangeBit(Mutator M,int NumIter)199*9880d681SAndroid Build Coastguard Worker void TestChangeBit(Mutator M, int NumIter) {
200*9880d681SAndroid Build Coastguard Worker std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
201*9880d681SAndroid Build Coastguard Worker fuzzer::EF = t.get();
202*9880d681SAndroid Build Coastguard Worker Random Rand(0);
203*9880d681SAndroid Build Coastguard Worker MutationDispatcher MD(Rand, {});
204*9880d681SAndroid Build Coastguard Worker int FoundMask = 0;
205*9880d681SAndroid Build Coastguard Worker uint8_t CH0[8] = {0x01, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77};
206*9880d681SAndroid Build Coastguard Worker uint8_t CH1[8] = {0x00, 0x13, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77};
207*9880d681SAndroid Build Coastguard Worker uint8_t CH2[8] = {0x00, 0x11, 0x02, 0x33, 0x44, 0x55, 0x66, 0x77};
208*9880d681SAndroid Build Coastguard Worker uint8_t CH3[8] = {0x00, 0x11, 0x22, 0x37, 0x44, 0x55, 0x66, 0x77};
209*9880d681SAndroid Build Coastguard Worker uint8_t CH4[8] = {0x00, 0x11, 0x22, 0x33, 0x54, 0x55, 0x66, 0x77};
210*9880d681SAndroid Build Coastguard Worker uint8_t CH5[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x54, 0x66, 0x77};
211*9880d681SAndroid Build Coastguard Worker uint8_t CH6[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x76, 0x77};
212*9880d681SAndroid Build Coastguard Worker uint8_t CH7[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0xF7};
213*9880d681SAndroid Build Coastguard Worker for (int i = 0; i < NumIter; i++) {
214*9880d681SAndroid Build Coastguard Worker uint8_t T[9] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77};
215*9880d681SAndroid Build Coastguard Worker size_t NewSize = (MD.*M)(T, 8, 9);
216*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(CH0, T, 8)) FoundMask |= 1 << 0;
217*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(CH1, T, 8)) FoundMask |= 1 << 1;
218*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(CH2, T, 8)) FoundMask |= 1 << 2;
219*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(CH3, T, 8)) FoundMask |= 1 << 3;
220*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(CH4, T, 8)) FoundMask |= 1 << 4;
221*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(CH5, T, 8)) FoundMask |= 1 << 5;
222*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(CH6, T, 8)) FoundMask |= 1 << 6;
223*9880d681SAndroid Build Coastguard Worker if (NewSize == 8 && !memcmp(CH7, T, 8)) FoundMask |= 1 << 7;
224*9880d681SAndroid Build Coastguard Worker }
225*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(FoundMask, 255);
226*9880d681SAndroid Build Coastguard Worker }
227*9880d681SAndroid Build Coastguard Worker
TEST(FuzzerMutate,ChangeBit1)228*9880d681SAndroid Build Coastguard Worker TEST(FuzzerMutate, ChangeBit1) {
229*9880d681SAndroid Build Coastguard Worker TestChangeBit(&MutationDispatcher::Mutate_ChangeBit, 1 << 16);
230*9880d681SAndroid Build Coastguard Worker }
TEST(FuzzerMutate,ChangeBit2)231*9880d681SAndroid Build Coastguard Worker TEST(FuzzerMutate, ChangeBit2) {
232*9880d681SAndroid Build Coastguard Worker TestChangeBit(&MutationDispatcher::Mutate, 1 << 18);
233*9880d681SAndroid Build Coastguard Worker }
234*9880d681SAndroid Build Coastguard Worker
TestShuffleBytes(Mutator M,int NumIter)235*9880d681SAndroid Build Coastguard Worker void TestShuffleBytes(Mutator M, int NumIter) {
236*9880d681SAndroid Build Coastguard Worker std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
237*9880d681SAndroid Build Coastguard Worker fuzzer::EF = t.get();
238*9880d681SAndroid Build Coastguard Worker Random Rand(0);
239*9880d681SAndroid Build Coastguard Worker MutationDispatcher MD(Rand, {});
240*9880d681SAndroid Build Coastguard Worker int FoundMask = 0;
241*9880d681SAndroid Build Coastguard Worker uint8_t CH0[7] = {0x00, 0x22, 0x11, 0x33, 0x44, 0x55, 0x66};
242*9880d681SAndroid Build Coastguard Worker uint8_t CH1[7] = {0x11, 0x00, 0x33, 0x22, 0x44, 0x55, 0x66};
243*9880d681SAndroid Build Coastguard Worker uint8_t CH2[7] = {0x00, 0x33, 0x11, 0x22, 0x44, 0x55, 0x66};
244*9880d681SAndroid Build Coastguard Worker uint8_t CH3[7] = {0x00, 0x11, 0x22, 0x44, 0x55, 0x66, 0x33};
245*9880d681SAndroid Build Coastguard Worker uint8_t CH4[7] = {0x00, 0x11, 0x22, 0x33, 0x55, 0x44, 0x66};
246*9880d681SAndroid Build Coastguard Worker for (int i = 0; i < NumIter; i++) {
247*9880d681SAndroid Build Coastguard Worker uint8_t T[7] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66};
248*9880d681SAndroid Build Coastguard Worker size_t NewSize = (MD.*M)(T, 7, 7);
249*9880d681SAndroid Build Coastguard Worker if (NewSize == 7 && !memcmp(CH0, T, 7)) FoundMask |= 1 << 0;
250*9880d681SAndroid Build Coastguard Worker if (NewSize == 7 && !memcmp(CH1, T, 7)) FoundMask |= 1 << 1;
251*9880d681SAndroid Build Coastguard Worker if (NewSize == 7 && !memcmp(CH2, T, 7)) FoundMask |= 1 << 2;
252*9880d681SAndroid Build Coastguard Worker if (NewSize == 7 && !memcmp(CH3, T, 7)) FoundMask |= 1 << 3;
253*9880d681SAndroid Build Coastguard Worker if (NewSize == 7 && !memcmp(CH4, T, 7)) FoundMask |= 1 << 4;
254*9880d681SAndroid Build Coastguard Worker }
255*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(FoundMask, 31);
256*9880d681SAndroid Build Coastguard Worker }
257*9880d681SAndroid Build Coastguard Worker
TEST(FuzzerMutate,ShuffleBytes1)258*9880d681SAndroid Build Coastguard Worker TEST(FuzzerMutate, ShuffleBytes1) {
259*9880d681SAndroid Build Coastguard Worker TestShuffleBytes(&MutationDispatcher::Mutate_ShuffleBytes, 1 << 16);
260*9880d681SAndroid Build Coastguard Worker }
TEST(FuzzerMutate,ShuffleBytes2)261*9880d681SAndroid Build Coastguard Worker TEST(FuzzerMutate, ShuffleBytes2) {
262*9880d681SAndroid Build Coastguard Worker TestShuffleBytes(&MutationDispatcher::Mutate, 1 << 20);
263*9880d681SAndroid Build Coastguard Worker }
264*9880d681SAndroid Build Coastguard Worker
TestAddWordFromDictionary(Mutator M,int NumIter)265*9880d681SAndroid Build Coastguard Worker void TestAddWordFromDictionary(Mutator M, int NumIter) {
266*9880d681SAndroid Build Coastguard Worker std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
267*9880d681SAndroid Build Coastguard Worker fuzzer::EF = t.get();
268*9880d681SAndroid Build Coastguard Worker Random Rand(0);
269*9880d681SAndroid Build Coastguard Worker MutationDispatcher MD(Rand, {});
270*9880d681SAndroid Build Coastguard Worker uint8_t Word1[4] = {0xAA, 0xBB, 0xCC, 0xDD};
271*9880d681SAndroid Build Coastguard Worker uint8_t Word2[3] = {0xFF, 0xEE, 0xEF};
272*9880d681SAndroid Build Coastguard Worker MD.AddWordToManualDictionary(Word(Word1, sizeof(Word1)));
273*9880d681SAndroid Build Coastguard Worker MD.AddWordToManualDictionary(Word(Word2, sizeof(Word2)));
274*9880d681SAndroid Build Coastguard Worker int FoundMask = 0;
275*9880d681SAndroid Build Coastguard Worker uint8_t CH0[7] = {0x00, 0x11, 0x22, 0xAA, 0xBB, 0xCC, 0xDD};
276*9880d681SAndroid Build Coastguard Worker uint8_t CH1[7] = {0x00, 0x11, 0xAA, 0xBB, 0xCC, 0xDD, 0x22};
277*9880d681SAndroid Build Coastguard Worker uint8_t CH2[7] = {0x00, 0xAA, 0xBB, 0xCC, 0xDD, 0x11, 0x22};
278*9880d681SAndroid Build Coastguard Worker uint8_t CH3[7] = {0xAA, 0xBB, 0xCC, 0xDD, 0x00, 0x11, 0x22};
279*9880d681SAndroid Build Coastguard Worker uint8_t CH4[6] = {0x00, 0x11, 0x22, 0xFF, 0xEE, 0xEF};
280*9880d681SAndroid Build Coastguard Worker uint8_t CH5[6] = {0x00, 0x11, 0xFF, 0xEE, 0xEF, 0x22};
281*9880d681SAndroid Build Coastguard Worker uint8_t CH6[6] = {0x00, 0xFF, 0xEE, 0xEF, 0x11, 0x22};
282*9880d681SAndroid Build Coastguard Worker uint8_t CH7[6] = {0xFF, 0xEE, 0xEF, 0x00, 0x11, 0x22};
283*9880d681SAndroid Build Coastguard Worker for (int i = 0; i < NumIter; i++) {
284*9880d681SAndroid Build Coastguard Worker uint8_t T[7] = {0x00, 0x11, 0x22};
285*9880d681SAndroid Build Coastguard Worker size_t NewSize = (MD.*M)(T, 3, 7);
286*9880d681SAndroid Build Coastguard Worker if (NewSize == 7 && !memcmp(CH0, T, 7)) FoundMask |= 1 << 0;
287*9880d681SAndroid Build Coastguard Worker if (NewSize == 7 && !memcmp(CH1, T, 7)) FoundMask |= 1 << 1;
288*9880d681SAndroid Build Coastguard Worker if (NewSize == 7 && !memcmp(CH2, T, 7)) FoundMask |= 1 << 2;
289*9880d681SAndroid Build Coastguard Worker if (NewSize == 7 && !memcmp(CH3, T, 7)) FoundMask |= 1 << 3;
290*9880d681SAndroid Build Coastguard Worker if (NewSize == 6 && !memcmp(CH4, T, 6)) FoundMask |= 1 << 4;
291*9880d681SAndroid Build Coastguard Worker if (NewSize == 6 && !memcmp(CH5, T, 6)) FoundMask |= 1 << 5;
292*9880d681SAndroid Build Coastguard Worker if (NewSize == 6 && !memcmp(CH6, T, 6)) FoundMask |= 1 << 6;
293*9880d681SAndroid Build Coastguard Worker if (NewSize == 6 && !memcmp(CH7, T, 6)) FoundMask |= 1 << 7;
294*9880d681SAndroid Build Coastguard Worker }
295*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(FoundMask, 255);
296*9880d681SAndroid Build Coastguard Worker }
297*9880d681SAndroid Build Coastguard Worker
TEST(FuzzerMutate,AddWordFromDictionary1)298*9880d681SAndroid Build Coastguard Worker TEST(FuzzerMutate, AddWordFromDictionary1) {
299*9880d681SAndroid Build Coastguard Worker TestAddWordFromDictionary(
300*9880d681SAndroid Build Coastguard Worker &MutationDispatcher::Mutate_AddWordFromManualDictionary, 1 << 15);
301*9880d681SAndroid Build Coastguard Worker }
302*9880d681SAndroid Build Coastguard Worker
TEST(FuzzerMutate,AddWordFromDictionary2)303*9880d681SAndroid Build Coastguard Worker TEST(FuzzerMutate, AddWordFromDictionary2) {
304*9880d681SAndroid Build Coastguard Worker TestAddWordFromDictionary(&MutationDispatcher::Mutate, 1 << 15);
305*9880d681SAndroid Build Coastguard Worker }
306*9880d681SAndroid Build Coastguard Worker
TestAddWordFromDictionaryWithHint(Mutator M,int NumIter)307*9880d681SAndroid Build Coastguard Worker void TestAddWordFromDictionaryWithHint(Mutator M, int NumIter) {
308*9880d681SAndroid Build Coastguard Worker std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
309*9880d681SAndroid Build Coastguard Worker fuzzer::EF = t.get();
310*9880d681SAndroid Build Coastguard Worker Random Rand(0);
311*9880d681SAndroid Build Coastguard Worker MutationDispatcher MD(Rand, {});
312*9880d681SAndroid Build Coastguard Worker uint8_t W[] = {0xAA, 0xBB, 0xCC, 0xDD, 0xFF, 0xEE, 0xEF};
313*9880d681SAndroid Build Coastguard Worker size_t PosHint = 7777;
314*9880d681SAndroid Build Coastguard Worker MD.AddWordToAutoDictionary(Word(W, sizeof(W)), PosHint);
315*9880d681SAndroid Build Coastguard Worker int FoundMask = 0;
316*9880d681SAndroid Build Coastguard Worker for (int i = 0; i < NumIter; i++) {
317*9880d681SAndroid Build Coastguard Worker uint8_t T[10000];
318*9880d681SAndroid Build Coastguard Worker memset(T, 0, sizeof(T));
319*9880d681SAndroid Build Coastguard Worker size_t NewSize = (MD.*M)(T, 9000, 10000);
320*9880d681SAndroid Build Coastguard Worker if (NewSize >= PosHint + sizeof(W) &&
321*9880d681SAndroid Build Coastguard Worker !memcmp(W, T + PosHint, sizeof(W)))
322*9880d681SAndroid Build Coastguard Worker FoundMask = 1;
323*9880d681SAndroid Build Coastguard Worker }
324*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(FoundMask, 1);
325*9880d681SAndroid Build Coastguard Worker }
326*9880d681SAndroid Build Coastguard Worker
TEST(FuzzerMutate,AddWordFromDictionaryWithHint1)327*9880d681SAndroid Build Coastguard Worker TEST(FuzzerMutate, AddWordFromDictionaryWithHint1) {
328*9880d681SAndroid Build Coastguard Worker TestAddWordFromDictionaryWithHint(
329*9880d681SAndroid Build Coastguard Worker &MutationDispatcher::Mutate_AddWordFromTemporaryAutoDictionary, 1 << 5);
330*9880d681SAndroid Build Coastguard Worker }
331*9880d681SAndroid Build Coastguard Worker
TEST(FuzzerMutate,AddWordFromDictionaryWithHint2)332*9880d681SAndroid Build Coastguard Worker TEST(FuzzerMutate, AddWordFromDictionaryWithHint2) {
333*9880d681SAndroid Build Coastguard Worker TestAddWordFromDictionaryWithHint(&MutationDispatcher::Mutate, 1 << 10);
334*9880d681SAndroid Build Coastguard Worker }
335*9880d681SAndroid Build Coastguard Worker
TestChangeASCIIInteger(Mutator M,int NumIter)336*9880d681SAndroid Build Coastguard Worker void TestChangeASCIIInteger(Mutator M, int NumIter) {
337*9880d681SAndroid Build Coastguard Worker std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
338*9880d681SAndroid Build Coastguard Worker fuzzer::EF = t.get();
339*9880d681SAndroid Build Coastguard Worker Random Rand(0);
340*9880d681SAndroid Build Coastguard Worker MutationDispatcher MD(Rand, {});
341*9880d681SAndroid Build Coastguard Worker
342*9880d681SAndroid Build Coastguard Worker uint8_t CH0[8] = {'1', '2', '3', '4', '5', '6', '7', '7'};
343*9880d681SAndroid Build Coastguard Worker uint8_t CH1[8] = {'1', '2', '3', '4', '5', '6', '7', '9'};
344*9880d681SAndroid Build Coastguard Worker uint8_t CH2[8] = {'2', '4', '6', '9', '1', '3', '5', '6'};
345*9880d681SAndroid Build Coastguard Worker uint8_t CH3[8] = {'0', '6', '1', '7', '2', '8', '3', '9'};
346*9880d681SAndroid Build Coastguard Worker int FoundMask = 0;
347*9880d681SAndroid Build Coastguard Worker for (int i = 0; i < NumIter; i++) {
348*9880d681SAndroid Build Coastguard Worker uint8_t T[8] = {'1', '2', '3', '4', '5', '6', '7', '8'};
349*9880d681SAndroid Build Coastguard Worker size_t NewSize = (MD.*M)(T, 8, 8);
350*9880d681SAndroid Build Coastguard Worker /**/ if (NewSize == 8 && !memcmp(CH0, T, 8)) FoundMask |= 1 << 0;
351*9880d681SAndroid Build Coastguard Worker else if (NewSize == 8 && !memcmp(CH1, T, 8)) FoundMask |= 1 << 1;
352*9880d681SAndroid Build Coastguard Worker else if (NewSize == 8 && !memcmp(CH2, T, 8)) FoundMask |= 1 << 2;
353*9880d681SAndroid Build Coastguard Worker else if (NewSize == 8 && !memcmp(CH3, T, 8)) FoundMask |= 1 << 3;
354*9880d681SAndroid Build Coastguard Worker else if (NewSize == 8) FoundMask |= 1 << 4;
355*9880d681SAndroid Build Coastguard Worker }
356*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(FoundMask, 31);
357*9880d681SAndroid Build Coastguard Worker }
358*9880d681SAndroid Build Coastguard Worker
TEST(FuzzerMutate,ChangeASCIIInteger1)359*9880d681SAndroid Build Coastguard Worker TEST(FuzzerMutate, ChangeASCIIInteger1) {
360*9880d681SAndroid Build Coastguard Worker TestChangeASCIIInteger(&MutationDispatcher::Mutate_ChangeASCIIInteger,
361*9880d681SAndroid Build Coastguard Worker 1 << 15);
362*9880d681SAndroid Build Coastguard Worker }
363*9880d681SAndroid Build Coastguard Worker
TEST(FuzzerMutate,ChangeASCIIInteger2)364*9880d681SAndroid Build Coastguard Worker TEST(FuzzerMutate, ChangeASCIIInteger2) {
365*9880d681SAndroid Build Coastguard Worker TestChangeASCIIInteger(&MutationDispatcher::Mutate, 1 << 15);
366*9880d681SAndroid Build Coastguard Worker }
367*9880d681SAndroid Build Coastguard Worker
368*9880d681SAndroid Build Coastguard Worker
TEST(FuzzerDictionary,ParseOneDictionaryEntry)369*9880d681SAndroid Build Coastguard Worker TEST(FuzzerDictionary, ParseOneDictionaryEntry) {
370*9880d681SAndroid Build Coastguard Worker Unit U;
371*9880d681SAndroid Build Coastguard Worker EXPECT_FALSE(ParseOneDictionaryEntry("", &U));
372*9880d681SAndroid Build Coastguard Worker EXPECT_FALSE(ParseOneDictionaryEntry(" ", &U));
373*9880d681SAndroid Build Coastguard Worker EXPECT_FALSE(ParseOneDictionaryEntry("\t ", &U));
374*9880d681SAndroid Build Coastguard Worker EXPECT_FALSE(ParseOneDictionaryEntry(" \" ", &U));
375*9880d681SAndroid Build Coastguard Worker EXPECT_FALSE(ParseOneDictionaryEntry(" zz\" ", &U));
376*9880d681SAndroid Build Coastguard Worker EXPECT_FALSE(ParseOneDictionaryEntry(" \"zz ", &U));
377*9880d681SAndroid Build Coastguard Worker EXPECT_FALSE(ParseOneDictionaryEntry(" \"\" ", &U));
378*9880d681SAndroid Build Coastguard Worker EXPECT_TRUE(ParseOneDictionaryEntry("\"a\"", &U));
379*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(U, Unit({'a'}));
380*9880d681SAndroid Build Coastguard Worker EXPECT_TRUE(ParseOneDictionaryEntry("\"abc\"", &U));
381*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(U, Unit({'a', 'b', 'c'}));
382*9880d681SAndroid Build Coastguard Worker EXPECT_TRUE(ParseOneDictionaryEntry("abc=\"abc\"", &U));
383*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(U, Unit({'a', 'b', 'c'}));
384*9880d681SAndroid Build Coastguard Worker EXPECT_FALSE(ParseOneDictionaryEntry("\"\\\"", &U));
385*9880d681SAndroid Build Coastguard Worker EXPECT_TRUE(ParseOneDictionaryEntry("\"\\\\\"", &U));
386*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(U, Unit({'\\'}));
387*9880d681SAndroid Build Coastguard Worker EXPECT_TRUE(ParseOneDictionaryEntry("\"\\xAB\"", &U));
388*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(U, Unit({0xAB}));
389*9880d681SAndroid Build Coastguard Worker EXPECT_TRUE(ParseOneDictionaryEntry("\"\\xABz\\xDE\"", &U));
390*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(U, Unit({0xAB, 'z', 0xDE}));
391*9880d681SAndroid Build Coastguard Worker EXPECT_TRUE(ParseOneDictionaryEntry("\"#\"", &U));
392*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(U, Unit({'#'}));
393*9880d681SAndroid Build Coastguard Worker EXPECT_TRUE(ParseOneDictionaryEntry("\"\\\"\"", &U));
394*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(U, Unit({'"'}));
395*9880d681SAndroid Build Coastguard Worker }
396*9880d681SAndroid Build Coastguard Worker
TEST(FuzzerDictionary,ParseDictionaryFile)397*9880d681SAndroid Build Coastguard Worker TEST(FuzzerDictionary, ParseDictionaryFile) {
398*9880d681SAndroid Build Coastguard Worker std::vector<Unit> Units;
399*9880d681SAndroid Build Coastguard Worker EXPECT_FALSE(ParseDictionaryFile("zzz\n", &Units));
400*9880d681SAndroid Build Coastguard Worker EXPECT_FALSE(ParseDictionaryFile("", &Units));
401*9880d681SAndroid Build Coastguard Worker EXPECT_TRUE(ParseDictionaryFile("\n", &Units));
402*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(Units.size(), 0U);
403*9880d681SAndroid Build Coastguard Worker EXPECT_TRUE(ParseDictionaryFile("#zzzz a b c d\n", &Units));
404*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(Units.size(), 0U);
405*9880d681SAndroid Build Coastguard Worker EXPECT_TRUE(ParseDictionaryFile(" #zzzz\n", &Units));
406*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(Units.size(), 0U);
407*9880d681SAndroid Build Coastguard Worker EXPECT_TRUE(ParseDictionaryFile(" #zzzz\n", &Units));
408*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(Units.size(), 0U);
409*9880d681SAndroid Build Coastguard Worker EXPECT_TRUE(ParseDictionaryFile(" #zzzz\naaa=\"aa\"", &Units));
410*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(Units, std::vector<Unit>({Unit({'a', 'a'})}));
411*9880d681SAndroid Build Coastguard Worker EXPECT_TRUE(
412*9880d681SAndroid Build Coastguard Worker ParseDictionaryFile(" #zzzz\naaa=\"aa\"\n\nabc=\"abc\"", &Units));
413*9880d681SAndroid Build Coastguard Worker EXPECT_EQ(Units,
414*9880d681SAndroid Build Coastguard Worker std::vector<Unit>({Unit({'a', 'a'}), Unit({'a', 'b', 'c'})}));
415*9880d681SAndroid Build Coastguard Worker }
416*9880d681SAndroid Build Coastguard Worker
TEST(FuzzerUtil,Base64)417*9880d681SAndroid Build Coastguard Worker TEST(FuzzerUtil, Base64) {
418*9880d681SAndroid Build Coastguard Worker EXPECT_EQ("", Base64({}));
419*9880d681SAndroid Build Coastguard Worker EXPECT_EQ("YQ==", Base64({'a'}));
420*9880d681SAndroid Build Coastguard Worker EXPECT_EQ("eA==", Base64({'x'}));
421*9880d681SAndroid Build Coastguard Worker EXPECT_EQ("YWI=", Base64({'a', 'b'}));
422*9880d681SAndroid Build Coastguard Worker EXPECT_EQ("eHk=", Base64({'x', 'y'}));
423*9880d681SAndroid Build Coastguard Worker EXPECT_EQ("YWJj", Base64({'a', 'b', 'c'}));
424*9880d681SAndroid Build Coastguard Worker EXPECT_EQ("eHl6", Base64({'x', 'y', 'z'}));
425*9880d681SAndroid Build Coastguard Worker EXPECT_EQ("YWJjeA==", Base64({'a', 'b', 'c', 'x'}));
426*9880d681SAndroid Build Coastguard Worker EXPECT_EQ("YWJjeHk=", Base64({'a', 'b', 'c', 'x', 'y'}));
427*9880d681SAndroid Build Coastguard Worker EXPECT_EQ("YWJjeHl6", Base64({'a', 'b', 'c', 'x', 'y', 'z'}));
428*9880d681SAndroid Build Coastguard Worker }
429*9880d681SAndroid Build Coastguard Worker
TEST(Corpus,Distribution)430*9880d681SAndroid Build Coastguard Worker TEST(Corpus, Distribution) {
431*9880d681SAndroid Build Coastguard Worker std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
432*9880d681SAndroid Build Coastguard Worker fuzzer::EF = t.get();
433*9880d681SAndroid Build Coastguard Worker Random Rand(0);
434*9880d681SAndroid Build Coastguard Worker MutationDispatcher MD(Rand, {});
435*9880d681SAndroid Build Coastguard Worker Fuzzer Fuzz(LLVMFuzzerTestOneInput, MD, {});
436*9880d681SAndroid Build Coastguard Worker size_t N = 10;
437*9880d681SAndroid Build Coastguard Worker size_t TriesPerUnit = 1<<20;
438*9880d681SAndroid Build Coastguard Worker for (size_t i = 0; i < N; i++) {
439*9880d681SAndroid Build Coastguard Worker Fuzz.AddToCorpus(Unit{ static_cast<uint8_t>(i) });
440*9880d681SAndroid Build Coastguard Worker }
441*9880d681SAndroid Build Coastguard Worker std::vector<size_t> Hist(N);
442*9880d681SAndroid Build Coastguard Worker for (size_t i = 0; i < N * TriesPerUnit; i++) {
443*9880d681SAndroid Build Coastguard Worker Hist[Fuzz.ChooseUnitIdxToMutate()]++;
444*9880d681SAndroid Build Coastguard Worker }
445*9880d681SAndroid Build Coastguard Worker for (size_t i = 0; i < N; i++) {
446*9880d681SAndroid Build Coastguard Worker // A weak sanity check that every unit gets invoked.
447*9880d681SAndroid Build Coastguard Worker EXPECT_GT(Hist[i], TriesPerUnit / N / 3);
448*9880d681SAndroid Build Coastguard Worker }
449*9880d681SAndroid Build Coastguard Worker }
450