mirror of
https://github.com/mruby/mruby
synced 2026-06-08 16:11:16 +00:00
David Korczynski
923c2e6a73
Adds 6 new fuzzing harnesses to be consumed by OSS-Fuzz. Have confirmed locally this results in significant coverage gains relative to the current code coverage in OSS-Fuzz: https://storage.googleapis.com/oss-fuzz-coverage/mruby/reports/20260427/linux/src/report.html Signed-off-by: David Korczynski <david@adalogics.com>
40 lines
1.1 KiB
C
40 lines
1.1 KiB
C
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <mruby.h>
|
|
#include <mruby/string.h>
|
|
#include <mruby/array.h>
|
|
#include <mruby/variable.h>
|
|
|
|
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t size) {
|
|
if (size < 1) {
|
|
return 0;
|
|
}
|
|
mrb_state *mrb = mrb_open();
|
|
if (!mrb) {
|
|
return 0;
|
|
}
|
|
|
|
/* Use the first byte as a format string length */
|
|
uint8_t fmt_len = Data[0];
|
|
if (fmt_len > size - 1) {
|
|
fmt_len = size - 1;
|
|
}
|
|
|
|
mrb_value fmt = mrb_str_new(mrb, (const char *)(Data + 1), fmt_len);
|
|
|
|
/* provide some arguments of different types to satisfy various format specifiers */
|
|
mrb_value args[5];
|
|
args[0] = mrb_fixnum_value(123);
|
|
args[1] = mrb_float_value(mrb, 3.14);
|
|
args[2] = mrb_str_new_cstr(mrb, "fuzz");
|
|
args[3] = mrb_symbol_value(mrb_intern_cstr(mrb, "symbol"));
|
|
args[4] = mrb_ary_new(mrb);
|
|
|
|
/* Call sprintf via mrb_funcall */
|
|
/* We don't use all args every time, but it doesn't hurt to pass them */
|
|
mrb_funcall(mrb, mrb_obj_value(mrb->kernel_module), "sprintf", 6, fmt, args[0], args[1], args[2], args[3], args[4]);
|
|
|
|
mrb_close(mrb);
|
|
return 0;
|
|
}
|