External/fmt
8
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

update to use FMT_FUZZ

Browse Source 
Signed-off-by: Asra Ali <asraa@google.com>
This commit is contained in:
Asra Ali 2020-04-28 15:30:49 -04:00
parent 9aa1517525
commit ca0fb3040c
4 changed files with 20 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
include/fmt/format-inl.h
View File

@ -1151,10 +1151,10 @@ int snprintf_float(T value, int precision, float_specs specs,
for (;;) { for (;;) {
auto begin = buf.data() + offset; auto begin = buf.data() + offset;
auto capacity = buf.capacity() - offset; auto capacity = buf.capacity() - offset;
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION #ifdef FUZZ_MODE
if (precision > 100000) if (precision > 100000)
FMT_THROW(std::runtime_error( throw std::runtime_error(
"fuzz mode - avoid large allocation inside snprintf")); "fuzz mode - avoid large allocation inside snprintf");
#endif #endif
// Suppress the warning about a nonliteral format string. // Suppress the warning about a nonliteral format string.
// Cannot use auto becase of a bug in MinGW (#1532). // Cannot use auto becase of a bug in MinGW (#1532).

8
include/fmt/format.h
View File

@ -699,8 +699,8 @@ class basic_memory_buffer : public internal::buffer<T> {
template <typename T, std::size_t SIZE, typename Allocator> template <typename T, std::size_t SIZE, typename Allocator>
void basic_memory_buffer<T, SIZE, Allocator>::grow(std::size_t size) { void basic_memory_buffer<T, SIZE, Allocator>::grow(std::size_t size) {
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION #ifdef FUZZ_MODE
if (size > 1000) FMT_THROW(std::runtime_error("fuzz mode - won't grow that much")); if (size > 1000) throw std::runtime_error("fuzz mode - won't grow that much");
#endif #endif
std::size_t old_capacity = this->capacity(); std::size_t old_capacity = this->capacity();
std::size_t new_capacity = old_capacity + old_capacity / 2; std::size_t new_capacity = old_capacity + old_capacity / 2;
@ -1136,9 +1136,9 @@ template <typename Char> class float_writer {
*it++ = static_cast<Char>('0'); *it++ = static_cast<Char>('0');
return it; return it;
} }
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION #ifdef FUZZ_MODE
if (num_zeros > 1000) if (num_zeros > 1000)
FMT_THROW(std::runtime_error("fuzz mode - avoiding excessive cpu use")); throw std::runtime_error("fuzz mode - avoiding excessive cpu use");
#endif #endif
it = std::fill_n(it, num_zeros, static_cast<Char>('0')); it = std::fill_n(it, num_zeros, static_cast<Char>('0'));
} }

6
src/format.cc
View File

@ -13,10 +13,10 @@ namespace internal {
template <typename T> template <typename T>
int format_float(char* buf, std::size_t size, const char* format, int precision, int format_float(char* buf, std::size_t size, const char* format, int precision,
T value) { T value) {
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION #ifdef FUZZ_MODE
if (precision > 100000) if (precision > 100000)
FMT_THROW(std::runtime_error( throw std::runtime_error(
"fuzz mode - avoid large allocation inside snprintf")); "fuzz mode - avoid large allocation inside snprintf");
#endif #endif
// Suppress the warning about nonliteral format string. // Suppress the warning about nonliteral format string.
int (*snprintf_ptr)(char*, size_t, const char*, ...) = FMT_SNPRINTF; int (*snprintf_ptr)(char*, size_t, const char*, ...) = FMT_SNPRINTF;

15
test/fuzzing/README.md
View File

@ -7,14 +7,19 @@ in fmt. It is a part of the continous fuzzing at
The source code is modified to make the fuzzing possible without locking up on The source code is modified to make the fuzzing possible without locking up on
resource exhaustion: resource exhaustion:
```cpp ```cpp
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION #ifdef FUZZ_MODE
if(spec.precision>100000) { if(spec.precision>100000) {
FMT_THROW(std::runtime_error("fuzz mode - avoiding large precision")); throw std::runtime_error("fuzz mode - avoiding large precision");
} }
#endif #endif
``` ```
This macro is the defacto standard for making fuzzing practically possible, see This macro `FUZZ_MODE` is enabled on OSS-Fuzz builds and makes fuzzing
[the libFuzzer documentation](https://llvm.org/docs/LibFuzzer.html#fuzzer-friendly-build-mode). practically possible. It is used in fmt code to prevent resource exhaustion in
fuzzing mode.
The macro `FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION` is the
defacto standard for making fuzzing practically possible to disable certain
fuzzing-unfriendly features (for example, randomness), see [the libFuzzer
documentation](https://llvm.org/docs/LibFuzzer.html#fuzzer-friendly-build-mode).
## Running the fuzzers locally ## Running the fuzzers locally