oss-fuzz: add fuzzer for parsing reftables

index cedc234173..18cf8c2463 100644 --- a/Makefile +++ b/Makefile @@ -2603,6 +2603,7 @@ FUZZ_OBJS += oss-fuzz/fuzz-date.o FUZZ_OBJS += oss-fuzz/fuzz-pack-headers.o FUZZ_OBJS += oss-fuzz/fuzz-pack-idx.o FUZZ_OBJS += oss-fuzz/fuzz-parse-attr-line.o +FUZZ_OBJS += oss-fuzz/fuzz-reftable.o FUZZ_OBJS += oss-fuzz/fuzz-url-decode-mem.o .PHONY: fuzz-objs fuzz-objs: $(FUZZ_OBJS)

index e7b97952e7..37b24b092d 100755 --- a/ci/run-build-and-minimal-fuzzers.sh +++ b/ci/run-build-and-minimal-fuzzers.sh @@ -21,6 +21,7 @@ date pack-headers pack-idx parse-attr-line +reftable url-decode-mem "

index f2d74de457..dc7a127a62 100644 --- a/oss-fuzz/.gitignore +++ b/oss-fuzz/.gitignore @@ -5,4 +5,5 @@ fuzz-date fuzz-pack-headers fuzz-pack-idx fuzz-parse-attr-line +fuzz-reftable fuzz-url-decode-mem

new file mode 100644 index 0000000000..c46eac2c6b --- /dev/null +++ b/oss-fuzz/fuzz-reftable.c @@ -0,0 +1,74 @@ +#include "git-compat-util.h" +#include "reftable/basics.h" +#include "reftable/blocksource.h" +#include "reftable/reftable-blocksource.h" +#include "reftable/reftable-error.h" +#include "reftable/reftable-iterator.h" +#include "reftable/reftable-record.h" +#include "reftable/reftable-table.h" +#include "reftable/reftable-writer.h" + +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size); + +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + struct reftable_block_source source = { 0 }; + struct reftable_buf buf = REFTABLE_BUF_INIT; + struct reftable_table *table = NULL; + int err; + + if (reftable_buf_add(&buf, (const char *)data, size) < 0) + goto out; + block_source_from_buf(&source, &buf); + + err = reftable_table_new(&table, &source, "fuzz-input"); + if (err < 0) + goto out; + + /* + * Exercise the ref, log and raw block iterators so that we cover as + * much of the parsing code as possible. + */ + { + struct reftable_ref_record ref = { 0 }; + struct reftable_iterator it = { 0 }; + + reftable_table_init_ref_iterator(table, &it); + if (!reftable_iterator_seek_ref(&it, "")) + while (!reftable_iterator_next_ref(&it, &ref)) + ; + + reftable_ref_record_release(&ref); + reftable_iterator_destroy(&it); + } + + { + struct reftable_log_record log = { 0 }; + struct reftable_iterator it = { 0 }; + + reftable_table_init_log_iterator(table, &it); + if (!reftable_iterator_seek_log(&it, "")) + while (!reftable_iterator_next_log(&it, &log)) + ; + + reftable_log_record_release(&log); + reftable_iterator_destroy(&it); + } + + { + struct reftable_table_iterator it = { 0 }; + const struct reftable_block *block; + + if (!reftable_table_iterator_init(&it, table)) + while (!reftable_table_iterator_next(&it, &block)) + ; + + reftable_table_iterator_release(&it); + } + +out: + if (table) + reftable_table_decref(table); + reftable_buf_release(&buf); + return 0; +}

index 10bcac2f6d..5a3854256b 100644 --- a/oss-fuzz/meson.build +++ b/oss-fuzz/meson.build @@ -6,6 +6,7 @@ fuzz_programs = [ 'fuzz-pack-headers.c', 'fuzz-pack-idx.c', 'fuzz-parse-attr-line.c', + 'fuzz-reftable.c', 'fuzz-url-decode-mem.c', ]