contrib/fuzz/mpatch.cc
author Manuel Jacob <me@manueljacob.de>
Mon, 11 Jul 2022 01:51:20 +0200
branchstable
changeset 49378 094a5fa3cf52
parent 43816 d37658efbec2
permissions -rw-r--r--
procutil: make stream detection in make_line_buffered more correct and strict In make_line_buffered(), we don’t want to wrap the stream if we know that lines get flushed to the underlying raw stream already. Previously, the heuristic was too optimistic. It assumed that any stream which is not an instance of io.BufferedIOBase doesn’t need wrapping. However, there are buffered streams that aren’t instances of io.BufferedIOBase, like Mercurial’s own winstdout. The new logic is different in two ways: First, only for the check, if unwraps any combination of WriteAllWrapper and winstdout. Second, it skips wrapping the stream only if it is an instance of io.RawIOBase (or already wrapped). If it is an instance of io.BufferedIOBase, it gets wrapped. In any other case, the function raises an exception. This ensures that, if an unknown stream is passed or we add another wrapper in the future, we don’t wrap the stream if it’s already line buffered or not wrap the stream if it’s not line buffered. In fact, this was already helpful during development of this change. Without it, I possibly would have forgot that WriteAllWrapper needs to be ignored for the check, leading to unnecessary wrapping if stdout is unbuffered. The alternative would have been to always wrap unknown streams. However, I don’t think that anyone would benefit from being less strict. We can expect streams from the standard library to be subclassing either io.RawIOBase or io.BufferedIOBase, so running Mercurial in the standard way should not regress by this change. Py2exe might replace sys.stdout and sys.stderr, but that currently breaks Mercurial anyway and also these streams don’t claim to be interactive, so this function is not called for them.

/*
 * mpatch.cc - fuzzer harness for mpatch.c
 *
 * Copyright 2018, Google Inc.
 *
 * This software may be used and distributed according to the terms of
 * the GNU General Public License, incorporated herein by reference.
 */
#include <iostream>
#include <memory>
#include <stdint.h>
#include <stdlib.h>
#include <vector>

#include "fuzzutil.h"

extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv)
{
	return 0;
}

// To avoid having too many OOMs from the fuzzer infrastructure, we'll
// skip patch application if the resulting fulltext would be bigger
// than 10MiB.
#define MAX_OUTPUT_SIZE 10485760

extern "C" {
#include "bitmanipulation.h"
#include "mpatch.h"

struct mpatchbin {
	std::unique_ptr<char[]> data;
	size_t len;
};

static mpatch_flist *getitem(void *vbins, ssize_t pos)
{
	std::vector<mpatchbin> *bins = (std::vector<mpatchbin> *)vbins;
	const mpatchbin &bin = bins->at(pos + 1);
	struct mpatch_flist *res;
	LOG(2) << "mpatch_decode " << bin.len << std::endl;
	if (mpatch_decode(bin.data.get(), bin.len, &res) < 0)
		return NULL;
	return res;
}

// input format:
// u8 number of inputs
// one u16 for each input, its length
// the inputs
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
{
	if (!Size) {
		return 0;
	}
	// First byte of data is how many texts we expect, first text
	// being the base the rest being the deltas.
	ssize_t numtexts = Data[0];
	if (numtexts < 2) {
		// No point if we don't have at least a base text and a delta...
		return 0;
	}
	// Each text will be described by a byte for how long it
	// should be, so give up if we don't have enough.
	if ((Size - 1) < (numtexts * 2)) {
		return 0;
	}
	size_t consumed = 1 + (numtexts * 2);
	LOG(2) << "input contains " << Size << std::endl;
	LOG(2) << numtexts << " texts, consuming " << consumed << std::endl;
	std::vector<mpatchbin> bins;
	bins.reserve(numtexts);
	for (int i = 0; i < numtexts; ++i) {
		mpatchbin bin;
		size_t nthsize = getbeuint16((char *)Data + 1 + (2 * i));
		LOG(2) << "text " << i << " is " << nthsize << std::endl;
		char *start = (char *)Data + consumed;
		consumed += nthsize;
		if (consumed > Size) {
			LOG(2) << "ran out of data, consumed " << consumed
			       << " of " << Size << std::endl;
			return 0;
		}
		bin.len = nthsize;
		bin.data.reset(new char[nthsize]);
		memcpy(bin.data.get(), start, nthsize);
		bins.push_back(std::move(bin));
	}
	LOG(2) << "mpatch_flist" << std::endl;
	struct mpatch_flist *patch =
	    mpatch_fold(&bins, getitem, 0, numtexts - 1);
	if (!patch) {
		return 0;
	}
	LOG(2) << "mpatch_calcsize" << std::endl;
	ssize_t outlen = mpatch_calcsize(bins[0].len, patch);
	LOG(2) << "outlen " << outlen << std::endl;
	if (outlen < 0 || outlen > MAX_OUTPUT_SIZE) {
		goto cleanup;
	}
	{
		char *dest = (char *)malloc(outlen);
		LOG(2) << "expecting " << outlen << " total bytes at "
		       << (void *)dest << std::endl;
		mpatch_apply(dest, bins[0].data.get(), bins[0].len, patch);
		free(dest);
		LOG(1) << "applied a complete patch" << std::endl;
	}
cleanup:
	mpatch_lfree(patch);
	return 0;
}

} // extern "C"