Skip to content

Commit e04a61f

Browse files
DavidKorczynskiDavidKorczynski
committed
fuzzing: add two new fuzzers to OSS-Fuzz setup
Signed-off-by: David Korczynski <[email protected]>
1 parent cb8693b commit e04a61f

File tree

3 files changed

+205
-0
lines changed

3 files changed

+205
-0
lines changed

‎fuzzing/cjson_extended_fuzzer.cpp

+164
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
#include <fuzzer/FuzzedDataProvider.h>
2+
#include <string>
3+
4+
extern "C" {
5+
#include "../cJSON.c"
6+
}
7+
8+
int intArray[10];
9+
float floatArray[10];
10+
double doubleArray[10];
11+
const char *stringArray[10];
12+
13+
extern "C" int
14+
LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
15+
{
16+
FuzzedDataProvider fdp(data, size);
17+
18+
std::string json_string = fdp.ConsumeRandomLengthString();
19+
cJSON *json = cJSON_ParseWithOpts(json_string.c_str(), NULL, fdp.ConsumeBool());
20+
21+
if (json != NULL) {
22+
23+
cJSON *new_json = cJSON_Duplicate(json, fdp.ConsumeBool());
24+
if (new_json != NULL) {
25+
cJSON_Delete(new_json);
26+
}
27+
28+
// Modifify the object
29+
int opsToPerform = fdp.ConsumeIntegralInRange(5, 20);
30+
for (int i = 0; i < opsToPerform; i++) {
31+
int op = fdp.ConsumeIntegralInRange(0, 13);
32+
switch (op) {
33+
case 0:
34+
cJSON_AddBoolToObject(json, fdp.ConsumeRandomLengthString().c_str(), fdp.ConsumeBool());
35+
break;
36+
case 1:
37+
cJSON_AddTrueToObject(json, fdp.ConsumeRandomLengthString().c_str());
38+
break;
39+
case 2:
40+
cJSON_AddNumberToObject(json, fdp.ConsumeRandomLengthString().c_str(), 1.0);
41+
break;
42+
case 3:
43+
cJSON_GetObjectItem(json, fdp.ConsumeRandomLengthString().c_str());
44+
break;
45+
case 4:
46+
cJSON_GetObjectItemCaseSensitive(json, fdp.ConsumeRandomLengthString().c_str());
47+
break;
48+
case 5:
49+
cJSON_AddNullToObject(json, fdp.ConsumeRandomLengthString().c_str());
50+
break;
51+
case 6:
52+
cJSON_AddStringToObject(json, fdp.ConsumeRandomLengthString().c_str(), fdp.ConsumeRandomLengthString().c_str());
53+
break;
54+
case 7:
55+
cJSON_AddRawToObject(json, fdp.ConsumeRandomLengthString().c_str(), fdp.ConsumeRandomLengthString().c_str());
56+
break;
57+
case 8:
58+
cJSON_AddArrayToObject(json, fdp.ConsumeRandomLengthString().c_str());
59+
break;
60+
case 9:
61+
cJSON_AddFalseToObject(json, fdp.ConsumeRandomLengthString().c_str());
62+
break;
63+
case 10:
64+
cJSON_AddObjectToObject(json, fdp.ConsumeRandomLengthString().c_str());
65+
break;
66+
case 11:
67+
cJSON_SetNumberHelper(json, fdp.ConsumeFloatingPoint<double>());
68+
break;
69+
case 12:
70+
cJSON_SetValuestring(json, fdp.ConsumeRandomLengthString().c_str());
71+
break;
72+
default:
73+
break;
74+
}
75+
}
76+
77+
// Array creation routines.
78+
for (int i = 0; i < 10; i++) {
79+
intArray[i] = fdp.ConsumeIntegral<int>();
80+
floatArray[i] = fdp.ConsumeFloatingPoint<float>();
81+
doubleArray[i] = fdp.ConsumeFloatingPoint<double>();
82+
stringArray[i] = json_string.c_str();
83+
}
84+
cJSON *cJsonIntArray = cJSON_CreateIntArray(intArray, 10);
85+
if (cJsonIntArray != NULL) {
86+
cJSON_Delete(cJsonIntArray);
87+
}
88+
cJSON *floatIntArray = cJSON_CreateFloatArray(floatArray, 10);
89+
if (floatIntArray != NULL) {
90+
cJSON_Delete(floatIntArray);
91+
}
92+
cJSON *cJsonDoubleArray = cJSON_CreateDoubleArray(doubleArray, 10);
93+
if (cJsonDoubleArray != NULL) {
94+
cJSON_Delete(cJsonDoubleArray);
95+
}
96+
cJSON *cJsonStringArray = cJSON_CreateStringArray(stringArray, 10);
97+
if (cJsonStringArray != NULL) {
98+
cJSON_Delete(cJsonStringArray);
99+
}
100+
101+
// Replace
102+
cJSON *nullObj = cJSON_CreateNull();
103+
if (nullObj != NULL) {
104+
if (cJSON_ReplaceItemInObject(json, fdp.ConsumeRandomLengthString().c_str(), nullObj) == false) {
105+
cJSON_Delete(nullObj);
106+
}
107+
}
108+
// Print the object
109+
unsigned char printed_unformatted[1024];
110+
unsigned char printed_formatted[1024];
111+
printbuffer unformatted_buffer = { 0, 0, 0, 0, 0, 0, { 0, 0, 0 } };
112+
113+
/* buffer for formatted printing */
114+
unformatted_buffer.buffer = printed_unformatted;
115+
unformatted_buffer.length = sizeof(printed_unformatted);
116+
unformatted_buffer.offset = 0;
117+
unformatted_buffer.noalloc = true;
118+
unformatted_buffer.hooks = global_hooks;
119+
print_object(json, &unformatted_buffer);
120+
121+
// Type checks
122+
opsToPerform = fdp.ConsumeIntegralInRange(5, 20);
123+
for (int i = 0; i < opsToPerform; i++) {
124+
int op = fdp.ConsumeIntegralInRange(0, 9);
125+
switch (op) {
126+
case 0:
127+
if (cJSON_IsArray(json)) {
128+
cJSON_GetArraySize(json);
129+
cJSON_GetArrayItem(json, 10);
130+
}
131+
break;
132+
case 1:
133+
cJSON_IsObject(json);
134+
break;
135+
case 2:
136+
cJSON_IsString(json);
137+
break;
138+
case 3:
139+
cJSON_IsRaw(json);
140+
break;
141+
case 4:
142+
cJSON_IsNull(json);
143+
break;
144+
case 5:
145+
cJSON_IsBool(json);
146+
break;
147+
case 6:
148+
cJSON_IsTrue(json);
149+
break;
150+
case 7:
151+
cJSON_IsFalse(json);
152+
break;
153+
case 8:
154+
cJSON_IsInvalid(json);
155+
break;
156+
default:
157+
break;
158+
}
159+
}
160+
}
161+
162+
cJSON_Delete(json);
163+
return 0;
164+
}

‎fuzzing/cjson_read_compare.cpp

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#include <stdlib.h>
2+
#include <stdint.h>
3+
#include <string.h>
4+
#include <fuzzer/FuzzedDataProvider.h>
5+
6+
extern "C" {
7+
#include "../cJSON.h"
8+
}
9+
10+
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
11+
{
12+
cJSON *a_json, *b_json;
13+
FuzzedDataProvider fdp(data, size);
14+
15+
std::string payload1 = fdp.ConsumeRandomLengthString();
16+
std::string payload2 = fdp.ConsumeRandomLengthString();
17+
18+
a_json = cJSON_ParseWithOpts(payload1.c_str(), NULL, 1);
19+
b_json = cJSON_ParseWithOpts(payload2.c_str(), NULL, 1);
20+
21+
if(a_json != NULL && b_json != NULL) {
22+
cJSON_Compare(a_json, b_json, fdp.ConsumeBool());
23+
}
24+
25+
if (a_json != NULL) {
26+
cJSON_Delete(a_json);
27+
}
28+
if (b_json != NULL) {
29+
cJSON_Delete(b_json);
30+
}
31+
32+
return 0;
33+
}

‎fuzzing/ossfuzz.sh

+8
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,14 @@ $CXX $CXXFLAGS $SRC/cjson/fuzzing/cjson_read_fuzzer.c -I. \
1212
-o $OUT/cjson_read_fuzzer \
1313
$LIB_FUZZING_ENGINE $SRC/cjson/build/libcjson.a
1414

15+
$CXX $CXXFLAGS $SRC/cjson/fuzzing/cjson_read_compare.cpp -I. \
16+
-o $OUT/cjson_read_compare \
17+
$LIB_FUZZING_ENGINE $SRC/cjson/build/libcjson.a
18+
19+
$CXX $CXXFLAGS $SRC/cjson/fuzzing/cjson_extended_fuzzer.cpp -I. \
20+
-o $OUT/cjson_extended_fuzzer \
21+
$LIB_FUZZING_ENGINE $SRC/cjson/build/libcjson.a
22+
1523
find $SRC/cjson/fuzzing/inputs -name "*" | \
1624
xargs zip $OUT/cjson_read_fuzzer_seed_corpus.zip
1725

0 commit comments

Comments
 (0)