From e3a423a9493af054d87f7ce45feb228a3ccfe6e6 Mon Sep 17 00:00:00 2001 From: Gabriel Rasskin Date: Tue, 16 Jun 2020 16:34:38 -0700 Subject: [PATCH] Added FuzzedDataProvider to split fuzzer data Switched manual data splicing to FuzzedDataProvider @mihaimaruseac --- tensorflow/security/fuzzing/status_fuzz.cc | 26 +++++++++------------- 1 file changed, 10 insertions(+), 16 deletions(-) diff --git a/tensorflow/security/fuzzing/status_fuzz.cc b/tensorflow/security/fuzzing/status_fuzz.cc index 7b161645148..8b5949009b1 100644 --- a/tensorflow/security/fuzzing/status_fuzz.cc +++ b/tensorflow/security/fuzzing/status_fuzz.cc @@ -17,6 +17,8 @@ limitations under the License. #include "tensorflow/core/platform/status.h" +#include + // This is a fuzzer for `tensorflow::Status`. Since `Status` is used almost // everywhere, we need to ensure that the common functionality is safe. We don't // expect many crashes from this fuzzer since we only create a status and then @@ -26,9 +28,7 @@ limitations under the License. namespace { -tensorflow::error::Code BuildRandomErrorCode(uint8_t a, uint8_t b, uint8_t c, - uint8_t d) { - int code = (a << 24) | (b << 16) | (c << 8) | d; +tensorflow::error::Code BuildRandomErrorCode(uint32_t code){ // We cannot build a `Status` with error_code of 0 and a message, so force // error code to be non-zero. @@ -39,22 +39,16 @@ tensorflow::error::Code BuildRandomErrorCode(uint8_t a, uint8_t b, uint8_t c, return static_cast(code); } -std::string GetRandomErrorString(const uint8_t *data, size_t size) { - const char *p = reinterpret_cast(data); - return std::string(p, size); -} - extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { - // TODO(mihaimaruseac): Use `FuzzedDataProvider` and then make these `const` tensorflow::error::Code error_code; std::string error_message; - if (size < 4) { - error_code = BuildRandomErrorCode(0, 0, 0, 0); - error_message = GetRandomErrorString(data, size); - } else { - error_code = BuildRandomErrorCode(data[0], data[1], data[2], data[3]); - error_message = GetRandomErrorString(data + 4, size - 4); - } + + FuzzedDataProvider fuzzed_data(data, size); + + uint32_t code = fuzzed_data.ConsumeIntegral(); + error_code = BuildRandomErrorCode(code); + + error_message = fuzzed_data.ConsumeRemainingBytesAsString(); tensorflow::Status s = tensorflow::Status(error_code, error_message); const std::string actual_message = s.ToString();