From 8452c9f80ee02cb71fb72f638d3bdef754f15297 Mon Sep 17 00:00:00 2001
From: Gabriel Rasskin <grasskin@google.com>
Date: Thu, 18 Jun 2020 13:58:25 -0700
Subject: [PATCH] Added status_group fuzzer

---
 .../security/fuzzing/status_group_fuzz.cc     | 83 +++++++++++++++++++
 1 file changed, 83 insertions(+)
 create mode 100644 tensorflow/security/fuzzing/status_group_fuzz.cc

diff --git a/tensorflow/security/fuzzing/status_group_fuzz.cc b/tensorflow/security/fuzzing/status_group_fuzz.cc
new file mode 100644
index 00000000000..979fd444b48
--- /dev/null
+++ b/tensorflow/security/fuzzing/status_group_fuzz.cc
@@ -0,0 +1,83 @@
+/* Copyright 2020 The TensorFlow Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+==============================================================================*/
+#include <cstdint>
+#include <cstdlib>
+
+#include "tensorflow/core/platform/status.h"
+
+#include <fuzzer/FuzzedDataProvider.h>
+
+// This is a fuzzer for `tensorflow::StatusGroup`. Since `Status` is used almost
+// everywhere, we need to ensure that the common functionality is safe. We don't
+// expect many crashes from this fuzzer
+
+namespace {
+
+tensorflow::error::Code BuildRandomErrorCode(uint32_t code){
+
+  // We cannot build a `Status` with error_code of 0 and a message, so force
+  // error code to be non-zero.
+  if (code == 0) {
+    return tensorflow::error::UNKNOWN;
+  }
+
+  return static_cast<tensorflow::error::Code>(code);
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  tensorflow::error::Code error_code;
+
+  std::string error_message = "ERROR";
+
+  tensorflow::Status s, derived_s;
+
+  tensorflow::StatusGroup sg;
+
+  bool is_derived;
+
+  uint32_t code;
+
+  FuzzedDataProvider fuzzed_data(data, size);
+
+  while(fuzzed_data.remaining_bytes() > 0) {
+    code = fuzzed_data.ConsumeIntegral<uint32_t>();
+
+    error_code = BuildRandomErrorCode(code);
+
+    is_derived = fuzzed_data.ConsumeBool();
+
+    s = tensorflow::Status(error_code, error_message);
+
+    if(is_derived) {
+      derived_s = tensorflow::StatusGroup::MakeDerived(s);
+
+      sg.Update(derived_s);
+
+    } else {
+      sg.Update(s);
+
+    }
+  }
+
+  sg.as_summary_status();
+
+  sg.as_concatenated_status();
+
+  sg.AttachLogMessages();
+
+  return 0;
+}
+
+}  // namespace