experiments
/
STT-tensorflow
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Added FuzzedDataProvider to split fuzzer data 

Switched manual data splicing to FuzzedDataProvider @mihaimaruseac
This commit is contained in:
Gabriel Rasskin 2020-06-16 16:34:38 -07:00 committed by GitHub
parent 89a1d3f4e9
commit e3a423a949
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 10 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
tensorflow/security/fuzzing/status_fuzz.cc
View File

@ -17,6 +17,8 @@ limitations under the License.
#include "tensorflow/core/platform/status.h" #include "tensorflow/core/platform/status.h"
#include <fuzzer/FuzzedDataProvider.h>
// This is a fuzzer for `tensorflow::Status`. Since `Status` is used almost // This is a fuzzer for `tensorflow::Status`. Since `Status` is used almost
// everywhere, we need to ensure that the common functionality is safe. We don't // everywhere, we need to ensure that the common functionality is safe. We don't
// expect many crashes from this fuzzer since we only create a status and then // expect many crashes from this fuzzer since we only create a status and then
@ -26,9 +28,7 @@ limitations under the License.
namespace { namespace {
tensorflow::error::Code BuildRandomErrorCode(uint8_t a, uint8_t b, uint8_t c, tensorflow::error::Code BuildRandomErrorCode(uint32_t code){
uint8_t d) {
int code = (a << 24) | (b << 16) | (c << 8) | d;
// We cannot build a `Status` with error_code of 0 and a message, so force // We cannot build a `Status` with error_code of 0 and a message, so force
// error code to be non-zero. // error code to be non-zero.
@ -39,22 +39,16 @@ tensorflow::error::Code BuildRandomErrorCode(uint8_t a, uint8_t b, uint8_t c,
return static_cast<tensorflow::error::Code>(code); return static_cast<tensorflow::error::Code>(code);
} }
std::string GetRandomErrorString(const uint8_t *data, size_t size) {
const char *p = reinterpret_cast<const char *>(data);
return std::string(p, size);
}
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
// TODO(mihaimaruseac): Use `FuzzedDataProvider` and then make these `const`
tensorflow::error::Code error_code; tensorflow::error::Code error_code;
std::string error_message; std::string error_message;
if (size < 4) {
error_code = BuildRandomErrorCode(0, 0, 0, 0); FuzzedDataProvider fuzzed_data(data, size);
error_message = GetRandomErrorString(data, size);
} else { uint32_t code = fuzzed_data.ConsumeIntegral<uint32_t>();
error_code = BuildRandomErrorCode(data[0], data[1], data[2], data[3]); error_code = BuildRandomErrorCode(code);
error_message = GetRandomErrorString(data + 4, size - 4);
} error_message = fuzzed_data.ConsumeRemainingBytesAsString();
tensorflow::Status s = tensorflow::Status(error_code, error_message); tensorflow::Status s = tensorflow::Status(error_code, error_message);
const std::string actual_message = s.ToString(); const std::string actual_message = s.ToString();