Commit Graph

19 Commits

Author SHA1 Message Date
Vladimir Glavnyy 7abe612b59
[fuzzer] Fix the binary schema loading in the monster_fuzzer (#6396)
This commit should fix issue 29374 in oss-fuzz.
2021-01-12 10:20:47 -08:00
Vladimir Glavnyy 85719669cb
[fuzzer] Debug the monster_tets.bfbs on clusterfuzz server (#6392)
For some reason, this fuzzer failed to load the binary schema file
when run on the `/clusterfuzz` server.
Issue: https://oss-fuzz.com/testcase-detail/6215075358703616
This issue doesn't reproduce locally with the latest oss-fuzz docker image.
2021-01-08 11:09:41 -08:00
Vladimir Glavnyy 82836a62be
[idl_parser] Improve stack overflow protection (#6364)
* [idl_parser] Improve stack overflow protection

Add stack overflow protection for Flexbuffer and nested Flatbuffer parsers.
Replaces the `Recurse()` method by the new ParseDepthGuard RAII class.

* Remove move operator from Parser.

It was wrong decision to add move ctor and assignment into Parser class.
These operators will make it extremely difficult to add constant or reference fields in the future.

* Remove ';' from definition of FLATBUFFERS_DELETE_FUNC

* Format code

* Make this PR compatible with MSVC2010 (it doesn't support inherited ctor)
2021-01-04 12:39:12 -08:00
Vladimir Glavnyy 92a806b4e8
[fuzzer] Rename fuzzing dictionaries for `oss-fuzz` (#6318)
This commit makes the names of fuzzing dictionaries the same as the target binary names.
Also it explicitly limits size of test inputs to prevent failures in `regex` and fuzzing time-outs.
2020-12-10 14:02:01 -08:00
Vladimir Glavnyy bc7eb8adeb
[fuzzer] Fix mistakes in the `parser` and `scalar` fuzzers. (#6314)
The flatbuffers::Parser::Parse() isn't an idempotent method for schema parsing.
This commit removes a wrong for-loop that tried to check the same schema twice.
2020-12-07 11:47:33 -08:00
Vladimir Glavnyy f437f0f7ed
[fuzzer] Fix loading of schema in monster_fuzzer (#6308)
This is fix for (https://oss-fuzz.com/testcase-detail/6251772204810240)
2020-12-07 11:21:23 -08:00
Vladimir Glavnyy 8d9eae9ac9
[idl_parser] Unify parsing of NaN values read from .fbs and .json files (#6296)
This commit unifies parsing of NaN values read
from .fbs and .json files by converting them to unsigned NaN.
2020-12-07 11:12:58 -08:00
Vladimir Glavnyy c27bc2d76f
[C++] Add ParseJson(), Parser(Parser&&), update fuzzers (#6284)
- add a new method ParseJson to minimize failures during fuzzing
- add default (conditional) move-constructor for Parser
- add a new monster_fuzzer
- switch fuzzers to C++17 and `test/cpp17` generated code
2020-11-23 10:17:44 -08:00
AdamKorcz d6a8dbd26f
Experimental fix for failing oss-fuzz coverage build (#6259) 2020-11-13 15:48:05 -08:00
AdamKorcz a49531414b
Update to flags in fuzzing-cmake file (#6256) 2020-11-12 10:21:34 -08:00
Vladimir Glavnyy 9b034eee12
Fix interpretation of 'nan(number)' by the idl_parser (#5810)
* Parser reject "nan(n)" string as it does with nan(n)

* Adjust scalar fuzzer to ignore '$schema' substrings

- Scalar fuzzer ignores '$schema' substrings at the input
- Added 'scalar_debug' target to simplify research of fuzzed cases

* Improve formatting of './tests/fuzzer/CMakeLists.txt'
2020-03-16 11:59:34 -07:00
Wouter van Oortmerssen 3cd9b6434a Removed code_generators.cpp from library targets
Change-Id: Ia6e032a77983bf1838b8675f51d1c910acc991d8
2020-01-02 08:50:39 -08:00
Google AutoFuzz Team 4fd8eb214b Remove a static_assert (#5643)
Having a static_assert on MSAN and ASAN prevents
the fuzzers from being used with different engines,
like TSAN, UBSAN, … but also with fuzzers that aren't
using MSAN/ASAN like afl for example.
2019-12-02 14:13:28 -08:00
Vladimir Glavnyy 5f32f94810 Make the Parser independent from the global C-locale (#5028)
* Make the Parser independent from the global C-locale

* Set a specific test locale using the environment variable FLATBUFFERS_TEST_LOCALE

* Remove redundant static qualifiers
2018-11-16 09:24:06 -08:00
Vladimir Glavnyy 55b30827f2 Add fuzzer test for scalar numbers in json. (#4996)
* Add fuzzer test for scalar numbers in json. Grammar-based regex used to check correctness.

* Fix conversation
2018-10-22 15:44:18 -07:00
Wouter van Oortmerssen af6c0e6839 Updated fuzzer scripts
Point to new Chromium location
Also enable UBSan

Change-Id: I4ba182e3c6a967ad89090b776d05762fa9ae6e40
2018-07-16 15:51:28 -07:00
Wouter van Oortmerssen a98bff3ea1 Add simple libfuzzer based test.
This tests the verifier and the parser.

Tested: on Linux.
Bug: 27230459
Change-Id: I3417faba9385dc941199c57a08d8a50c2faec1aa
2016-05-25 17:25:40 -07:00
Wouter van Oortmerssen 64b91da9cf Uncomment the corpus attribute since b/28762769 is fixed,
add more items to the corpus (taken from the ClusterFuzz-generated corpus).

(mirrored from cl 122690857)

Change-Id: I98c7672169a9a27fe18bedae8501e6fb85a0681d
2016-05-23 16:37:57 -07:00
Wouter van Oortmerssen fe9787e58d Add a fuzzer for flatbuffers, derived from the one used in Chromium:
https://code.google.com/p/chromium/codesearch#chromium/src/testing/libfuzzer/fuzzers/flatbuffers_verifier_fuzzer.cc

(mirrored from cl 122676317)

Change-Id: I0074af435cf37f5e6368b040563c3733d9e02345
2016-05-23 16:35:20 -07:00