mirror of https://github.com/google/oss-fuzz.git
48 lines
1.7 KiB
C++
48 lines
1.7 KiB
C++
// From https://svn.boost.org/trac10/ticket/12818
|
|
// This fuzz target can likely be enhanced to exercise more code.
|
|
// The ideal place for this fuzz target is the boost repository.
|
|
#ifdef DEBUG
|
|
#include <iostream>
|
|
#endif
|
|
|
|
#include <boost/regex.hpp>
|
|
#include <fuzzer/FuzzedDataProvider.h>
|
|
|
|
namespace {
|
|
void assertPostConditions(boost::match_results<std::string::const_iterator> const& match, boost::regex const& e)
|
|
{
|
|
// See https://www.boost.org/doc/libs/1_71_0/libs/regex/doc/html/boost_regex/ref/regex_match.html
|
|
assert(match.size() == e.mark_count() + 1);
|
|
assert(!match.empty());
|
|
assert(!match.prefix().matched);
|
|
assert(!match.suffix().matched);
|
|
}
|
|
}
|
|
|
|
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
|
|
FuzzedDataProvider fuzzed_data(Data, Size);
|
|
// First value is length of the regex string
|
|
size_t regex_length = fuzzed_data.ConsumeIntegral<uint8_t>();
|
|
// Second value is regexp string whose length is `regex_length`
|
|
std::string regex_string = fuzzed_data.ConsumeBytesAsString(regex_length);
|
|
boost::regex e(regex_string);
|
|
// Last value is the text to be matched
|
|
std::string text = fuzzed_data.ConsumeRemainingBytesAsString();
|
|
|
|
#ifdef DEBUG
|
|
std::cout << "Regexp string: " << regex_string << "Size: " << regex_string.size() << std::endl;
|
|
std::cout << "Text: " << text << "Size: " << text.size() << std::endl;
|
|
#endif
|
|
|
|
try {
|
|
boost::match_results<std::string::const_iterator> what;
|
|
bool match = boost::regex_match(text, what, e,
|
|
boost::match_default | boost::match_partial);
|
|
if (match)
|
|
assertPostConditions(what, e);
|
|
}
|
|
catch (const std::runtime_error &) {
|
|
}
|
|
return 0;
|
|
}
|