Commit Graph

28 Commits

Author SHA1 Message Date
Wouter van Oortmerssen
5b0d491127 Updated FlexBuffers fuzzer 2021-12-14 11:57:42 -08:00
Wouter van Oortmerssen
956d11569e re-enabled FlexBuffer JSON in fuzzer 2021-12-10 15:22:06 -08:00
Wouter van Oortmerssen
e367ca32ad Verifier for FlexBuffers (#6977)
* Verifier for FlexBuffers

* Verifier improvements & fuzzer
2021-12-10 14:59:08 -08:00
Wouter van Oortmerssen
0fadaf391d Enable verifier on nested_flatbuffers 2021-11-29 15:05:59 -08:00
Wouter van Oortmerssen
4d0e9a8706 Turn off nested FlatBuffers/FlexBuffers for the fuzzer
this is a temporary fix to allow the fuzzer to work until the real fix of adding a verifier for this is added.
2021-11-29 09:19:29 -08:00
Catena cyber
d727579b6d fuzzers: fix typo in file path (#6931) 2021-11-17 14:43:56 -08:00
Derek Bailey
6c8c291559 [C++] Split flatbuffers.h into separate files (#6868)
* split flatbuffers.h into separate files

* wrong variable in cmakelists for android

* readded two accidentally deleted includes

* created buffer.h and moved buffer related things over
2021-11-10 22:26:09 -08:00
Vladimir Glavnyy
c992eafb5b [fuzzer] Add monster_debug target (#6513)
Add the `monster_debug` target for better troubleshooting.
Improve oss-fuzz logs.
2021-03-18 10:56:28 -07:00
Vladimir Glavnyy
76e7a0ff55 [fuzzer] Limit parser_fuzzer execution time (#6431)
Limit the length of the fuzzer input to 16384 characters to prevent timeout
in JSON parser (Vector of tables with key).

Related oss-fuzz issues:
- 5742497110294528
2021-01-30 21:43:31 +07:00
Vladimir Glavnyy
7abe612b59 [fuzzer] Fix the binary schema loading in the monster_fuzzer (#6396)
This commit should fix issue 29374 in oss-fuzz.
2021-01-12 10:20:47 -08:00
Vladimir Glavnyy
85719669cb [fuzzer] Debug the monster_tets.bfbs on clusterfuzz server (#6392)
For some reason, this fuzzer failed to load the binary schema file
when run on the `/clusterfuzz` server.
Issue: https://oss-fuzz.com/testcase-detail/6215075358703616
This issue doesn't reproduce locally with the latest oss-fuzz docker image.
2021-01-08 11:09:41 -08:00
Vladimir Glavnyy
82836a62be [idl_parser] Improve stack overflow protection (#6364)
* [idl_parser] Improve stack overflow protection

Add stack overflow protection for Flexbuffer and nested Flatbuffer parsers.
Replaces the `Recurse()` method by the new ParseDepthGuard RAII class.

* Remove move operator from Parser.

It was wrong decision to add move ctor and assignment into Parser class.
These operators will make it extremely difficult to add constant or reference fields in the future.

* Remove ';' from definition of FLATBUFFERS_DELETE_FUNC

* Format code

* Make this PR compatible with MSVC2010 (it doesn't support inherited ctor)
2021-01-04 12:39:12 -08:00
Vladimir Glavnyy
92a806b4e8 [fuzzer] Rename fuzzing dictionaries for oss-fuzz (#6318)
This commit makes the names of fuzzing dictionaries the same as the target binary names.
Also it explicitly limits size of test inputs to prevent failures in `regex` and fuzzing time-outs.
2020-12-10 14:02:01 -08:00
Vladimir Glavnyy
bc7eb8adeb [fuzzer] Fix mistakes in the parser and scalar fuzzers. (#6314)
The flatbuffers::Parser::Parse() isn't an idempotent method for schema parsing.
This commit removes a wrong for-loop that tried to check the same schema twice.
2020-12-07 11:47:33 -08:00
Vladimir Glavnyy
f437f0f7ed [fuzzer] Fix loading of schema in monster_fuzzer (#6308)
This is fix for (https://oss-fuzz.com/testcase-detail/6251772204810240)
2020-12-07 11:21:23 -08:00
Vladimir Glavnyy
8d9eae9ac9 [idl_parser] Unify parsing of NaN values read from .fbs and .json files (#6296)
This commit unifies parsing of NaN values read
from .fbs and .json files by converting them to unsigned NaN.
2020-12-07 11:12:58 -08:00
Vladimir Glavnyy
c27bc2d76f [C++] Add ParseJson(), Parser(Parser&&), update fuzzers (#6284)
- add a new method ParseJson to minimize failures during fuzzing
- add default (conditional) move-constructor for Parser
- add a new monster_fuzzer
- switch fuzzers to C++17 and `test/cpp17` generated code
2020-11-23 10:17:44 -08:00
AdamKorcz
d6a8dbd26f Experimental fix for failing oss-fuzz coverage build (#6259) 2020-11-13 15:48:05 -08:00
AdamKorcz
a49531414b Update to flags in fuzzing-cmake file (#6256) 2020-11-12 10:21:34 -08:00
Vladimir Glavnyy
9b034eee12 Fix interpretation of 'nan(number)' by the idl_parser (#5810)
* Parser reject "nan(n)" string as it does with nan(n)

* Adjust scalar fuzzer to ignore '$schema' substrings

- Scalar fuzzer ignores '$schema' substrings at the input
- Added 'scalar_debug' target to simplify research of fuzzed cases

* Improve formatting of './tests/fuzzer/CMakeLists.txt'
2020-03-16 11:59:34 -07:00
Wouter van Oortmerssen
3cd9b6434a Removed code_generators.cpp from library targets
Change-Id: Ia6e032a77983bf1838b8675f51d1c910acc991d8
2020-01-02 08:50:39 -08:00
Google AutoFuzz Team
4fd8eb214b Remove a static_assert (#5643)
Having a static_assert on MSAN and ASAN prevents
the fuzzers from being used with different engines,
like TSAN, UBSAN, … but also with fuzzers that aren't
using MSAN/ASAN like afl for example.
2019-12-02 14:13:28 -08:00
Vladimir Glavnyy
5f32f94810 Make the Parser independent from the global C-locale (#5028)
* Make the Parser independent from the global C-locale

* Set a specific test locale using the environment variable FLATBUFFERS_TEST_LOCALE

* Remove redundant static qualifiers
2018-11-16 09:24:06 -08:00
Vladimir Glavnyy
55b30827f2 Add fuzzer test for scalar numbers in json. (#4996)
* Add fuzzer test for scalar numbers in json. Grammar-based regex used to check correctness.

* Fix conversation
2018-10-22 15:44:18 -07:00
Wouter van Oortmerssen
af6c0e6839 Updated fuzzer scripts
Point to new Chromium location
Also enable UBSan

Change-Id: I4ba182e3c6a967ad89090b776d05762fa9ae6e40
2018-07-16 15:51:28 -07:00
Wouter van Oortmerssen
a98bff3ea1 Add simple libfuzzer based test.
This tests the verifier and the parser.

Tested: on Linux.
Bug: 27230459
Change-Id: I3417faba9385dc941199c57a08d8a50c2faec1aa
2016-05-25 17:25:40 -07:00
Wouter van Oortmerssen
64b91da9cf Uncomment the corpus attribute since b/28762769 is fixed,
add more items to the corpus (taken from the ClusterFuzz-generated corpus).

(mirrored from cl 122690857)

Change-Id: I98c7672169a9a27fe18bedae8501e6fb85a0681d
2016-05-23 16:37:57 -07:00
Wouter van Oortmerssen
fe9787e58d Add a fuzzer for flatbuffers, derived from the one used in Chromium:
https://code.google.com/p/chromium/codesearch#chromium/src/testing/libfuzzer/fuzzers/flatbuffers_verifier_fuzzer.cc

(mirrored from cl 122676317)

Change-Id: I0074af435cf37f5e6368b040563c3733d9e02345
2016-05-23 16:35:20 -07:00