From 888922aff35513d1032cdbe14046f7b43352b591 Mon Sep 17 00:00:00 2001 From: mhoffm Date: Sun, 27 Jun 2021 19:57:02 +0200 Subject: [PATCH] start fuzzing --- CHANGELOG.md | 3 +++ README.md | 8 +++++++- ...0d2958a668c04944f12da010e4cd4239cb587114.hcl | Bin 0 -> 6666 bytes ...bbabb6816b26bfecdaa9aef4b049f7259aac9954.hcl | Bin 0 -> 29211 bytes src/scanner.cc | 11 ++++++++--- 5 files changed, 18 insertions(+), 4 deletions(-) create mode 100644 fuzz/crashers/crash-0d2958a668c04944f12da010e4cd4239cb587114.hcl create mode 100644 fuzz/crashers/crash-bbabb6816b26bfecdaa9aef4b049f7259aac9954.hcl diff --git a/CHANGELOG.md b/CHANGELOG.md index 27ff51c..b5eb3d5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,9 @@ fix: * allow empty template interpolations * allow empty templates +quality: +* add fuzzing + ## 0.2.0 - 2021-06-26 feature: diff --git a/README.md b/README.md index 7fa448e..18583c1 100644 --- a/README.md +++ b/README.md @@ -26,8 +26,9 @@ tree-sitter parse --quiet --stat example/real_world_stuff/*/* Total parses: 1892; successful parses: 1892; failed parses: 0; success percentage: 100.00% ``` -The aim is to build unit testcases from selected failure classes and slowly get to 100%. +## Fuzzing +The directory `fuzz/crashers` contains a set of crashes that were found with fuzzing. To fuzz the parser i used the instrumentation of [tree-sitter](https://github.com/tree-sitter/tree-sitter/tree/master/test/fuzz) ## Todo @@ -37,3 +38,8 @@ The aim is to build unit testcases from selected failure classes and slowly get * [x] add quoted template interpolations * [ ] add quoted template directives * [x] add heredoc templates +* [ ] fuzzing + * [x] start with fuzzing the parser + * [ ] upload fuzzing instrumentation + * [ ] document fuzzing process + * [ ] add parsing of crashers to CI process diff --git a/fuzz/crashers/crash-0d2958a668c04944f12da010e4cd4239cb587114.hcl b/fuzz/crashers/crash-0d2958a668c04944f12da010e4cd4239cb587114.hcl new file mode 100644 index 0000000000000000000000000000000000000000..a087945a3aeb489f5db8d56a747ec1718a040938 GIT binary patch literal 6666 zcmdPba?UTPEXqvJC{Z}HQo+c;&_YMSzbG*|CsiRaFGWAUNFlSNSRpYjEi)%Gu_U!v zPr)%KM**y%SfMDjIJKxOHARn$Du;@TLmQpJuuWa0Li8##TVok zm4M~IRv4NZ8G= zrWF^1g^R&<*eXOT85x*ZDCsCD85x)wfM`QQL#0@*S}rbS1*gQ~5>Q|SrzV#cWtLPb z_+%EBa22H%=a&{Grz$ArCuhbd=NF~M7ef`q=VTU_C@CmGH3p|9gLEi?gD*Khw;-{o zBsVp$BtA1m!B(Lxu}BYDFh4mng-bypC9}97C$TaS}ek6cl1XF38Ly$_XI5 z@(Vzwf}96)n1X^*Zf2emC<(zF1xpN2i$G3N%1x}mucj8{5|C23Pm!DsvKl51Hx(Mo zDB*$KkF{K&)Z&s@l9-fOoT?C9SzMBut3Yz9adDzjf50~91(dTv zSu{B_r3h*48Yd#x98k9}Ss^$zu_!r%>{8q{m`a5>!k`hHm>}KJ0qOaH(lPZ)*3@Eh3RXh8 zXq+ViQu7OPQj7D`N)$r!^K*(xZ}A6!^-(EDpc*#fa|LV^411Xh$vGHm;3;N8A9P5M zwDAzCJaOEh#81QBcarFD{8MD9S8LEJ=;eEKpLY=2B27OUx-vRj^e^tST)^ zEy|70$;>OQh%d`5Dk)9OiO)?;&dAJ5)ho-@LuiaoOi3w9EiOhjJ1@1QJijPAJ~IW? z*xdY-(wtO1s5Fd@&rHFlxhORyvpBxEG$}8&gjkc%^k6d<=5o>u#?Xb$=(M8zypq(s z6k;8%udm>oUr@Jd5L++mGSw>nJEe&V5?A;Sfqz6%%z}E zTAW&xoS37KmYI{PkXn(PQ<{>RqEMEZsF0pnl9`^DUzEyKlvVm|Q3_VCnuGNRSA+=JkAOmE1YOWI4&YaZv0%%0! z=PB4KC>fX;7=Wab!AS(_6tII!a*E;kFdJkL*jvTL8SqR7c2#OFBo2}ii%T-|^Ay1O z8J3x$g7F|hh||$?azSZQPG)j^W`SN=Zah@E9!NRFRMeQo86k;9sE$f3$>35@C`wHS zxd;|Ypl|}kG(;F=zP`Q!Jb9$$7b#@q=cdARf%u+|z6$V2E+_)|Z4Ag_RpiF?4c@VAymkgj>n+H`6qHGnw*}L_~NgDB3D0>8GTY>F1T^!qKW@`(M38EscAeHDS(?OK2cnTik z;tXUh=`jY@MNE8w6oNt%Ug|28sVuk!Ph1|sA zlGGxFy!;eUKS4o3Utb|4BUJ%hDrOcdB<2+7gZm0OiNz%f1&Ku^AWex1Mfo|Y>ct9< zL4JB%U`-IxwIVUMAScxd!c)*v2+Ge%1*rnHQxc2vtP;zMtuhmHt*i`tN6^s+<1`L@nG-R zDkv#&LCgesF)TMlr!+TJp`@}PRUxxjAuqo~Av50)6j0b439=*}q9r~vzn~aY z#T!D}{m{rL&a49442ndELWRsch4jqy#H7lS)MC<{OUMae%WM^tjKMt*s0+Ye$xl;& z+73xk1&PVosYT#!TTyCZX=YJsN_;_1X?kW}F<4MRAtfKI!WPO^Pylr|L9KpU1tmLM zP}5Y;98`^inoZE&nyrFTdS*#RX%e_^nUPqWk(r!dRG<$r3Zl3c+|DXXOfO2zD^b8@ zx}lzd9@q~=m<}}yVSFv9;Dx%vCsg4E_Kl;;=aq$q(*gP5nF zkeQd0nFkuKf!MF0pp=@Nk+0yGl9HL14sN=F$_*Dt%sJ=hl_X~7r4~VrfT@lFSpiDh zDsKM%F-i({3Q&jZl~j~~LI7f0EhxJcd7#@t=g9PQLfR2}?7K2Lk6osTpuq9yu&LDHZnKTnTQd63f0xoaz%TkMS5(~gCQb^3JRLC#M z02T9)v6^BXh2qlW4AAIKB5W8#0n~a_l(q^=h6bRlr)QvVXa*~AHS!BU9rVN;O@)w*%wmP){JgZx^wOf# zVo(wV6(fmdiJ3WxNtrpBC6x+Q`FW|upusGVH#3Vs0auh-T#%m!PNa}gI0a`IxLTv)XFcjZ{ zhA2U;htlGb{9Ndm9Vo%Us}@gKEekG4Athxh%#)yMR-;%GDM=)h80qDvrev1pCV+f^ z&92mBqj+!u4C>{y*^u z08)}y9G{bzl$ryoyM0I zEl31)k8>&&(u(qP!J&v$dSc`~Naj({Qb>qa%FIg#4fpGU2DK`bV)0}wkmd0R%c<06 zgXCH&wAmmA#nZUW2C)U{GBg$%%QO;7`jh%}Y_pNG(dWf=@=J(y zOU?()Ksh@qfW~7$F_&19ssm}OmEVGEYW$P#;DxjJUZy2NI2$)qE4drCWASl#hkkp3KDoX`LV@YZrxD5eH%4j~zPOU`o z5xDz;)|*gD&dAOG$IJi*pc*YDDIPo$51Rj~)h|xYNK8-7E72`UO)N^uFVE8}&VcqT zphLsNt1rq`&`nc-3@GE!1!}{C8uz-z8Hq(HAiKbB2IVJk&qP@vCAGMuD8Di@FCD$F zRg{{WUy`buT9KLzX&WghlxL)ZXBuo3l%V=RWgkY5N(s$npk@K25?9L2%u@nIfJ!xZ zU{5ctxH!Hbzo?`*+9(!0$^}!GSV34F*b5*H1x5KK`N{b?$R>lDY%p=S$&fA;c>WL? z+@J;rs38GWQVZ!Q!dzUMQV~r=Sp9oB>I|v7q+6LTxPjuN9GFd71* zAut*OqaiRF0;3@?8UmvsFd71bGz1{yD8-PT8>CyAms$>+0f$VL#3xo2M}yaI=w;@m zq*la2RD*hc5Cs|-8bNaLMTvRosX7YAItoadH9?v|%T2fx6p$xv;z5%($bC@4&Zq?s zv6LjHgZh_BD%H8EMd_&;xrqfD;EuWyXsS&~2exbsI@k;zA+ObiOvCHKy3$CN4bq4j z6wWG3EXqtw%1KpFg080rPu&$mhB#oOy19u3;D|{{O-n4z0nKAW`u<_ge!8GZH_)I1 z1fx&(fkXqqi-v>2OYj|C3?ah};AuAyp>JdY>2#thGeTBo2%3Pys>~Q!nGuq*yu=b@ z8U5m^~{N)T!(l4&3tk(HSunFd<0hiWSstnmu z6J$%XEsC9;eSMq|*23Ioifk#mG9yqK1WIaprpT6}D>FtYLs$x4_JNs4AcbUnN*<9J z1vx4~82~hYrvws&7zAEPpr8N}fcXs+R%oigGb^a7KtYA3${3QHP~#C~r>%lgwnZ^S zJTV1oC4`G?DXKE4ov6w{wxTM7T8bKv2umU2a7!UvOiLl+i78M^AzYX;gryMi#1yEd z=<#R>ipOk=;^gGqoFurN=&Hbp0-*|OCAunbnn0)m+Xzk)T!=J*yvSY&v|0s84m34T zl%Eq{kdv5~3SAr!pO_4qmx7eAh!Rx^vS>c-|JmQZ3QWI+H@+=D0U;|q#X z(=sa{kqxd+A(2#EQk0pOjv7r$XmOv6v~&Qp{Ry175U~gvst3*ggO)OarMQ$8f}zVh z6hMifm3?SlA1HsK~Lgs-LLA0S5X9NmTh&a?Z(1r*?rh(Kz zG@%%V={DHL2|@IE0J6i>i@1eCA zWQ8Dj4;ggXDbl*qIy(geJwp?4<^r{IVZ{fyJsJ<%!wAb5kX(u=HP+t`BGju&%kDsjiWMp@p8Ifu5n6E_$e< zSWujiSdfZgT$rz3a7kibN@7upp`H#98AggSVA~h{Br#Ka_RwGNLis6N{xOsVSM@Rig1AmqQwYkYWp)V?jk2xc;zJP{P$6gA~AMg*7w~(N^;1 zCuOB3m&6yBuxgBFc~h(&_W2Oi69+VO$4ptCDJI6QmkeaBo-H!=NDn$@s8;vm~yOU;n+8iX$tDj zd6+yn!in?`ER>Z&E1)6C0-hq^#SCn%DQFuNxYmY+IA~o+S#CU{2mz7a zmI^AZq77o_I{4BOZVKHUI47(uQDukcER?SKY37gRJT*em2h&L)5wpr@q=WyM2{Qm|5h zw8mj697P_fIfsuFfI*29qyXf-R5O!!=wc?U zNdcr5Y?>Y(oye&Zq%1i<546@P9+rBEFd1D7$Vg>{Akg6sFn_@P06D$^6yTs_iE22w zDW!+9(it=Mzy^TQ7?=T$I*>^URtliD6Ub^<>_HS17w3Ri?NDwN%p{yvfr5;3Ye1$T zS)r`plb@KP09#}W3s6v&0AYB*qAbOYPXg`s$xFdi!lNkGL*XH5MGj0jtAf3Pk}L8`L#TW%Xn84Uvj}W^K?-QWvz3BMH8iK9Sc>M%%z|1a z1uIyd#;+3O5oLuiUvS{TLkwQ_f%6F{5urvN$Wvvx@gP~QTCPDcAUx^_vO)mSP6j1X zNaF_**RWO_tjmwm4hJa))nJIEL6q{uob>#n%#w^;609grO)g4>Zo$W539Lv1_puY> zK^s$`V@t4V8gyz&etBvU$jy-K1>UEtr=&!fWrgrmg^a|qRM5KS6wpr5%wovt z1DXnI3dIFEnI#&U3hE_AnaSDe3Q4KSiKWG$^~I?Q;8ns!l?wR-}%}W8T zxlc_@&H!)VMQT(isZ~q;vJJ8% z-wJfrBdB=^-x3HuC=4__l9~dZR0bccq@++&13r2Qt_<8P1`WVL$I+1{6Tv1xjv9kB zK2i66+t|4JyK#A@f!qP=2Y|-LbQD0EbRn9MH@6ilBo?K@H^imrA?XA6>~)~qBr{SK zK*JWPDWGj{iFqjskfXT3MnTL-N(Bx4l@^1}gaA1JrK44rn3I{3SyBl)P%$$fI=+g{ z*evsl4cp)xhGs928+@+sU@Hd=1|AmDj1m=Sr~u@G~gXxLX>Vg+c zfb@Y5354G006i29w*LsS8VPZ%Ht6_Pn8V`14kPHZQ3azRFd71*Aut*O0~G@LT8Ps> z53N)Ht@brixp^Mog%e2Y zLr``?Lk^h(Er~$eA`Ov%)SRg~;G;*ut4pxxM%{B=s{}gP7IJPVq@IPk17a3vz#r;K z`1(ayMXXYdY?Gsl4%j=8jo_NKD%D6_Z9}ks!He->=0j<)f03<$1#di9HCUel$c@ki zdu4f<$?++vC5f3ikX7yq3XnDLpkq;?W^hhqAWG4LfD5D#GYl}C2Ab>uHB`tC z0R@G`V$j?LY>{$i0chJLXkr8G2Dk;_O=EbKc6@xUHfsa!M@9fD< zElC6|8U`=yR!{(KDM>6X$;dCttV&G*onsBs0NS`;Qk0onTmV{k1iErS1Deg?@m!n% z3*zk5%338&NS*=h0~@HKY)IM*I*dFOwiZ4tz!@|Rmy=kU2U-XQy4e9VZ3@UvQ$7YumB0Zn@#%@4xo5YzL^l0k=? zB9>XfHUWUnhJX~mD8_*2p^A~FjzDvX*{MaK8+C@rS^MC_PCX!HqI$<#xZqXC^V BBWwTw literal 0 HcmV?d00001 diff --git a/src/scanner.cc b/src/scanner.cc index 365b982..f2f4505 100644 --- a/src/scanner.cc +++ b/src/scanner.cc @@ -1,10 +1,10 @@ #include +#include #include #include #include #include -#include namespace { @@ -40,6 +40,10 @@ public: unsigned serialize(char* buf) { unsigned size = 0; + if (context_stack.size() > CHAR_MAX) { + return 0; + } + buf[size++] = context_stack.size(); for (vector::iterator it = context_stack.begin(); it != context_stack.end(); ++it) { if (size + 2 + it->heredoc_identifier.size() >= TREE_SITTER_SERIALIZATION_BUFFER_SIZE) { @@ -54,12 +58,13 @@ public: } void deserialize(const char* buf, unsigned n) { - unsigned size = 0; + context_stack.clear(); + if (n == 0) { return; } - context_stack.clear(); + unsigned size = 0; uint8_t context_stack_size = buf[size++]; for (unsigned j = 0; j < context_stack_size; j++) { Context ctx;