profile_fuzzer.h

Go to the documentation of this file.

/*
 * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.
 *
 * SPDX-License-Identifier: curl
 */

 
#ifndef PROTO_FUZZER_PROFILE_FUZZER_H_
#define PROTO_FUZZER_PROFILE_FUZZER_H_
 
#include <libprotobuf-mutator/src/libfuzzer/libfuzzer_macro.h>
 
#include <array>
#include <cstddef>
#include <cstdint>
 
#include "curl_fuzzer.pb.h"
#include "proto_fuzzer/target_policy.h"
#include "proto_fuzzer/target_profile.h"
 
namespace proto_fuzzer {

struct ProfileFuzzerTraits {
  using CustomMutator = std::size_t (*)(std::uint8_t*, std::size_t, std::size_t, unsigned int);
  using CustomCrossOver = std::size_t (*)(const std::uint8_t*, std::size_t, const std::uint8_t*, std::size_t,
                                          std::uint8_t*, std::size_t, unsigned int);
  using InputLoader = bool (*)(const std::uint8_t*, std::size_t, curl::fuzzer::proto::Scenario*);
  using MutationProbe = void (*)();

  TargetProfile profile;
  CustomMutator custom_mutator;
  CustomCrossOver custom_crossover;
  InputLoader load_input;
  MutationProbe probe_mutation_helpers;
};

template <typename Traits>
class ProfileFuzzerHooks {
 public:
  using Message = typename Traits::Message;
  using RuntimeScenario = curl::fuzzer::proto::Scenario;

  static void EnsurePostProcessor() {
    static const protobuf_mutator::libfuzzer::PostProcessorRegistration<Message> registration(
        [](Message* message, unsigned int /*seed*/) { NormalizeMessage(message); });
    (void)registration;
  }

  static void NormalizeMessage(Message* message) {
    if (message == nullptr) {
      return;
    }
 
    message->DiscardUnknownFields();
    RuntimeScenario runtime;
    Traits::Lower(message, &runtime);
    if constexpr (Traits::kProfile != TargetProfile::kCompatibility) {
      NormalizeScenarioForTarget(&runtime, Traits::kProfile, &Traits::PruneConditionalEligibility);
    }
    message->Clear();
    Traits::Lift(&runtime, message);
  }

  static std::size_t CustomMutator(std::uint8_t* data, std::size_t size, std::size_t max_size, unsigned int seed) {
    EnsurePostProcessor();
    Message message;
    return protobuf_mutator::libfuzzer::CustomProtoMutator(true, data, size, max_size, seed, &message);
  }

  static std::size_t CustomCrossOver(const std::uint8_t* data1, std::size_t size1, const std::uint8_t* data2,
                                     std::size_t size2, std::uint8_t* out, std::size_t max_out_size,
                                     unsigned int seed) {
    EnsurePostProcessor();
    Message message1;
    Message message2;
    return protobuf_mutator::libfuzzer::CustomProtoCrossOver(true, data1, size1, data2, size2, out, max_out_size, seed,
                                                             &message1, &message2);
  }

  static bool LoadAndLower(const std::uint8_t* data, std::size_t size, RuntimeScenario* runtime) {
    if (runtime == nullptr) {
      return false;
    }
 
    EnsurePostProcessor();
    Message message;
    if (!protobuf_mutator::libfuzzer::LoadProtoInput(true, data, size, &message)) {
      return false;
    }
 
    // Mutated inputs have already passed the postprocessor before entering
    // LPM's cache. Parsed inputs pass it in Fix(). Discarding once more is
    // harmless and makes the lowering boundary fail closed for either path.
    message.DiscardUnknownFields();
    runtime->Clear();
    Traits::Lower(&message, runtime);
    // A projected profile root intentionally cannot carry policy-owned state
    // such as a fixed scheme. The postprocessor normalized that state before
    // Lift, but Lift necessarily omitted it; restore it at the final lowering
    // boundary instead of assuming the serialized root can round-trip it.
    if constexpr (Traits::kProfile != TargetProfile::kCompatibility) {
      NormalizeScenarioForTarget(runtime, Traits::kProfile, &Traits::PruneConditionalEligibility);
    }
    return true;
  }
};

template <typename Traits>
bool LoadProfileInput(const std::uint8_t* data, std::size_t size, curl::fuzzer::proto::Scenario* runtime) {
  return ProfileFuzzerHooks<Traits>::LoadAndLower(data, size, runtime);
}

template <typename Traits>
void ProbeTimingMutationHelpers() {
  static const bool mutation_helpers_probed = [] {
    constexpr std::size_t kBufferSize = 1024;
    constexpr unsigned int kMutationSeed = 0x4355524cU;
 
    curl::fuzzer::proto::Scenario runtime;
    NormalizeScenarioForTarget(&runtime, Traits::kProfile, &Traits::PruneConditionalEligibility);
 
    typename Traits::Message message;
    Traits::Lift(&runtime, &message);
    std::array<std::uint8_t, kBufferSize> first = {};
    const std::size_t original_size = message.ByteSizeLong();
    if (original_size > first.size()) {
      return true;
    }
    (void)message.SerializeWithCachedSizesToArray(first.data());
 
    using Hooks = ProfileFuzzerHooks<Traits>;
    std::array<std::uint8_t, kBufferSize> second = first;
    std::array<std::uint8_t, kBufferSize> child = {};
    const std::size_t mutated_size = Hooks::CustomMutator(first.data(), original_size, first.size(), kMutationSeed);
    const std::size_t crossed_size = Hooks::CustomCrossOver(first.data(), mutated_size, second.data(), original_size,
                                                            child.data(), child.size(), kMutationSeed);
    const volatile std::size_t result_sizes[] = {mutated_size, crossed_size};
    (void)result_sizes;
    return true;
  }();
  (void)mutation_helpers_probed;
}

template <typename Traits>
constexpr ProfileFuzzerTraits BindProfileFuzzer() {
  using Hooks = ProfileFuzzerHooks<Traits>;
  if constexpr (Traits::kProfile == TargetProfile::kTiming) {
    return {Traits::kProfile, &Hooks::CustomMutator, &Hooks::CustomCrossOver, &LoadProfileInput<Traits>,
            &ProbeTimingMutationHelpers<Traits>};
  }
  return {Traits::kProfile, &Hooks::CustomMutator, &Hooks::CustomCrossOver, &LoadProfileInput<Traits>, nullptr};
}
 
}  // namespace proto_fuzzer
 
#endif  // PROTO_FUZZER_PROFILE_FUZZER_H_