fuzzer_mlog.j2

/// This file is autogenerated

#include "{{ class_header }}"

#include <cstdint>
#include <iterator> // for std::size
#include <random>
#include <iostream>

/// ------------------------------ DUMPED DATA ------------------------------

namespace target {

struct Argument {
    bool is_pointer;
    size_t size;
};

const size_t ARG_LIMIT = {{ arg_limit }};

struct AData {
    Argument list[ARG_LIMIT];
    size_t size;
    size_t bytesize;
};

/// -------------- CONSTRUCTORS --------------

struct CData {
    AData args;
    {{ class_name }} (*fn)(const uint8_t *);
};

{% for c in constructors %}
{{ class_name }} constr_{{ loop.index }}(const uint8_t *data) {
{% if length(c.args) == 0 %}    return {{ class_name }}();
{% else %}    size_t size = 0;

    {% for a in c.args -%}
    {{ a.name }} *arg_{{ loop.index }} = ({{ a.name }} *)(data + size);
    size += sizeof({{ a.name }});{% endfor %}

    return {{ class_name }}({% for a in c.args %}{% if loop.index != 0 %}, {% endif %}*arg_{{loop.index}}{% endfor %});
{% endif %}{{ "};" }}
{% endfor %}

const CData c_list[] = {
    {% for c in constructors -%}
    {
        .args = {
            .list = {
                {% for a in c.args %}{{ "{" }}{{ a.is_pointer }}, sizeof({{ a.name }})},{% endfor %}
            },
            .size = {{ length(c.args) }},
            .bytesize = 0{% for a in c.args %} + sizeof({{ a.name }}){% endfor %},
        },
        .fn = constr_{{ loop.index }},
    },{% endfor %}
};

constexpr size_t c_size = std::size(c_list);

/// -------------- METHODS --------------

struct MData {
    AData args;
    void (*fn)({{ class_name }} *, const uint8_t *);
};

{% for m in methods %}
void method_{{ loop.index }}({{ class_name }} *obj, const uint8_t *data) {
{% if length(m.args) == 0 %}    obj->{{ m.name }}();
{% else %}    size_t size = 0;

    {% for a in m.args -%}
    {{ a.name }} *arg_{{ loop.index }} = ({{ a.name }} *)(data + size);
    size += sizeof({{ a.name }});{% endfor %}

    obj->{{ m.name }}({% for a in m.args %}{% if loop.index != 0 %}, {% endif %}*arg_{{ loop.index }}{% endfor %});
{% endif %}{{ "};"}}
{% endfor %}

const MData m_list[] = {
    {% for m in methods -%}
    {
        .args = {
            .list = {
                {% for a in m.args %}{{ "{" }}{{ a.is_pointer }}, sizeof({{ a.name }})},{% endfor %}
            },
            .size = {{ length(m.args) }},
            .bytesize = 0{% for a in m.args %} + sizeof({{ a.name }}){% endfor %},
        },
        .fn = method_{{ loop.index }},
    },{% endfor %}
};

constexpr size_t m_size = std::size(m_list);

} // namespace

/// ------------------------------ CALL CHAIN AND MUTATOR ------------------------------

extern "C" size_t LLVMFuzzerMutate(uint8_t *data, size_t size, size_t max_size);

class CallChain {
public:
    static const size_t LIMIT = {{ cc_limit }};

    static int eval(const uint8_t *data, size_t size) {
        if (size == 0)
            return 1;
        
        size_t ptr = 0;
        auto c = target::c_list[data[ptr] % target::c_size];
        ptr++;

        if (ptr + c.args.bytesize > size)
            return 1;

        auto obj = c.fn(data + ptr);
        ptr += c.args.bytesize;

        if (ptr >= size)
            return 1;

        auto m = target::m_list[data[ptr] % target::m_size];
        ptr++;

        size_t i = 1;
        while (ptr + m.args.bytesize <= size && i++ < LIMIT) {
            m.fn(&obj, data + ptr);
            ptr += m.args.bytesize;

            if (ptr >= size)
                return 1;

            m = target::m_list[data[ptr] % target::m_size];
            ptr++;
        }

        return 0;
    }

    CallChain(const uint8_t *data, size_t size) : d1(data), d2(nullptr), d_size(size) { update_chain(); }

    CallChain(uint8_t * data, size_t size) : d1(data), d2(data), d_size(size) { update_chain(); }

    size_t get_call_start_idx(size_t n) {
        if (n == 0)
            return 0;
        return calls[n - 1];
    }

    size_t get_cid(size_t n) const {
        if (n == 0)
            return d1[0] % target::c_size;
        return d1[calls[n - 1]] % target::m_size;
    }

    size_t get_size() const {
        return calls_size;
    }

    size_t get_arg_offset(size_t n, size_t a) const {
        size_t offset = n == 0 ? 1 : calls[n - 1] + 1;
        size_t cid = get_cid(n);
        const target::AData &ad = n == 0 ? target::c_list[cid].args : target::m_list[cid].args;

        if (a > ad.size)
            return 0;

        for (size_t i = 0; i < a; ++i)
            offset += ad.list[i].size;
        
        return offset;
    }

    const uint8_t *get_arg_ptr(size_t n, size_t a) const {
        size_t offset = get_arg_offset(n, a);
        if (offset == 0) // impossible cause first is always constructor id
            return nullptr;
        
        return d1 + offset;
    }

    size_t remove_call(size_t n) {
        n %= calls_size;
        if (d2 == nullptr || n == 0)
            return d_size;

        size_t shift = calls[n] - calls[n - 1];
        for (size_t i = calls[n - 1]; i < d_size - shift; ++i)
            d2[i] = d2[i + shift];
        d_size -= shift;

        update_chain();
        
        return d_size;
    }

    size_t insert_call(size_t cid, size_t n, size_t max_size) {
        cid %= target::m_size;
        n %= (calls_size + 1);
        if (d2 == nullptr || n == 0 || calls_size >= LIMIT)
            return d_size;

        size_t shift = target::m_list[cid].args.bytesize + 1;
        if (d_size + shift > max_size)
            return d_size;
        
        for (size_t i = d_size - 1; i >= calls[n - 1]; --i)
            d2[i + shift] = d2[i];

        d2[calls[n - 1]] = cid;
        for (size_t i = 1; i < shift; ++i)
            d2[calls[n - 1] + i] = 0;
        d_size += shift;

        update_chain();

        return d_size;
    }

    size_t mutate_args(size_t n) {
        if (d2 == nullptr || d_size > 1 || calls_size == 0)
            return d_size;
        n %= calls_size;
        
        uint8_t *data; size_t size;
        if (n == 0) {
            data = d2 + 1;
            size = calls[0] - 1;
        } else {
            data = d2 + calls[n - 1] + 1;
            size = calls[n] - calls[n - 1];
        }

        if (size == 0)
            return d_size;

        std::cout << d_size << " " << size << " " << calls[n] << std::endl;
        std::fflush(stdout);

        LLVMFuzzerMutate(data, size, size);

        return d_size;
    }

private:
    const uint8_t *d1;
    uint8_t *d2;
    size_t d_size;

    size_t calls[LIMIT];
    size_t calls_size;

    void update_chain() {
        if (d_size == 0) {
            calls_size = 0;
            return;
        }

        if (d2 != nullptr && d1 != d2)
            d1 = d2;
        
        calls[0] = target::c_list[d1[0] % target::c_size].args.bytesize + 1;
        calls_size = 1;

        while (calls_size < LIMIT && calls[calls_size - 1] < d_size) {
            calls[calls_size] = calls[calls_size - 1] + target::m_list[d1[calls[calls_size - 1]] % target::m_size].args.bytesize + 1;
            calls_size++;
        }
    }
};

#include <iomanip>

void print_data_as_hex(const uint8_t *data, size_t size) {
    for (int i = 0; i < size; ++i)
        std::cout << std::hex << std::setfill('0') << std::setw(2) << (int)data[i];
}

extern "C" size_t LLVMFuzzerCustomMutator(uint8_t *data, size_t size, size_t max_size, unsigned int seed) {
    if (size == 0)
        return size;

    CallChain cc(data, size);

    if (cc.get_size() == 0)
        return size;

    std::mt19937 rng(seed);
    switch (rng() % 3) {
        case 0: {
            size_t n = rng() % cc.get_size();
            std::cout << std::dec << "Delete call[" << n << "]: ";
            print_data_as_hex(data, size);

            size_t s =  cc.remove_call(n);
            
            std::cout << " -> ";
            print_data_as_hex(data, s);
            std::cout << std::endl;

            return s;
        }
        case 1: {
            size_t  cid = rng() % target::m_size,
                    n = rng() % (cc.get_size() + 1);
            std::cout << std::dec << "Insert call[" << cid << ", " << n << "]: ";
            print_data_as_hex(data, size);
            
            size_t s =  cc.insert_call(cid, n, max_size);
            
            std::cout << " -> ";
            print_data_as_hex(data, s);
            std::cout << std::endl;

            return s;
        }
        case 2: {
            size_t n = rng() % cc.get_size();
            std::cout << std::dec << "Mutate args[" << n << "]: ";
            print_data_as_hex(data, size);

            size_t s = cc.mutate_args(rng());

            std::cout << " -> ";
            print_data_as_hex(data, s);
            std::cout << std::endl;

            return s;
        }
        default: 
            return size;
    }
}

extern "C" size_t LLVMFuzzerCustomCrossOver(
    const uint8_t *data1, size_t size1,
    const uint8_t *data2, size_t size2,
    uint8_t *out, size_t max_out_size,
    unsigned int seed
) {
    CallChain c1(data1, size1), c2(data2, size2);

    if (c1.get_size() == 0 || c2.get_size() == 0) {
        for (size_t i = 0; i < size1; ++i)
            out[i] = 0;
        return size1;
    }

    std::mt19937 rng(seed);
    size_t p1, p2, i = 0;
    do {
        p1 = rng() % c1.get_size();
        p2 = rng() % c2.get_size();
    } while (c1.get_call_start_idx(p1) + c2.get_call_start_idx(p2) >= max_out_size + size2 && p1 + p2 >= CallChain::LIMIT + c2.get_size()  && i++ < 10);

    if (i >= 10) {
        for (size_t i = 0; i < size1; ++i)
            out[i] = 0;
        return max_out_size;
    }

    for (i = 0; i < c1.get_call_start_idx(p1); ++i)
        out[i] = data1[i];
    
    for (size_t j = c2.get_call_start_idx(p2); j < size2; ++j, ++i)
        out[i] = data2[j];
    
    return i;
}


/// ------------------------------ HARNESS FN ------------------------------

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    CallChain::eval(data, size);
    return 0;
}