xref: /llvm-project/compiler-rt/test/fuzzer/SwitchTest.cpp (revision 2946cd701067404b99c39fb29dc9c74bd7193eb3)
1*2946cd70SChandler Carruth // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
2*2946cd70SChandler Carruth // See https://llvm.org/LICENSE.txt for license information.
3*2946cd70SChandler Carruth // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
410ab2aceSGeorge Karpenkov 
510ab2aceSGeorge Karpenkov // Simple test for a fuzzer. The fuzzer must find the interesting switch value.
610ab2aceSGeorge Karpenkov #include <cstddef>
710ab2aceSGeorge Karpenkov #include <cstdint>
810ab2aceSGeorge Karpenkov #include <cstdio>
910ab2aceSGeorge Karpenkov #include <cstdlib>
1010ab2aceSGeorge Karpenkov #include <cstring>
1110ab2aceSGeorge Karpenkov 
1210ab2aceSGeorge Karpenkov static volatile int Sink;
1310ab2aceSGeorge Karpenkov 
1410ab2aceSGeorge Karpenkov template<class T>
Switch(const uint8_t * Data,size_t Size)1510ab2aceSGeorge Karpenkov bool Switch(const uint8_t *Data, size_t Size) {
1610ab2aceSGeorge Karpenkov   T X;
1710ab2aceSGeorge Karpenkov   if (Size < sizeof(X)) return false;
1810ab2aceSGeorge Karpenkov   memcpy(&X, Data, sizeof(X));
1910ab2aceSGeorge Karpenkov   switch (X) {
2010ab2aceSGeorge Karpenkov     case 1: Sink = __LINE__; break;
2110ab2aceSGeorge Karpenkov     case 101: Sink = __LINE__; break;
2210ab2aceSGeorge Karpenkov     case 1001: Sink = __LINE__; break;
2310ab2aceSGeorge Karpenkov     case 10001: Sink = __LINE__; break;
2410ab2aceSGeorge Karpenkov     case 100001: Sink = __LINE__; break;
2510ab2aceSGeorge Karpenkov     case 1000001: Sink = __LINE__; break;
2610ab2aceSGeorge Karpenkov     case 10000001: Sink = __LINE__; break;
2710ab2aceSGeorge Karpenkov     case 100000001: return true;
2810ab2aceSGeorge Karpenkov   }
2910ab2aceSGeorge Karpenkov   return false;
3010ab2aceSGeorge Karpenkov }
3110ab2aceSGeorge Karpenkov 
ShortSwitch(const uint8_t * Data,size_t Size)3210ab2aceSGeorge Karpenkov bool ShortSwitch(const uint8_t *Data, size_t Size) {
3310ab2aceSGeorge Karpenkov   short X;
3410ab2aceSGeorge Karpenkov   if (Size < sizeof(short)) return false;
3510ab2aceSGeorge Karpenkov   memcpy(&X, Data, sizeof(short));
3610ab2aceSGeorge Karpenkov   switch(X) {
3710ab2aceSGeorge Karpenkov     case 42: Sink = __LINE__; break;
3810ab2aceSGeorge Karpenkov     case 402: Sink = __LINE__; break;
3910ab2aceSGeorge Karpenkov     case 4002: Sink = __LINE__; break;
4010ab2aceSGeorge Karpenkov     case 5002: Sink = __LINE__; break;
4110ab2aceSGeorge Karpenkov     case 7002: Sink = __LINE__; break;
4210ab2aceSGeorge Karpenkov     case 9002: Sink = __LINE__; break;
4310ab2aceSGeorge Karpenkov     case 14002: Sink = __LINE__; break;
4410ab2aceSGeorge Karpenkov     case 21402: return true;
4510ab2aceSGeorge Karpenkov   }
4610ab2aceSGeorge Karpenkov   return false;
4710ab2aceSGeorge Karpenkov }
4810ab2aceSGeorge Karpenkov 
LLVMFuzzerTestOneInput(const uint8_t * Data,size_t Size)4910ab2aceSGeorge Karpenkov extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
5010ab2aceSGeorge Karpenkov   if (Size >= 4  && Switch<int>(Data, Size) &&
5110ab2aceSGeorge Karpenkov       Size >= 12 && Switch<uint64_t>(Data + 4, Size - 4) &&
5210ab2aceSGeorge Karpenkov       Size >= 14 && ShortSwitch(Data + 12, 2)
5310ab2aceSGeorge Karpenkov     ) {
5410ab2aceSGeorge Karpenkov     fprintf(stderr, "BINGO; Found the target, exiting\n");
5510ab2aceSGeorge Karpenkov     exit(1);
5610ab2aceSGeorge Karpenkov   }
5710ab2aceSGeorge Karpenkov   return 0;
5810ab2aceSGeorge Karpenkov }
5910ab2aceSGeorge Karpenkov 
60