1544cb649SScott Linder //===-- yaml-parser-fuzzer.cpp - Fuzzer for YAML parser -------------------===//
2544cb649SScott Linder //
3544cb649SScott Linder // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4544cb649SScott Linder // See https://llvm.org/LICENSE.txt for license information.
5544cb649SScott Linder // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6544cb649SScott Linder //
7544cb649SScott Linder //===----------------------------------------------------------------------===//
8544cb649SScott Linder
9544cb649SScott Linder #include "llvm/ADT/StringRef.h"
10544cb649SScott Linder #include "llvm/Support/YAMLParser.h"
11544cb649SScott Linder
12544cb649SScott Linder using namespace llvm;
13544cb649SScott Linder
isValidYaml(const uint8_t * Data,size_t Size)14544cb649SScott Linder static bool isValidYaml(const uint8_t *Data, size_t Size) {
15544cb649SScott Linder SourceMgr SM;
16544cb649SScott Linder yaml::Stream Stream(StringRef(reinterpret_cast<const char *>(Data), Size),
17544cb649SScott Linder SM);
18544cb649SScott Linder return Stream.validate();
19544cb649SScott Linder }
20544cb649SScott Linder
LLVMFuzzerTestOneInput(const uint8_t * Data,size_t Size)21544cb649SScott Linder extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
22544cb649SScott Linder std::vector<uint8_t> Input(Data, Data + Size);
23544cb649SScott Linder
242980933dSScott Linder // Ensure we don't crash on any arbitrary byte string.
252980933dSScott Linder isValidYaml(Input.data(), Input.size());
262980933dSScott Linder
272980933dSScott Linder // Ensure we don't crash on byte strings with no null characters.
28*f9306f6dSKazu Hirata llvm::erase(Input, 0);
292980933dSScott Linder Input.shrink_to_fit();
302980933dSScott Linder bool IsValidWithout0s = isValidYaml(Input.data(), Input.size());
312980933dSScott Linder
32544cb649SScott Linder // Ensure we don't crash on byte strings where the only null character is
33544cb649SScott Linder // one-past-the-end of the actual input to the parser.
34544cb649SScott Linder Input.push_back(0);
35544cb649SScott Linder Input.shrink_to_fit();
362980933dSScott Linder bool IsValidWhen0Terminated = isValidYaml(Input.data(), Input.size() - 1);
372980933dSScott Linder
382980933dSScott Linder // Ensure we don't crash on byte strings with no null characters, but with
392980933dSScott Linder // an invalid character one-past-the-end of the actual input to the parser.
402980933dSScott Linder Input.back() = 1;
412980933dSScott Linder bool IsValidWhen1Terminated = isValidYaml(Input.data(), Input.size() - 1);
422980933dSScott Linder
432980933dSScott Linder // The parser should either accept all of these inputs, or reject all of
442980933dSScott Linder // them, because the parser sees an identical byte string in each case. This
452980933dSScott Linder // should hopefully catch some cases where the parser is sensitive to what is
462980933dSScott Linder // present one-past-the-end of the actual input.
472980933dSScott Linder if (IsValidWithout0s != IsValidWhen0Terminated ||
482980933dSScott Linder IsValidWhen0Terminated != IsValidWhen1Terminated)
492980933dSScott Linder LLVM_BUILTIN_TRAP;
50544cb649SScott Linder
51544cb649SScott Linder return 0;
52544cb649SScott Linder }
53