Add fuzzer for the terminal

This commit adds a fuzzer for more of the terminal pipeline, adding coverage for the input and output portions of the terminal framebuffer.
mobile-shell · May 31, 2022 · f2ad6fe · f2ad6fe
1 parent 4282c63
commit f2ad6fe
Show file tree

Hide file tree

Showing 18 changed files with 33 additions and 1 deletion.
diff --git a/src/fuzz/Makefile.am b/src/fuzz/Makefile.am
@@ -1,7 +1,11 @@
 AM_CXXFLAGS = $(WARNING_CXXFLAGS) $(PICKY_CXXFLAGS) $(HARDEN_CFLAGS) $(MISC_CXXFLAGS) $(CODE_COVERAGE_CXXFLAGS) $(FUZZING_CFLAGS)
 
-noinst_PROGRAMS = terminal_parser_fuzzer
+noinst_PROGRAMS = terminal_parser_fuzzer terminal_fuzzer
 
 terminal_parser_fuzzer_CPPFLAGS = -I$(srcdir)/../terminal -I$(srcdir)/../util
 terminal_parser_fuzzer_LDADD = ../terminal/libmoshterminal.a ../util/libmoshutil.a
 terminal_parser_fuzzer_SOURCES = terminal_parser_fuzzer.cc
+
+terminal_fuzzer_CPPFLAGS = -I$(srcdir)/../terminal -I$(srcdir)/../util -I$(srcdir)/../statesync -I../protobufs
+terminal_fuzzer_LDADD = ../terminal/libmoshterminal.a ../util/libmoshutil.a ../statesync/libmoshstatesync.a ../protobufs/libmoshprotos.a $(TINFO_LIBS) $(protobuf_LIBS)
+terminal_fuzzer_SOURCES = terminal_fuzzer.cc
diff --git a/src/fuzz/terminal_corpus/3769c52698d426976ee402b9dbc3c2a7bd5e5485 b/src/fuzz/terminal_corpus/3769c52698d426976ee402b9dbc3c2a7bd5e5485
diff --git a/src/fuzz/terminal_corpus/3a52ce780950d4d969792a2559cd519d7ee8c727 b/src/fuzz/terminal_corpus/3a52ce780950d4d969792a2559cd519d7ee8c727
@@ -0,0 +1 @@
+.
diff --git a/src/fuzz/terminal_corpus/3facad9d449f8b10a2d18ef821325639214afc3c b/src/fuzz/terminal_corpus/3facad9d449f8b10a2d18ef821325639214afc3c
diff --git a/src/fuzz/terminal_corpus/433f367f36f48f78570c2013fef7a4f4b52b7c0c b/src/fuzz/terminal_corpus/433f367f36f48f78570c2013fef7a4f4b52b7c0c
@@ -0,0 +1 @@
+&�����:#
diff --git a/src/fuzz/terminal_corpus/5ba93c9db0cff93f52b521d7420e43f6eda2784f b/src/fuzz/terminal_corpus/5ba93c9db0cff93f52b521d7420e43f6eda2784f
diff --git a/src/fuzz/terminal_corpus/64b6cc492319c39d017963ee8f5863520eb7b6b9 b/src/fuzz/terminal_corpus/64b6cc492319c39d017963ee8f5863520eb7b6b9
diff --git a/src/fuzz/terminal_corpus/7c4d33785daa5c2370201ffa236b427aa37c9996 b/src/fuzz/terminal_corpus/7c4d33785daa5c2370201ffa236b427aa37c9996
@@ -0,0 +1 @@
+&
diff --git a/src/fuzz/terminal_corpus/7fff5c5bdfcaecbe749a7eda1f831a4b0ac6c285 b/src/fuzz/terminal_corpus/7fff5c5bdfcaecbe749a7eda1f831a4b0ac6c285
diff --git a/src/fuzz/terminal_corpus/94fc46a4dd7043c8a22bc85f24aafdf0bc963125 b/src/fuzz/terminal_corpus/94fc46a4dd7043c8a22bc85f24aafdf0bc963125
diff --git a/src/fuzz/terminal_corpus/9a78211436f6d425ec38f5c4e02270801f3524f8 b/src/fuzz/terminal_corpus/9a78211436f6d425ec38f5c4e02270801f3524f8
@@ -0,0 +1 @@
+@
diff --git a/src/fuzz/terminal_corpus/a70a7fcfa8e88039504b6a798314285419f51e16 b/src/fuzz/terminal_corpus/a70a7fcfa8e88039504b6a798314285419f51e16
@@ -0,0 +1,3 @@
+
+
+@
diff --git a/src/fuzz/terminal_corpus/adc83b19e793491b1c6ea0fd8b46cd9f32e592fc b/src/fuzz/terminal_corpus/adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
@@ -0,0 +1 @@
+
diff --git a/src/fuzz/terminal_corpus/bf72240ede73688a77e62c38b4a112f15cb61802 b/src/fuzz/terminal_corpus/bf72240ede73688a77e62c38b4a112f15cb61802
diff --git a/src/fuzz/terminal_corpus/c822a8bc8c7d9f938990c2bfd0b24fd9d48af917 b/src/fuzz/terminal_corpus/c822a8bc8c7d9f938990c2bfd0b24fd9d48af917
diff --git a/src/fuzz/terminal_corpus/e0d3c08cb28736844512c52dc05fa4e4efd91490 b/src/fuzz/terminal_corpus/e0d3c08cb28736844512c52dc05fa4e4efd91490
@@ -0,0 +1,2 @@
+
+@
diff --git a/src/fuzz/terminal_corpus/f195c020a28dfc5f2fb6af256b524ddcd93756ed b/src/fuzz/terminal_corpus/f195c020a28dfc5f2fb6af256b524ddcd93756ed
@@ -0,0 +1 @@
+�
diff --git a/src/fuzz/terminal_fuzzer.cc b/src/fuzz/terminal_fuzzer.cc
@@ -0,0 +1,17 @@
+#include <cstddef>
+#include <cstdint>
+
+#include "parser.h"
+#include "completeterminal.h"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  Terminal::Display display(false);
+  Terminal::Complete complete(80, 24);
+  Terminal::Framebuffer state(80, 24);
+  for (size_t i = 0; i < size; i++) {
+    complete.act(Parser::UserByte(data[i]));
+  }
+  display.new_frame(true, state, complete.get_fb());
+
+  return 0;
+}