tests/fuzz_test.cpp - third_party/flatbuffers - Git at Google

 #include "fuzz_test.h"

 #include "flatbuffers/flatbuffers.h"
 #include "flatbuffers/idl.h"
 #include "test_assert.h"

 namespace flatbuffers {
 namespace tests {
 namespace {

 // Include simple random number generator to ensure results will be the
 // same cross platform.
 // http://en.wikipedia.org/wiki/Park%E2%80%93Miller_random_number_generator
 uint32_t lcg_seed = 48271;
 uint32_t lcg_rand() {
   return lcg_seed =
              (static_cast<uint64_t>(lcg_seed) * 279470273UL) % 4294967291UL;
 }
 void lcg_reset() { lcg_seed = 48271; }

 template<typename T>
 static void CompareTableFieldValue(flatbuffers::Table *table,
                             flatbuffers::voffset_t voffset, T val) {
   T read = table->GetField(voffset, static_cast<T>(0));
   TEST_EQ(read, val);
 }

 }  // namespace

 // Low level stress/fuzz test: serialize/deserialize a variety of
 // different kinds of data in different combinations
 void FuzzTest1() {
   // Values we're testing against: chosen to ensure no bits get chopped
   // off anywhere, and also be different from eachother.
   const uint8_t bool_val = true;
   const int8_t char_val = -127;  // 0x81
   const uint8_t uchar_val = 0xFF;
   const int16_t short_val = -32222;  // 0x8222;
   const uint16_t ushort_val = 0xFEEE;
   const int32_t int_val = 0x83333333;
   const uint32_t uint_val = 0xFDDDDDDD;
   const int64_t long_val = 0x8444444444444444LL;
   const uint64_t ulong_val = 0xFCCCCCCCCCCCCCCCULL;
   const float float_val = 3.14159f;
   const double double_val = 3.14159265359;

   const int test_values_max = 11;
   const flatbuffers::voffset_t fields_per_object = 4;
   const int num_fuzz_objects = 10000;  // The higher, the more thorough :)

   flatbuffers::FlatBufferBuilder builder;

   lcg_reset();  // Keep it deterministic.

   flatbuffers::uoffset_t objects[num_fuzz_objects];

   // Generate num_fuzz_objects random objects each consisting of
   // fields_per_object fields, each of a random type.
   for (int i = 0; i < num_fuzz_objects; i++) {
     auto start = builder.StartTable();
     for (flatbuffers::voffset_t f = 0; f < fields_per_object; f++) {
       int choice = lcg_rand() % test_values_max;
       auto off = flatbuffers::FieldIndexToOffset(f);
       switch (choice) {
         case 0: builder.AddElement<uint8_t>(off, bool_val, 0); break;
         case 1: builder.AddElement<int8_t>(off, char_val, 0); break;
         case 2: builder.AddElement<uint8_t>(off, uchar_val, 0); break;
         case 3: builder.AddElement<int16_t>(off, short_val, 0); break;
         case 4: builder.AddElement<uint16_t>(off, ushort_val, 0); break;
         case 5: builder.AddElement<int32_t>(off, int_val, 0); break;
         case 6: builder.AddElement<uint32_t>(off, uint_val, 0); break;
         case 7: builder.AddElement<int64_t>(off, long_val, 0); break;
         case 8: builder.AddElement<uint64_t>(off, ulong_val, 0); break;
         case 9: builder.AddElement<float>(off, float_val, 0); break;
         case 10: builder.AddElement<double>(off, double_val, 0); break;
       }
     }
     objects[i] = builder.EndTable(start);
   }
   builder.PreAlign<flatbuffers::largest_scalar_t>(0);  // Align whole buffer.

   lcg_reset();  // Reset.

   uint8_t *eob = builder.GetCurrentBufferPointer() + builder.GetSize();

   // Test that all objects we generated are readable and return the
   // expected values. We generate random objects in the same order
   // so this is deterministic.
   for (int i = 0; i < num_fuzz_objects; i++) {
     auto table = reinterpret_cast<flatbuffers::Table *>(eob - objects[i]);
     for (flatbuffers::voffset_t f = 0; f < fields_per_object; f++) {
       int choice = lcg_rand() % test_values_max;
       flatbuffers::voffset_t off = flatbuffers::FieldIndexToOffset(f);
       switch (choice) {
         case 0: CompareTableFieldValue(table, off, bool_val); break;
         case 1: CompareTableFieldValue(table, off, char_val); break;
         case 2: CompareTableFieldValue(table, off, uchar_val); break;
         case 3: CompareTableFieldValue(table, off, short_val); break;
         case 4: CompareTableFieldValue(table, off, ushort_val); break;
         case 5: CompareTableFieldValue(table, off, int_val); break;
         case 6: CompareTableFieldValue(table, off, uint_val); break;
         case 7: CompareTableFieldValue(table, off, long_val); break;
         case 8: CompareTableFieldValue(table, off, ulong_val); break;
         case 9: CompareTableFieldValue(table, off, float_val); break;
         case 10: CompareTableFieldValue(table, off, double_val); break;
       }
     }
   }
 }

 // High level stress/fuzz test: generate a big schema and
 // matching json data in random combinations, then parse both,
 // generate json back from the binary, and compare with the original.
 void FuzzTest2() {
   lcg_reset();  // Keep it deterministic.

   const int num_definitions = 30;
   const int num_struct_definitions = 5;  // Subset of num_definitions.
   const int fields_per_definition = 15;
   const int instances_per_definition = 5;
   const int deprecation_rate = 10;  // 1 in deprecation_rate fields will
                                     // be deprecated.

   std::string schema = "namespace test;\n\n";

   struct RndDef {
     std::string instances[instances_per_definition];

     // Since we're generating schema and corresponding data in tandem,
     // this convenience function adds strings to both at once.
     static void Add(RndDef (&definitions_l)[num_definitions],
                     std::string &schema_l, const int instances_per_definition_l,
                     const char *schema_add, const char *instance_add,
                     int definition) {
       schema_l += schema_add;
       for (int i = 0; i < instances_per_definition_l; i++)
         definitions_l[definition].instances[i] += instance_add;
     }
   };

   // clang-format off
   #define AddToSchemaAndInstances(schema_add, instance_add) \
     RndDef::Add(definitions, schema, instances_per_definition, \
                 schema_add, instance_add, definition)

   #define Dummy() \
     RndDef::Add(definitions, schema, instances_per_definition, \
                 "byte", "1", definition)
   // clang-format on

   RndDef definitions[num_definitions];

   // We are going to generate num_definitions, the first
   // num_struct_definitions will be structs, the rest tables. For each
   // generate random fields, some of which may be struct/table types
   // referring to previously generated structs/tables.
   // Simultanenously, we generate instances_per_definition JSON data
   // definitions, which will have identical structure to the schema
   // being generated. We generate multiple instances such that when creating
   // hierarchy, we get some variety by picking one randomly.
   for (int definition = 0; definition < num_definitions; definition++) {
     std::string definition_name = "D" + flatbuffers::NumToString(definition);

     bool is_struct = definition < num_struct_definitions;

     AddToSchemaAndInstances(
         ((is_struct ? "struct " : "table ") + definition_name + " {\n").c_str(),
         "{\n");

     for (int field = 0; field < fields_per_definition; field++) {
       const bool is_last_field = field == fields_per_definition - 1;

       // Deprecate 1 in deprecation_rate fields. Only table fields can be
       // deprecated.
       // Don't deprecate the last field to avoid dangling commas in JSON.
       const bool deprecated =
           !is_struct && !is_last_field && (lcg_rand() % deprecation_rate == 0);

       std::string field_name = "f" + flatbuffers::NumToString(field);
       AddToSchemaAndInstances(("  " + field_name + ":").c_str(),
                               deprecated ? "" : (field_name + ": ").c_str());
       // Pick random type:
       auto base_type = static_cast<flatbuffers::BaseType>(
           lcg_rand() % (flatbuffers::BASE_TYPE_UNION + 1));
       switch (base_type) {
         case flatbuffers::BASE_TYPE_STRING:
           if (is_struct) {
             Dummy();  // No strings in structs.
           } else {
             AddToSchemaAndInstances("string", deprecated ? "" : "\"hi\"");
           }
           break;
         case flatbuffers::BASE_TYPE_VECTOR:
           if (is_struct) {
             Dummy();  // No vectors in structs.
           } else {
             AddToSchemaAndInstances("[ubyte]",
                                     deprecated ? "" : "[\n0,\n1,\n255\n]");
           }
           break;
         case flatbuffers::BASE_TYPE_NONE:
         case flatbuffers::BASE_TYPE_UTYPE:
         case flatbuffers::BASE_TYPE_STRUCT:
         case flatbuffers::BASE_TYPE_UNION:
           if (definition) {
             // Pick a random previous definition and random data instance of
             // that definition.
             int defref = lcg_rand() % definition;
             int instance = lcg_rand() % instances_per_definition;
             AddToSchemaAndInstances(
                 ("D" + flatbuffers::NumToString(defref)).c_str(),
                 deprecated ? ""
                            : definitions[defref].instances[instance].c_str());
           } else {
             // If this is the first definition, we have no definition we can
             // refer to.
             Dummy();
           }
           break;
         case flatbuffers::BASE_TYPE_BOOL:
           AddToSchemaAndInstances(
               "bool", deprecated ? "" : (lcg_rand() % 2 ? "true" : "false"));
           break;
         case flatbuffers::BASE_TYPE_ARRAY:
           if (!is_struct) {
             AddToSchemaAndInstances(
                 "ubyte",
                 deprecated ? "" : "255");  // No fixed-length arrays in tables.
           } else {
             AddToSchemaAndInstances("[int:3]", deprecated ? "" : "[\n,\n,\n]");
           }
           break;
         default:
           // All the scalar types.
           schema += flatbuffers::kTypeNames[base_type];

           if (!deprecated) {
             // We want each instance to use its own random value.
             for (int inst = 0; inst < instances_per_definition; inst++)
               definitions[definition].instances[inst] +=
                   flatbuffers::IsFloat(base_type)
                       ? flatbuffers::NumToString<double>(lcg_rand() % 128)
                             .c_str()
                       : flatbuffers::NumToString<int>(lcg_rand() % 128).c_str();
           }
       }
       AddToSchemaAndInstances(deprecated ? "(deprecated);\n" : ";\n",
                               deprecated      ? ""
                               : is_last_field ? "\n"
                                               : ",\n");
     }
     AddToSchemaAndInstances("}\n\n", "}");
   }

   schema += "root_type D" + flatbuffers::NumToString(num_definitions - 1);
   schema += ";\n";

   flatbuffers::Parser parser;

   // Will not compare against the original if we don't write defaults
   parser.builder_.ForceDefaults(true);

   // Parse the schema, parse the generated data, then generate text back
   // from the binary and compare against the original.
   TEST_EQ(parser.Parse(schema.c_str()), true);

   const std::string &json =
       definitions[num_definitions - 1].instances[0] + "\n";

   TEST_EQ(parser.Parse(json.c_str()), true);

   std::string jsongen;
   parser.opts.indent_step = 0;
   auto result =
       GenerateText(parser, parser.builder_.GetBufferPointer(), &jsongen);
   TEST_EQ(result, true);

   if (jsongen != json) {
     // These strings are larger than a megabyte, so we show the bytes around
     // the first bytes that are different rather than the whole string.
     size_t len = std::min(json.length(), jsongen.length());
     for (size_t i = 0; i < len; i++) {
       if (json[i] != jsongen[i]) {
         i -= std::min(static_cast<size_t>(10), i);  // show some context;
         size_t end = std::min(len, i + 20);
         for (; i < end; i++)
           TEST_OUTPUT_LINE("at %d: found \"%c\", expected \"%c\"\n",
                            static_cast<int>(i), jsongen[i], json[i]);
         break;
       }
     }
     TEST_NOTNULL(nullptr);  //-V501 (this comment suppresses CWE-570 warning)
   }

   // clang-format off
   #ifdef FLATBUFFERS_TEST_VERBOSE
     TEST_OUTPUT_LINE("%dk schema tested with %dk of json\n",
                      static_cast<int>(schema.length() / 1024),
                      static_cast<int>(json.length() / 1024));
   #endif
   // clang-format on
 }

 }  // namespace tests
 }  // namespace flatbuffers
	#include "fuzz_test.h"

	#include "flatbuffers/flatbuffers.h"
	#include "flatbuffers/idl.h"
	#include "test_assert.h"

	namespace flatbuffers {
	namespace tests {
	namespace {

	// Include simple random number generator to ensure results will be the
	// same cross platform.
	// http://en.wikipedia.org/wiki/Park%E2%80%93Miller_random_number_generator
	uint32_t lcg_seed = 48271;
	uint32_t lcg_rand() {
	return lcg_seed =
	(static_cast<uint64_t>(lcg_seed) * 279470273UL) % 4294967291UL;
	}
	void lcg_reset() { lcg_seed = 48271; }

	template<typename T>
	static void CompareTableFieldValue(flatbuffers::Table *table,
	flatbuffers::voffset_t voffset, T val) {
	T read = table->GetField(voffset, static_cast<T>(0));
	TEST_EQ(read, val);
	}

	} // namespace

	// Low level stress/fuzz test: serialize/deserialize a variety of
	// different kinds of data in different combinations
	void FuzzTest1() {
	// Values we're testing against: chosen to ensure no bits get chopped
	// off anywhere, and also be different from eachother.
	const uint8_t bool_val = true;
	const int8_t char_val = -127; // 0x81
	const uint8_t uchar_val = 0xFF;
	const int16_t short_val = -32222; // 0x8222;
	const uint16_t ushort_val = 0xFEEE;
	const int32_t int_val = 0x83333333;
	const uint32_t uint_val = 0xFDDDDDDD;
	const int64_t long_val = 0x8444444444444444LL;
	const uint64_t ulong_val = 0xFCCCCCCCCCCCCCCCULL;
	const float float_val = 3.14159f;
	const double double_val = 3.14159265359;

	const int test_values_max = 11;
	const flatbuffers::voffset_t fields_per_object = 4;
	const int num_fuzz_objects = 10000; // The higher, the more thorough :)

	flatbuffers::FlatBufferBuilder builder;

	lcg_reset(); // Keep it deterministic.

	flatbuffers::uoffset_t objects[num_fuzz_objects];

	// Generate num_fuzz_objects random objects each consisting of
	// fields_per_object fields, each of a random type.
	for (int i = 0; i < num_fuzz_objects; i++) {
	auto start = builder.StartTable();
	for (flatbuffers::voffset_t f = 0; f < fields_per_object; f++) {
	int choice = lcg_rand() % test_values_max;
	auto off = flatbuffers::FieldIndexToOffset(f);
	switch (choice) {
	case 0: builder.AddElement<uint8_t>(off, bool_val, 0); break;
	case 1: builder.AddElement<int8_t>(off, char_val, 0); break;
	case 2: builder.AddElement<uint8_t>(off, uchar_val, 0); break;
	case 3: builder.AddElement<int16_t>(off, short_val, 0); break;
	case 4: builder.AddElement<uint16_t>(off, ushort_val, 0); break;
	case 5: builder.AddElement<int32_t>(off, int_val, 0); break;
	case 6: builder.AddElement<uint32_t>(off, uint_val, 0); break;
	case 7: builder.AddElement<int64_t>(off, long_val, 0); break;
	case 8: builder.AddElement<uint64_t>(off, ulong_val, 0); break;
	case 9: builder.AddElement<float>(off, float_val, 0); break;
	case 10: builder.AddElement<double>(off, double_val, 0); break;
	}
	}
	objects[i] = builder.EndTable(start);
	}
	builder.PreAlign<flatbuffers::largest_scalar_t>(0); // Align whole buffer.

	lcg_reset(); // Reset.

	uint8_t *eob = builder.GetCurrentBufferPointer() + builder.GetSize();

	// Test that all objects we generated are readable and return the
	// expected values. We generate random objects in the same order
	// so this is deterministic.
	for (int i = 0; i < num_fuzz_objects; i++) {
	auto table = reinterpret_cast<flatbuffers::Table *>(eob - objects[i]);
	for (flatbuffers::voffset_t f = 0; f < fields_per_object; f++) {
	int choice = lcg_rand() % test_values_max;
	flatbuffers::voffset_t off = flatbuffers::FieldIndexToOffset(f);
	switch (choice) {
	case 0: CompareTableFieldValue(table, off, bool_val); break;
	case 1: CompareTableFieldValue(table, off, char_val); break;
	case 2: CompareTableFieldValue(table, off, uchar_val); break;
	case 3: CompareTableFieldValue(table, off, short_val); break;
	case 4: CompareTableFieldValue(table, off, ushort_val); break;
	case 5: CompareTableFieldValue(table, off, int_val); break;
	case 6: CompareTableFieldValue(table, off, uint_val); break;
	case 7: CompareTableFieldValue(table, off, long_val); break;
	case 8: CompareTableFieldValue(table, off, ulong_val); break;
	case 9: CompareTableFieldValue(table, off, float_val); break;
	case 10: CompareTableFieldValue(table, off, double_val); break;
	}
	}
	}
	}

	// High level stress/fuzz test: generate a big schema and
	// matching json data in random combinations, then parse both,
	// generate json back from the binary, and compare with the original.
	void FuzzTest2() {
	lcg_reset(); // Keep it deterministic.

	const int num_definitions = 30;
	const int num_struct_definitions = 5; // Subset of num_definitions.
	const int fields_per_definition = 15;
	const int instances_per_definition = 5;
	const int deprecation_rate = 10; // 1 in deprecation_rate fields will
	// be deprecated.

	std::string schema = "namespace test;\n\n";

	struct RndDef {
	std::string instances[instances_per_definition];

	// Since we're generating schema and corresponding data in tandem,
	// this convenience function adds strings to both at once.
	static void Add(RndDef (&definitions_l)[num_definitions],
	std::string &schema_l, const int instances_per_definition_l,
	const char schema_add, const char instance_add,
	int definition) {
	schema_l += schema_add;
	for (int i = 0; i < instances_per_definition_l; i++)
	definitions_l[definition].instances[i] += instance_add;
	}
	};

	// clang-format off
	#define AddToSchemaAndInstances(schema_add, instance_add) \
	RndDef::Add(definitions, schema, instances_per_definition, \
	schema_add, instance_add, definition)

	#define Dummy() \
	RndDef::Add(definitions, schema, instances_per_definition, \
	"byte", "1", definition)
	// clang-format on

	RndDef definitions[num_definitions];

	// We are going to generate num_definitions, the first
	// num_struct_definitions will be structs, the rest tables. For each
	// generate random fields, some of which may be struct/table types
	// referring to previously generated structs/tables.
	// Simultanenously, we generate instances_per_definition JSON data
	// definitions, which will have identical structure to the schema
	// being generated. We generate multiple instances such that when creating
	// hierarchy, we get some variety by picking one randomly.
	for (int definition = 0; definition < num_definitions; definition++) {
	std::string definition_name = "D" + flatbuffers::NumToString(definition);

	bool is_struct = definition < num_struct_definitions;

	AddToSchemaAndInstances(
	((is_struct ? "struct " : "table ") + definition_name + " {\n").c_str(),
	"{\n");

	for (int field = 0; field < fields_per_definition; field++) {
	const bool is_last_field = field == fields_per_definition - 1;

	// Deprecate 1 in deprecation_rate fields. Only table fields can be
	// deprecated.
	// Don't deprecate the last field to avoid dangling commas in JSON.
	const bool deprecated =
	!is_struct && !is_last_field && (lcg_rand() % deprecation_rate == 0);

	std::string field_name = "f" + flatbuffers::NumToString(field);
	AddToSchemaAndInstances((" " + field_name + ":").c_str(),
	deprecated ? "" : (field_name + ": ").c_str());
	// Pick random type:
	auto base_type = static_cast<flatbuffers::BaseType>(
	lcg_rand() % (flatbuffers::BASE_TYPE_UNION + 1));
	switch (base_type) {
	case flatbuffers::BASE_TYPE_STRING:
	if (is_struct) {
	Dummy(); // No strings in structs.
	} else {
	AddToSchemaAndInstances("string", deprecated ? "" : "\"hi\"");
	}
	break;
	case flatbuffers::BASE_TYPE_VECTOR:
	if (is_struct) {
	Dummy(); // No vectors in structs.
	} else {
	AddToSchemaAndInstances("[ubyte]",
	deprecated ? "" : "[\n0,\n1,\n255\n]");
	}
	break;
	case flatbuffers::BASE_TYPE_NONE:
	case flatbuffers::BASE_TYPE_UTYPE:
	case flatbuffers::BASE_TYPE_STRUCT:
	case flatbuffers::BASE_TYPE_UNION:
	if (definition) {
	// Pick a random previous definition and random data instance of
	// that definition.
	int defref = lcg_rand() % definition;
	int instance = lcg_rand() % instances_per_definition;
	AddToSchemaAndInstances(
	("D" + flatbuffers::NumToString(defref)).c_str(),
	deprecated ? ""
	: definitions[defref].instances[instance].c_str());
	} else {
	// If this is the first definition, we have no definition we can
	// refer to.
	Dummy();
	}
	break;
	case flatbuffers::BASE_TYPE_BOOL:
	AddToSchemaAndInstances(
	"bool", deprecated ? "" : (lcg_rand() % 2 ? "true" : "false"));
	break;
	case flatbuffers::BASE_TYPE_ARRAY:
	if (!is_struct) {
	AddToSchemaAndInstances(
	"ubyte",
	deprecated ? "" : "255"); // No fixed-length arrays in tables.
	} else {
	AddToSchemaAndInstances("[int:3]", deprecated ? "" : "[\n,\n,\n]");
	}
	break;
	default:
	// All the scalar types.
	schema += flatbuffers::kTypeNames[base_type];

	if (!deprecated) {
	// We want each instance to use its own random value.
	for (int inst = 0; inst < instances_per_definition; inst++)
	definitions[definition].instances[inst] +=
	flatbuffers::IsFloat(base_type)
	? flatbuffers::NumToString<double>(lcg_rand() % 128)
	.c_str()
	: flatbuffers::NumToString<int>(lcg_rand() % 128).c_str();
	}
	}
	AddToSchemaAndInstances(deprecated ? "(deprecated);\n" : ";\n",
	deprecated ? ""
	: is_last_field ? "\n"
	: ",\n");
	}
	AddToSchemaAndInstances("}\n\n", "}");
	}

	schema += "root_type D" + flatbuffers::NumToString(num_definitions - 1);
	schema += ";\n";

	flatbuffers::Parser parser;

	// Will not compare against the original if we don't write defaults
	parser.builder_.ForceDefaults(true);

	// Parse the schema, parse the generated data, then generate text back
	// from the binary and compare against the original.
	TEST_EQ(parser.Parse(schema.c_str()), true);

	const std::string &json =
	definitions[num_definitions - 1].instances[0] + "\n";

	TEST_EQ(parser.Parse(json.c_str()), true);

	std::string jsongen;
	parser.opts.indent_step = 0;
	auto result =
	GenerateText(parser, parser.builder_.GetBufferPointer(), &jsongen);
	TEST_EQ(result, true);

	if (jsongen != json) {
	// These strings are larger than a megabyte, so we show the bytes around
	// the first bytes that are different rather than the whole string.
	size_t len = std::min(json.length(), jsongen.length());
	for (size_t i = 0; i < len; i++) {
	if (json[i] != jsongen[i]) {
	i -= std::min(static_cast<size_t>(10), i); // show some context;
	size_t end = std::min(len, i + 20);
	for (; i < end; i++)
	TEST_OUTPUT_LINE("at %d: found \"%c\", expected \"%c\"\n",
	static_cast<int>(i), jsongen[i], json[i]);
	break;
	}
	}
	TEST_NOTNULL(nullptr); //-V501 (this comment suppresses CWE-570 warning)
	}

	// clang-format off
	#ifdef FLATBUFFERS_TEST_VERBOSE
	TEST_OUTPUT_LINE("%dk schema tested with %dk of json\n",
	static_cast<int>(schema.length() / 1024),
	static_cast<int>(json.length() / 1024));
	#endif
	// clang-format on
	}

	} // namespace tests
	} // namespace flatbuffers