Function LLVMFuzzerTestOneInput

fuzzing/bt_fuzzer.cpp:63–127

}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
{
  if(size < 4)
  {
    return 0;
  }

  FuzzedDataProvider fdp(data, size);
  BT::BehaviorTreeFactory factory;

  try
  {
    // Strategy 1: Test with completely random data
    if(fdp.ConsumeBool())
    {
      std::string random_xml = fdp.ConsumeRandomLengthString(size - 1);
      try
      {
        factory.createTreeFromText(random_xml);
      }
      catch(const std::exception&)
      {}
    }
    // Strategy 2: Generate semi-valid XML
    else
    {
      std::string xml = R"(
                <root BTCPP_format="4">
                    <BehaviorTree ID="MainTree">)";

      size_t num_nodes = fdp.ConsumeIntegralInRange<size_t>(1, 5);
      for(size_t i = 0; i < num_nodes; i++)
      {
        xml += generateFuzzedNodeXML(fdp);
      }

      xml += R"(
                    </BehaviorTree>
                </root>)";

      auto blackboard = BT::Blackboard::create();

      switch(fdp.ConsumeIntegralInRange<int>(0, 2))
      {
        case 0:
          factory.createTreeFromText(xml, blackboard);
          break;
        case 1:
          BT::VerifyXML(xml, {});
          break;
        case 2:
          factory.registerBehaviorTreeFromText(xml);
          if(!factory.registeredBehaviorTrees().empty())
          {
            factory.createTree(factory.registeredBehaviorTrees().front(), blackboard);
          }
          break;
      }