| 15 | #include <vector> |
| 16 | |
| 17 | FUZZ_TARGET(str_printf) |
| 18 | { |
| 19 | FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size()); |
| 20 | const std::string format_string = fuzzed_data_provider.ConsumeRandomLengthString(64); |
| 21 | const bilingual_str bilingual_string{format_string, format_string}; |
| 22 | |
| 23 | const int digits_in_format_specifier = std::count_if(format_string.begin(), format_string.end(), IsDigit); |
| 24 | |
| 25 | // Avoid triggering the following crash bug: |
| 26 | // * strprintf("%987654321000000:", 1); |
| 27 | // |
| 28 | // Avoid triggering the following OOM bug: |
| 29 | // * strprintf("%.222222200000000$", 1.1); |
| 30 | // |
| 31 | // Upstream bug report: https://github.com/c42f/tinyformat/issues/70 |
| 32 | if (format_string.find('%') != std::string::npos && digits_in_format_specifier >= 7) { |
| 33 | return; |
| 34 | } |
| 35 | |
| 36 | // Avoid triggering the following crash bug: |
| 37 | // * strprintf("%1$*1$*", -11111111); |
| 38 | // |
| 39 | // Upstream bug report: https://github.com/c42f/tinyformat/issues/70 |
| 40 | if (format_string.find('%') != std::string::npos && format_string.find('$') != std::string::npos && format_string.find('*') != std::string::npos && digits_in_format_specifier > 0) { |
| 41 | return; |
| 42 | } |
| 43 | |
| 44 | // Avoid triggering the following crash bug: |
| 45 | // * strprintf("%.1s", (char*)nullptr); |
| 46 | // |
| 47 | // (void)strprintf(format_string, (char*)nullptr); |
| 48 | // |
| 49 | // Upstream bug report: https://github.com/c42f/tinyformat/issues/70 |
| 50 | |
| 51 | try { |
| 52 | CallOneOf( |
| 53 | fuzzed_data_provider, |
| 54 | [&] { |
| 55 | (void)strprintf(format_string, fuzzed_data_provider.ConsumeRandomLengthString(32)); |
| 56 | (void)tinyformat::format(bilingual_string, fuzzed_data_provider.ConsumeRandomLengthString(32)); |
| 57 | }, |
| 58 | [&] { |
| 59 | (void)strprintf(format_string, fuzzed_data_provider.ConsumeRandomLengthString(32).c_str()); |
| 60 | (void)tinyformat::format(bilingual_string, fuzzed_data_provider.ConsumeRandomLengthString(32).c_str()); |
| 61 | }, |
| 62 | [&] { |
| 63 | (void)strprintf(format_string, fuzzed_data_provider.ConsumeIntegral<signed char>()); |
| 64 | (void)tinyformat::format(bilingual_string, fuzzed_data_provider.ConsumeIntegral<signed char>()); |
| 65 | }, |
| 66 | [&] { |
| 67 | (void)strprintf(format_string, fuzzed_data_provider.ConsumeIntegral<unsigned char>()); |
| 68 | (void)tinyformat::format(bilingual_string, fuzzed_data_provider.ConsumeIntegral<unsigned char>()); |
| 69 | }, |
| 70 | [&] { |
| 71 | (void)strprintf(format_string, fuzzed_data_provider.ConsumeIntegral<char>()); |
| 72 | (void)tinyformat::format(bilingual_string, fuzzed_data_provider.ConsumeIntegral<char>()); |
| 73 | }, |
| 74 | [&] { |
nothing calls this directly
no test coverage detected