Import c9a1e56750a4eef6ffca95f41f79f06979056e01 into master
am: f9fc8f8397
Change-Id: I3d055cf1811d6d6044d4095d9d75cd95779bcc7b
diff --git a/.clang-format b/.clang-format
new file mode 100644
index 0000000..3d22e0a
--- /dev/null
+++ b/.clang-format
@@ -0,0 +1 @@
+BasedOnStyle: Google
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..567609b
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+build/
diff --git a/.travis.yml b/.travis.yml
new file mode 100644
index 0000000..6b55737
--- /dev/null
+++ b/.travis.yml
@@ -0,0 +1,60 @@
+os: linux
+dist: trusty
+sudo: false
+
+language: cpp
+
+addons:
+ apt:
+ packages: &common_packages
+ - ninja-build
+ - liblzma-dev
+ - libz-dev
+ sources: &common_sources
+ - ubuntu-toolchain-r-test
+
+env:
+ global: CLANG_VERSION=7 GCC_VERSION=7
+
+matrix:
+ include:
+ - env: BUILD_TYPE=Release CC_COMPILER=clang-${CLANG_VERSION} CXX_COMPILER=clang++-${CLANG_VERSION}
+ addons: &clang
+ apt:
+ packages:
+ - *common_packages
+ - clang-7
+ sources:
+ - *common_sources
+ - sourceline: 'deb http://apt.llvm.org/jessie/ llvm-toolchain-jessie main'
+ key_url: 'https://apt.llvm.org/llvm-snapshot.gpg.key'
+
+ - env: BUILD_TYPE=Debug CC_COMPILER=clang-${CLANG_VERSION} CXX_COMPILER=clang++-${CLANG_VERSION}
+ addons: *clang
+
+ - env: BUILD_TYPE=Release CC_COMPILER=gcc-${GCC_VERSION} CXX_COMPILER=g++-${GCC_VERSION}
+ addons: &gcc
+ apt:
+ packages:
+ - *common_packages
+ - g++-7
+ - gcc-7
+ sources:
+ - *common_sources
+
+install:
+ - mkdir -p deps && cd deps
+ - travis_retry wget --no-check-certificate --quiet -O - https://cmake.org/files/v3.7/cmake-3.7.1-Linux-x86_64.tar.gz | tar --strip-components=1 -xz
+ - export PATH=${TRAVIS_BUILD_DIR}/deps/bin:${PATH}
+ - cd -
+
+before_script:
+ - travis_retry wget --quiet -O - https://raw.githubusercontent.com/cpplint/cpplint/master/cpplint.py | python - --recursive src examples
+ - mkdir -p build && cd build
+ - rm -rf *
+ - cmake .. -GNinja -DLIB_PROTO_MUTATOR_WITH_ASAN=ON -DLIB_PROTO_MUTATOR_DOWNLOAD_PROTOBUF=ON -DCMAKE_C_COMPILER=${CC_COMPILER} -DCMAKE_CXX_COMPILER=${CXX_COMPILER} -DCMAKE_BUILD_TYPE=${BUILD_TYPE} -DLIB_PROTO_MUTATOR_CTEST_JOBS=8
+
+script:
+ - export ASAN_OPTIONS=detect_leaks=0
+ - ninja
+ - ninja check
diff --git a/AUTHORS b/AUTHORS
new file mode 100644
index 0000000..5ee9017
--- /dev/null
+++ b/AUTHORS
@@ -0,0 +1,8 @@
+# This is the official list of the fuzzer-test-suite project authors for copyright purposes.
+# This file is distinct from the CONTRIBUTORS file. See the latter for an explanation.
+
+# Names should be added to this file as
+# Name or Organization
+# Email addresses for individuals are tracked elsewhere to avoid spam.
+
+Google Inc.
diff --git a/CMakeLists.txt b/CMakeLists.txt
new file mode 100644
index 0000000..c018d45
--- /dev/null
+++ b/CMakeLists.txt
@@ -0,0 +1,129 @@
+# Copyright 2016 Google Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+cmake_minimum_required(VERSION 3.5)
+project(LibProtobufMutator CXX)
+
+enable_language(C)
+enable_language(CXX)
+
+option(LIB_PROTO_MUTATOR_DOWNLOAD_PROTOBUF
+ "Automatically download working protobuf" OFF)
+option(LIB_PROTO_MUTATOR_WITH_ASAN "Enable address sanitizer" OFF)
+set(LIB_PROTO_MUTATOR_FUZZER_LIBRARIES "" CACHE STRING "Fuzzing engine libs")
+
+# External dependencies
+set(CMAKE_MODULE_PATH ${PROJECT_SOURCE_DIR}/cmake/external)
+
+# External dependencies
+include(ProcessorCount)
+include(CheckCCompilerFlag)
+include(CheckCXXCompilerFlag)
+
+set(THREADS_PREFER_PTHREAD_FLAG ON)
+find_package(Threads)
+
+find_package(LibLZMA)
+include_directories(${LIBLZMA_INCLUDE_DIRS})
+
+find_package(ZLIB)
+include_directories(${ZLIB_INCLUDE_DIRS})
+
+set(CMAKE_CXX_STANDARD 11)
+
+include_directories(${PROJECT_SOURCE_DIR})
+
+set(CMAKE_REQUIRED_FLAGS "-fsanitize=address")
+check_cxx_compiler_flag(-fsanitize=address LIB_PROTO_MUTATOR_HAS_SANITIZE_ADDRESS)
+check_cxx_compiler_flag("-fsanitize=address -fsanitize-address-use-after-scope"
+ LIB_PROTO_MUTATOR_HAS_SANITIZE_SCOPE)
+unset(CMAKE_REQUIRED_FLAGS)
+
+set(CMAKE_REQUIRED_FLAGS "-fsanitize-coverage=0")
+check_cxx_compiler_flag(-fsanitize-coverage= LIB_PROTO_MUTATOR_HAS_NO_COVERAGE)
+unset(CMAKE_REQUIRED_FLAGS)
+
+set(CMAKE_REQUIRED_FLAGS "-fsanitize=fuzzer-no-link")
+check_cxx_compiler_flag(-fsanitize=fuzzer-no-link LIB_PROTO_MUTATOR_HAS_SANITIZE_FUZZER)
+unset(CMAKE_REQUIRED_FLAGS)
+
+set(CMAKE_REQUIRED_FLAGS "-fno-sanitize=fuzzer")
+check_cxx_compiler_flag(-fno-sanitize=fuzzer LIB_PROTO_MUTATOR_HAS_NO_SANITIZE_FUZZER)
+unset(CMAKE_REQUIRED_FLAGS)
+
+check_cxx_compiler_flag(-Wstring-conversion LIB_PROTO_MUTATOR_HAS_WSTRING_CONVERSION)
+
+set(EXTRA_FLAGS "-fno-exceptions -Werror -Wall")
+if (LIB_PROTO_MUTATOR_HAS_WSTRING_CONVERSION)
+ set(EXTRA_FLAGS "${EXTRA_FLAGS} -Wstring-conversion")
+endif()
+
+if (LIB_PROTO_MUTATOR_WITH_ASAN)
+ if (LIB_PROTO_MUTATOR_HAS_SANITIZE_ADDRESS)
+ set(EXTRA_FLAGS "${EXTRA_FLAGS} -fsanitize=address")
+ if (LIB_PROTO_MUTATOR_HAS_SANITIZE_SCOPE)
+ set(EXTRA_FLAGS "${EXTRA_FLAGS} -fsanitize-address-use-after-scope")
+ endif()
+ endif()
+endif()
+
+# Assume CFLAGS has coverage options if LIB_PROTO_MUTATOR_FUZZER_LIBRARIES was set
+if ("${LIB_PROTO_MUTATOR_FUZZER_LIBRARIES}" STREQUAL "")
+ if (LIB_PROTO_MUTATOR_HAS_SANITIZE_FUZZER)
+ set(FUZZING_FLAGS "-fsanitize=fuzzer-no-link")
+ set(FUZZING_FLAGS_BINARY "-fsanitize=fuzzer")
+ endif()
+ if (LIB_PROTO_MUTATOR_HAS_SANITIZE_NO_FUZZER)
+ set(NO_FUZZING_FLAGS "-fno-sanitize=fuzzer")
+ endif()
+endif()
+if (LIB_PROTO_MUTATOR_HAS_NO_COVERAGE)
+ set(NO_FUZZING_FLAGS "${NO_FUZZING_FLAGS} -fsanitize-coverage=0")
+endif()
+
+set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${EXTRA_FLAGS}")
+set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${EXTRA_FLAGS}")
+
+set(PROTOBUF_CFLAGS "${CMAKE_C_FLAGS} ${NO_FUZZING_FLAGS} -w")
+set(PROTOBUF_CXXFLAGS "${CMAKE_CXX_FLAGS} ${NO_FUZZING_FLAGS} -w")
+if(CMAKE_USE_PTHREADS_INIT)
+ set(PROTOBUF_CFLAGS "${PROTOBUF_CFLAGS} -pthread")
+ set(PROTOBUF_CXXFLAGS "${PROTOBUF_CXXFLAGS} -pthread")
+endif()
+
+if (LIB_PROTO_MUTATOR_DOWNLOAD_PROTOBUF)
+ include(protobuf)
+else()
+ find_package(Protobuf REQUIRED)
+ include_directories(${PROTOBUF_INCLUDE_DIRS})
+ include_directories(${CMAKE_CURRENT_BINARY_DIR})
+endif()
+
+enable_testing()
+
+include(googletest)
+
+if (NOT LIB_PROTO_MUTATOR_CTEST_JOBS)
+ ProcessorCount(LIB_PROTO_MUTATOR_CTEST_JOBS)
+endif()
+add_custom_target(check
+ COMMAND ${CMAKE_CTEST_COMMAND} -j${LIB_PROTO_MUTATOR_CTEST_JOBS} --output-on-failure)
+
+add_subdirectory(src)
+
+if (NOT "${LIB_PROTO_MUTATOR_FUZZER_LIBRARIES}" STREQUAL "" OR
+ NOT "${FUZZING_FLAGS}" STREQUAL "")
+ add_subdirectory(examples EXCLUDE_FROM_ALL)
+endif()
+
diff --git a/CONTRIBUTING b/CONTRIBUTING
new file mode 100644
index 0000000..1a09deb
--- /dev/null
+++ b/CONTRIBUTING
@@ -0,0 +1,27 @@
+Want to contribute? Great! First, read this page (including the small print at the end).
+
+### Before you contribute
+Before we can use your code, you must sign the
+[Google Individual Contributor License Agreement]
+(https://cla.developers.google.com/about/google-individual)
+(CLA), which you can do online. The CLA is necessary mainly because you own the
+copyright to your changes, even after your contribution becomes part of our
+codebase, so we need your permission to use and distribute your code. We also
+need to be sure of various other things—for instance that you'll tell us if you
+know that your code infringes on other people's patents. You don't have to sign
+the CLA until after you've submitted your code for review and a member has
+approved it, but you must do it before we can put your code into our codebase.
+Before you start working on a larger contribution, you should get in touch with
+us first through the issue tracker with your idea so that we can help out and
+possibly guide you. Coordinating up front makes it much easier to avoid
+frustration later on.
+
+### Code reviews
+All submissions, including submissions by project members, require review. We
+use GitHub pull requests for this purpose.
+
+### The small print
+Contributions made by corporations are covered by a different agreement than
+the one above, the
+[Software Grant and Corporate Contributor License Agreement]
+(https://cla.developers.google.com/about/google-corporate).
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..d645695
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,202 @@
+
+ Apache License
+ Version 2.0, January 2004
+ http://www.apache.org/licenses/
+
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+ 1. Definitions.
+
+ "License" shall mean the terms and conditions for use, reproduction,
+ and distribution as defined by Sections 1 through 9 of this document.
+
+ "Licensor" shall mean the copyright owner or entity authorized by
+ the copyright owner that is granting the License.
+
+ "Legal Entity" shall mean the union of the acting entity and all
+ other entities that control, are controlled by, or are under common
+ control with that entity. For the purposes of this definition,
+ "control" means (i) the power, direct or indirect, to cause the
+ direction or management of such entity, whether by contract or
+ otherwise, or (ii) ownership of fifty percent (50%) or more of the
+ outstanding shares, or (iii) beneficial ownership of such entity.
+
+ "You" (or "Your") shall mean an individual or Legal Entity
+ exercising permissions granted by this License.
+
+ "Source" form shall mean the preferred form for making modifications,
+ including but not limited to software source code, documentation
+ source, and configuration files.
+
+ "Object" form shall mean any form resulting from mechanical
+ transformation or translation of a Source form, including but
+ not limited to compiled object code, generated documentation,
+ and conversions to other media types.
+
+ "Work" shall mean the work of authorship, whether in Source or
+ Object form, made available under the License, as indicated by a
+ copyright notice that is included in or attached to the work
+ (an example is provided in the Appendix below).
+
+ "Derivative Works" shall mean any work, whether in Source or Object
+ form, that is based on (or derived from) the Work and for which the
+ editorial revisions, annotations, elaborations, or other modifications
+ represent, as a whole, an original work of authorship. For the purposes
+ of this License, Derivative Works shall not include works that remain
+ separable from, or merely link (or bind by name) to the interfaces of,
+ the Work and Derivative Works thereof.
+
+ "Contribution" shall mean any work of authorship, including
+ the original version of the Work and any modifications or additions
+ to that Work or Derivative Works thereof, that is intentionally
+ submitted to Licensor for inclusion in the Work by the copyright owner
+ or by an individual or Legal Entity authorized to submit on behalf of
+ the copyright owner. For the purposes of this definition, "submitted"
+ means any form of electronic, verbal, or written communication sent
+ to the Licensor or its representatives, including but not limited to
+ communication on electronic mailing lists, source code control systems,
+ and issue tracking systems that are managed by, or on behalf of, the
+ Licensor for the purpose of discussing and improving the Work, but
+ excluding communication that is conspicuously marked or otherwise
+ designated in writing by the copyright owner as "Not a Contribution."
+
+ "Contributor" shall mean Licensor and any individual or Legal Entity
+ on behalf of whom a Contribution has been received by Licensor and
+ subsequently incorporated within the Work.
+
+ 2. Grant of Copyright License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ copyright license to reproduce, prepare Derivative Works of,
+ publicly display, publicly perform, sublicense, and distribute the
+ Work and such Derivative Works in Source or Object form.
+
+ 3. Grant of Patent License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ (except as stated in this section) patent license to make, have made,
+ use, offer to sell, sell, import, and otherwise transfer the Work,
+ where such license applies only to those patent claims licensable
+ by such Contributor that are necessarily infringed by their
+ Contribution(s) alone or by combination of their Contribution(s)
+ with the Work to which such Contribution(s) was submitted. If You
+ institute patent litigation against any entity (including a
+ cross-claim or counterclaim in a lawsuit) alleging that the Work
+ or a Contribution incorporated within the Work constitutes direct
+ or contributory patent infringement, then any patent licenses
+ granted to You under this License for that Work shall terminate
+ as of the date such litigation is filed.
+
+ 4. Redistribution. You may reproduce and distribute copies of the
+ Work or Derivative Works thereof in any medium, with or without
+ modifications, and in Source or Object form, provided that You
+ meet the following conditions:
+
+ (a) You must give any other recipients of the Work or
+ Derivative Works a copy of this License; and
+
+ (b) You must cause any modified files to carry prominent notices
+ stating that You changed the files; and
+
+ (c) You must retain, in the Source form of any Derivative Works
+ that You distribute, all copyright, patent, trademark, and
+ attribution notices from the Source form of the Work,
+ excluding those notices that do not pertain to any part of
+ the Derivative Works; and
+
+ (d) If the Work includes a "NOTICE" text file as part of its
+ distribution, then any Derivative Works that You distribute must
+ include a readable copy of the attribution notices contained
+ within such NOTICE file, excluding those notices that do not
+ pertain to any part of the Derivative Works, in at least one
+ of the following places: within a NOTICE text file distributed
+ as part of the Derivative Works; within the Source form or
+ documentation, if provided along with the Derivative Works; or,
+ within a display generated by the Derivative Works, if and
+ wherever such third-party notices normally appear. The contents
+ of the NOTICE file are for informational purposes only and
+ do not modify the License. You may add Your own attribution
+ notices within Derivative Works that You distribute, alongside
+ or as an addendum to the NOTICE text from the Work, provided
+ that such additional attribution notices cannot be construed
+ as modifying the License.
+
+ You may add Your own copyright statement to Your modifications and
+ may provide additional or different license terms and conditions
+ for use, reproduction, or distribution of Your modifications, or
+ for any such Derivative Works as a whole, provided Your use,
+ reproduction, and distribution of the Work otherwise complies with
+ the conditions stated in this License.
+
+ 5. Submission of Contributions. Unless You explicitly state otherwise,
+ any Contribution intentionally submitted for inclusion in the Work
+ by You to the Licensor shall be under the terms and conditions of
+ this License, without any additional terms or conditions.
+ Notwithstanding the above, nothing herein shall supersede or modify
+ the terms of any separate license agreement you may have executed
+ with Licensor regarding such Contributions.
+
+ 6. Trademarks. This License does not grant permission to use the trade
+ names, trademarks, service marks, or product names of the Licensor,
+ except as required for reasonable and customary use in describing the
+ origin of the Work and reproducing the content of the NOTICE file.
+
+ 7. Disclaimer of Warranty. Unless required by applicable law or
+ agreed to in writing, Licensor provides the Work (and each
+ Contributor provides its Contributions) on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ implied, including, without limitation, any warranties or conditions
+ of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+ PARTICULAR PURPOSE. You are solely responsible for determining the
+ appropriateness of using or redistributing the Work and assume any
+ risks associated with Your exercise of permissions under this License.
+
+ 8. Limitation of Liability. In no event and under no legal theory,
+ whether in tort (including negligence), contract, or otherwise,
+ unless required by applicable law (such as deliberate and grossly
+ negligent acts) or agreed to in writing, shall any Contributor be
+ liable to You for damages, including any direct, indirect, special,
+ incidental, or consequential damages of any character arising as a
+ result of this License or out of the use or inability to use the
+ Work (including but not limited to damages for loss of goodwill,
+ work stoppage, computer failure or malfunction, or any and all
+ other commercial damages or losses), even if such Contributor
+ has been advised of the possibility of such damages.
+
+ 9. Accepting Warranty or Additional Liability. While redistributing
+ the Work or Derivative Works thereof, You may choose to offer,
+ and charge a fee for, acceptance of support, warranty, indemnity,
+ or other liability obligations and/or rights consistent with this
+ License. However, in accepting such obligations, You may act only
+ on Your own behalf and on Your sole responsibility, not on behalf
+ of any other Contributor, and only if You agree to indemnify,
+ defend, and hold each Contributor harmless for any liability
+ incurred by, or claims asserted against, such Contributor by reason
+ of your accepting any such warranty or additional liability.
+
+ END OF TERMS AND CONDITIONS
+
+ APPENDIX: How to apply the Apache License to your work.
+
+ To apply the Apache License to your work, attach the following
+ boilerplate notice, with the fields enclosed by brackets "[]"
+ replaced with your own identifying information. (Don't include
+ the brackets!) The text should be enclosed in the appropriate
+ comment syntax for the file format. We also recommend that a
+ file or class name and description of purpose be included on the
+ same "printed page" as the copyright notice for easier
+ identification within third-party archives.
+
+ Copyright [yyyy] [name of copyright owner]
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..1470339
--- /dev/null
+++ b/README.md
@@ -0,0 +1,82 @@
+# libprotobuf-mutator
+
+## Overview
+libprotobuf-mutator is a library to randomly mutate
+[protobuffers](https://github.com/google/protobuf). <BR>
+It could be used together with guided
+fuzzing engines, such as [libFuzzer](http://libfuzzer.info).
+
+## Quick start on Debian/Ubuntu
+
+Install prerequisites:
+
+```
+sudo apt-get update
+sudo apt-get install binutils cmake ninja-build liblzma-dev libz-dev pkg-config
+```
+
+Compile and test everything:
+
+```
+mkdir build
+cd build
+cmake .. -GNinja -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ -DCMAKE_BUILD_TYPE=Debug
+ninja check
+```
+
+Clang is only needed for libFuzzer integration. <BR>
+By default, the system-installed version of
+[protobuf](https://github.com/google/protobuf) is used. However, on some
+systems, the system version is too old. You can pass
+`LIB_PROTO_MUTATOR_DOWNLOAD_PROTOBUF=ON` to cmake to automatically download and
+build a working version of protobuf.
+
+## Usage
+
+To use libprotobuf-mutator simply include
+[mutator.h](/src/mutator.h) and
+[mutator.cc](/src/mutator.cc) into your build files.
+
+The `ProtobufMutator` class implements mutations of the protobuf
+tree structure and mutations of individual fields.
+The field mutation logic is very basic --
+for better results you should override the `ProtobufMutator::Mutate*`
+methods with more sophisticated logic, e.g.
+using [libFuzzer](http://libfuzzer.info)'s mutators.
+
+To apply one mutation to a protobuf object do the following:
+
+```
+class MyProtobufMutator : public protobuf_mutator::Mutator {
+ public:
+ MyProtobufMutator(uint32_t seed) : protobuf_mutator::Mutator(seed) {}
+ // Optionally redefine the Mutate* methods to perform more sophisticated mutations.
+}
+void Mutate(MyMessage* message) {
+ MyProtobufMutator mutator(my_random_seed);
+ mutator.Mutate(message, 200);
+}
+```
+
+See also the `ProtobufMutatorMessagesTest.UsageExample` test from
+[mutator_test.cc](/src/mutator_test.cc).
+
+## Integrating with libFuzzer
+LibFuzzerProtobufMutator can help to integrate with libFuzzer. For example
+
+```
+#include "src/libfuzzer/libfuzzer_macro.h"
+
+DEFINE_PROTO_FUZZER(const MyMessageType& input) {
+ // Code which needs to be fuzzed.
+ ConsumeMyMessageType(input);
+}
+```
+
+Please see [libfuzzer_example.cc](/examples/libfuzzer/libfuzzer_example.cc) as an example.
+
+## UTF-8 strings
+"proto2" and "proto3" handle invalid UTF-8 strings differently. In both cases
+string should be UTF-8, however only "proto3" enforces that. So if fuzzer is
+applied to "proto2" type libprotobuf-mutator will generate any strings including
+invalid UTF-8. If it's a "proto3" message type, only valid UTF-8 will be used.
diff --git a/cmake/external/expat.cmake b/cmake/external/expat.cmake
new file mode 100644
index 0000000..6bb1769
--- /dev/null
+++ b/cmake/external/expat.cmake
@@ -0,0 +1,49 @@
+# Copyright 2017 Google Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set(EXPAT_TARGET external.expat)
+set(EXPAT_INSTALL_DIR ${CMAKE_CURRENT_BINARY_DIR}/${EXPAT_TARGET})
+set(EXPAT_SRC_DIR ${EXPAT_INSTALL_DIR}/src/${EXPAT_TARGET}/expat)
+
+set(EXPAT_INCLUDE_DIRS ${EXPAT_INSTALL_DIR}/include/)
+include_directories(${EXPAT_INCLUDE_DIRS})
+
+list(APPEND EXPAT_LIBRARIES expat)
+
+foreach(lib IN LISTS EXPAT_LIBRARIES)
+ list(APPEND EXPAT_BUILD_BYPRODUCTS ${EXPAT_INSTALL_DIR}/lib/lib${lib}.a)
+
+ add_library(${lib} STATIC IMPORTED)
+ set_property(TARGET ${lib} PROPERTY IMPORTED_LOCATION
+ ${EXPAT_INSTALL_DIR}/lib/lib${lib}.a)
+ add_dependencies(${lib} ${EXPAT_TARGET})
+endforeach(lib)
+
+include (ExternalProject)
+ExternalProject_Add(${EXPAT_TARGET}
+ PREFIX ${EXPAT_TARGET}
+ GIT_REPOSITORY https://github.com/libexpat/libexpat
+ GIT_TAG master
+ UPDATE_COMMAND ""
+ CONFIGURE_COMMAND cd ${EXPAT_SRC_DIR} && ./buildconf.sh && ./configure
+ --prefix=${EXPAT_INSTALL_DIR}
+ --without-xmlwf
+ CC=${CMAKE_C_COMPILER}
+ CXX=${CMAKE_CXX_COMPILER}
+ "CFLAGS=${EXPAT_CFLAGS} -w -DXML_POOR_ENTROPY"
+ "CXXFLAGS=${EXPAT_CXXFLAGS} -w -DXML_POOR_ENTROPY"
+ BUILD_COMMAND cd ${EXPAT_SRC_DIR} && make -j ${CPU_COUNT}
+ INSTALL_COMMAND cd ${EXPAT_SRC_DIR} && make install
+ BUILD_BYPRODUCTS ${EXPAT_BUILD_BYPRODUCTS}
+)
diff --git a/cmake/external/googletest.cmake b/cmake/external/googletest.cmake
new file mode 100644
index 0000000..1eec203
--- /dev/null
+++ b/cmake/external/googletest.cmake
@@ -0,0 +1,45 @@
+# Copyright 2016 Google Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set(GTEST_TARGET external.googletest)
+set(GTEST_INSTALL_DIR ${CMAKE_CURRENT_BINARY_DIR}/${GTEST_TARGET})
+
+set(GTEST_INCLUDE_DIRS ${GTEST_INSTALL_DIR}/include)
+include_directories(${GTEST_INCLUDE_DIRS})
+
+set(GTEST_LIBRARIES gtest)
+set(GTEST_MAIN_LIBRARIES gtest_main)
+set(GTEST_BOTH_LIBRARIES ${GTEST_LIBRARIES} ${GTEST_MAIN_LIBRARIES})
+
+foreach(lib IN LISTS GTEST_BOTH_LIBRARIES)
+ list(APPEND GTEST_BUILD_BYPRODUCTS ${GTEST_INSTALL_DIR}/lib/lib${lib}.a)
+
+ add_library(${lib} STATIC IMPORTED)
+ set_property(TARGET ${lib} PROPERTY IMPORTED_LOCATION
+ ${GTEST_INSTALL_DIR}/lib/lib${lib}.a)
+ add_dependencies(${lib} ${GTEST_TARGET})
+endforeach(lib)
+
+include (ExternalProject)
+ExternalProject_Add(${GTEST_TARGET}
+ PREFIX ${GTEST_TARGET}
+ GIT_REPOSITORY https://github.com/google/googletest.git
+ GIT_TAG 1b07766
+ UPDATE_COMMAND ""
+ CMAKE_CACHE_ARGS -DCMAKE_C_COMPILER:FILEPATH=${CMAKE_C_COMPILER}
+ -DCMAKE_CXX_COMPILER:FILEPATH=${CMAKE_CXX_COMPILER}
+ CMAKE_ARGS ${CMAKE_ARGS}
+ -DCMAKE_INSTALL_PREFIX=${GTEST_INSTALL_DIR}
+ BUILD_BYPRODUCTS ${GTEST_BUILD_BYPRODUCTS}
+)
diff --git a/cmake/external/libxml2.cmake b/cmake/external/libxml2.cmake
new file mode 100644
index 0000000..f31ac0e
--- /dev/null
+++ b/cmake/external/libxml2.cmake
@@ -0,0 +1,48 @@
+# Copyright 2017 Google Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set(LIBXML2_TARGET external.libxml2)
+set(LIBXML2_INSTALL_DIR ${CMAKE_CURRENT_BINARY_DIR}/${LIBXML2_TARGET})
+set(LIBXML2_SRC_DIR ${LIBXML2_INSTALL_DIR}/src/${LIBXML2_TARGET})
+
+set(LIBXML2_INCLUDE_DIRS ${LIBXML2_INSTALL_DIR}/include/libxml2)
+include_directories(${LIBXML2_INCLUDE_DIRS})
+
+list(APPEND LIBXML2_LIBRARIES xml2)
+
+foreach(lib IN LISTS LIBXML2_LIBRARIES)
+ list(APPEND LIBXML2_BUILD_BYPRODUCTS ${LIBXML2_INSTALL_DIR}/lib/lib${lib}.a)
+
+ add_library(${lib} STATIC IMPORTED)
+ set_property(TARGET ${lib} PROPERTY IMPORTED_LOCATION
+ ${LIBXML2_INSTALL_DIR}/lib/lib${lib}.a)
+ add_dependencies(${lib} ${LIBXML2_TARGET})
+endforeach(lib)
+
+include (ExternalProject)
+ExternalProject_Add(${LIBXML2_TARGET}
+ PREFIX ${LIBXML2_TARGET}
+ GIT_REPOSITORY https://github.com/GNOME/libxml2.git
+ GIT_TAG master
+ UPDATE_COMMAND ""
+ CONFIGURE_COMMAND ${LIBXML2_SRC_DIR}/autogen.sh --without-python
+ --prefix=${LIBXML2_INSTALL_DIR}
+ CC=${CMAKE_C_COMPILER}
+ CXX=${CMAKE_CXX_COMPILER}
+ CFLAGS=${LIBXML2_CFLAGS}
+ CXXFLAGS=${LIBXML2_CXXFLAGS}
+ BUILD_COMMAND make -j ${CPU_COUNT} all
+ INSTALL_COMMAND make install
+ BUILD_BYPRODUCTS ${LIBXML2_BUILD_BYPRODUCTS}
+)
diff --git a/cmake/external/protobuf.cmake b/cmake/external/protobuf.cmake
new file mode 100644
index 0000000..df79110
--- /dev/null
+++ b/cmake/external/protobuf.cmake
@@ -0,0 +1,68 @@
+# Copyright 2016 Google Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+include (FindProtobuf)
+
+set(PROTOBUF_TARGET external.protobuf)
+set(PROTOBUF_INSTALL_DIR ${CMAKE_CURRENT_BINARY_DIR}/${PROTOBUF_TARGET})
+
+set(PROTOBUF_INCLUDE_DIRS ${PROTOBUF_INSTALL_DIR}/include)
+include_directories(${PROTOBUF_INCLUDE_DIRS})
+include_directories(${CMAKE_CURRENT_BINARY_DIR})
+
+IF(CMAKE_BUILD_TYPE MATCHES Debug)
+ set(PROTOBUF_LIBRARIES protobufd)
+ELSE()
+ set(PROTOBUF_LIBRARIES protobuf)
+ENDIF()
+
+foreach(lib ${PROTOBUF_LIBRARIES})
+ list(APPEND PROTOBUF_BUILD_BYPRODUCTS ${PROTOBUF_INSTALL_DIR}/lib/lib${lib}.a)
+
+ add_library(${lib} STATIC IMPORTED)
+ set_property(TARGET ${lib} PROPERTY IMPORTED_LOCATION
+ ${PROTOBUF_INSTALL_DIR}/lib/lib${lib}.a)
+ add_dependencies(${lib} ${PROTOBUF_TARGET})
+endforeach(lib)
+
+set(PROTOBUF_PROTOC_EXECUTABLE ${PROTOBUF_INSTALL_DIR}/bin/protoc)
+list(APPEND PROTOBUF_BUILD_BYPRODUCTS ${PROTOBUF_PROTOC_EXECUTABLE})
+add_executable(protoc IMPORTED)
+set_property(TARGET protoc PROPERTY IMPORTED_LOCATION
+ ${PROTOBUF_PROTOC_EXECUTABLE})
+add_dependencies(protoc ${PROTOBUF_TARGET})
+
+include (ExternalProject)
+ExternalProject_Add(${PROTOBUF_TARGET}
+ PREFIX ${PROTOBUF_TARGET}
+ GIT_REPOSITORY https://github.com/google/protobuf.git
+ GIT_TAG 47b7d2c
+ UPDATE_COMMAND ""
+ CONFIGURE_COMMAND ${CMAKE_COMMAND} ${PROTOBUF_INSTALL_DIR}/src/${PROTOBUF_TARGET}/cmake
+ -G${CMAKE_GENERATOR}
+ -DCMAKE_INSTALL_PREFIX=${PROTOBUF_INSTALL_DIR}
+ -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}
+ -DCMAKE_POSITION_INDEPENDENT_CODE=ON
+ -DCMAKE_C_COMPILER:FILEPATH=${CMAKE_C_COMPILER}
+ -DCMAKE_CXX_COMPILER:FILEPATH=${CMAKE_CXX_COMPILER}
+ -DCMAKE_C_FLAGS=${PROTOBUF_CFLAGS}
+ -DCMAKE_CXX_FLAGS=${PROTOBUF_CXXFLAGS}
+ -Dprotobuf_BUILD_TESTS=OFF
+ BUILD_BYPRODUCTS ${PROTOBUF_BUILD_BYPRODUCTS}
+)
+
+# cmake 3.7 uses Protobuf_ when 3.5 PROTOBUF_ prefixes.
+set(Protobuf_INCLUDE_DIRS ${PROTOBUF_INCLUDE_DIRS})
+set(Protobuf_LIBRARIES ${PROTOBUF_LIBRARIES})
+set(Protobuf_PROTOC_EXECUTABLE ${PROTOBUF_PROTOC_EXECUTABLE})
diff --git a/examples/CMakeLists.txt b/examples/CMakeLists.txt
new file mode 100644
index 0000000..d932aed
--- /dev/null
+++ b/examples/CMakeLists.txt
@@ -0,0 +1,18 @@
+# Copyright 2017 Google Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+add_subdirectory(xml)
+add_subdirectory(expat)
+add_subdirectory(libfuzzer)
+add_subdirectory(libxml2)
diff --git a/examples/expat/CMakeLists.txt b/examples/expat/CMakeLists.txt
new file mode 100644
index 0000000..f2031f5
--- /dev/null
+++ b/examples/expat/CMakeLists.txt
@@ -0,0 +1,37 @@
+# Copyright 2017 Google Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set(EXPAT_CFLAGS "${CMAKE_C_FLAGS} ${FUZZING_FLAGS}")
+set(EXPAT_CXXFLAGS "${CMAKE_CXX_FLAGS} ${FUZZING_FLAGS}")
+include(expat)
+
+add_executable(expat_example
+ expat_example.cc)
+target_link_libraries(expat_example
+ protobuf-mutator-xml
+ ${LIB_PROTO_MUTATOR_FUZZER_LIBRARIES}
+ ${EXPAT_LIBRARIES})
+set_property(TARGET expat_example
+ PROPERTY COMPILE_FLAGS ${FUZZING_FLAGS})
+set_property(TARGET expat_example
+ PROPERTY LINK_FLAGS ${FUZZING_FLAGS_BINARY})
+
+add_executable(expat_example_test
+ expat_example_test.cc)
+add_dependencies(expat_example_test expat_example)
+target_link_libraries(expat_example_test
+ ${GTEST_BOTH_LIBRARIES}
+ ${CMAKE_THREAD_LIBS_INIT})
+add_test(test.expat_example_test expat_example_test --gtest_color=yes AUTO)
+add_dependencies(check expat_example_test)
diff --git a/examples/expat/expat_example.cc b/examples/expat/expat_example.cc
new file mode 100644
index 0000000..97911f3
--- /dev/null
+++ b/examples/expat/expat_example.cc
@@ -0,0 +1,41 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <vector>
+
+#include "expat.h" // NOLINT
+
+#include "examples/xml/xml.pb.h"
+#include "examples/xml/xml_writer.h"
+#include "src/libfuzzer/libfuzzer_macro.h"
+
+namespace {
+protobuf_mutator::protobuf::LogSilencer log_silincer;
+std::vector<const char*> kEncodings = {{"UTF-16", "UTF-8", "ISO-8859-1",
+ "US-ASCII", "UTF-16BE", "UTF-16LE",
+ "INVALIDENCODING"}};
+}
+
+DEFINE_PROTO_FUZZER(const protobuf_mutator::xml::Input& message) {
+ std::string xml = MessageToXml(message.document());
+ int options = message.options();
+
+ int use_ns = options % 2;
+ options /= 2;
+ auto enc = kEncodings[options % kEncodings.size()];
+ XML_Parser parser =
+ use_ns ? XML_ParserCreateNS(enc, '\n') : XML_ParserCreate(enc);
+ XML_Parse(parser, xml.data(), xml.size(), true);
+ XML_ParserFree(parser);
+}
diff --git a/examples/expat/expat_example_test.cc b/examples/expat/expat_example_test.cc
new file mode 100644
index 0000000..60f1191
--- /dev/null
+++ b/examples/expat/expat_example_test.cc
@@ -0,0 +1,30 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "port/gtest.h"
+
+#include "examples/fuzzer_test.h"
+
+using testing::Test;
+
+namespace {
+
+class ExpatExampleTest : public FuzzerTest {};
+
+TEST_F(ExpatExampleTest, Fuzz) {
+ EXPECT_EQ(0, RunFuzzer("expat_example", 500, 10000));
+ EXPECT_GT(CountFilesInDir(), 50);
+}
+
+} // namespace
diff --git a/examples/fuzzer_test.h b/examples/fuzzer_test.h
new file mode 100644
index 0000000..ace1410
--- /dev/null
+++ b/examples/fuzzer_test.h
@@ -0,0 +1,68 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef EXAMPLES_FUZZER_TEST_H_
+#define EXAMPLES_FUZZER_TEST_H_
+
+#include <dirent.h>
+#include <memory>
+#include <string>
+
+#include "port/gtest.h"
+
+using testing::Test;
+
+class FuzzerTest : public testing::Test {
+ protected:
+ void SetUp() override {
+ char dir_template[] = "/tmp/libxml2_example_test_XXXXXX";
+ auto dir = mkdtemp(dir_template);
+ ASSERT_TRUE(dir);
+ dir_ = std::string(dir) + "/";
+ EXPECT_EQ(0, CountFilesInDir());
+ }
+
+ void TearDown() override {
+ EXPECT_EQ(0, std::system((std::string("rm -rf ") + dir_).c_str()));
+ }
+
+ int RunFuzzer(const std::string& name, int max_len, int runs) {
+ std::string cmd = "ASAN_OPTIONS=detect_leaks=0 ./" + name;
+ cmd += " -detect_leaks=0";
+ cmd += " -len_control=0";
+ cmd += " -max_len=" + std::to_string(max_len);
+ cmd += " -runs=" + std::to_string(runs);
+ cmd += " -artifact_prefix=" + dir_;
+ cmd += " " + dir_;
+ fprintf(stderr, "%s \n", cmd.c_str());
+ return std::system(cmd.c_str());
+ }
+
+ size_t CountFilesInDir() const {
+ size_t res = 0;
+ std::unique_ptr<DIR, decltype(&closedir)> dir(opendir(dir_.c_str()),
+ &closedir);
+ if (!dir) return 0;
+ while (readdir(dir.get())) {
+ ++res;
+ }
+ if (res <= 2) return 0;
+ res -= 2; // . and ..
+ return res;
+ }
+
+ std::string dir_;
+};
+
+#endif // EXAMPLES_FUZZER_TEST_H_
diff --git a/examples/libfuzzer/CMakeLists.txt b/examples/libfuzzer/CMakeLists.txt
new file mode 100644
index 0000000..dc39177
--- /dev/null
+++ b/examples/libfuzzer/CMakeLists.txt
@@ -0,0 +1,43 @@
+# Copyright 2017 Google Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+add_executable(libfuzzer_example_test
+ libfuzzer_example_test.cc)
+target_link_libraries(libfuzzer_example_test
+ ${GTEST_BOTH_LIBRARIES}
+ ${CMAKE_THREAD_LIBS_INIT})
+add_test(test.libfuzzer_example_test libfuzzer_example_test --gtest_color=yes AUTO)
+add_dependencies(check libfuzzer_example_test)
+
+protobuf_generate_cpp(LIB_FUZZER_EXAMPLE_PROTO_SRCS
+ LIB_FUZZER_EXAMPLE_PROTO_HDRS
+ libfuzzer_example.proto)
+
+add_library(fuzzer-example-proto
+ ${LIB_FUZZER_EXAMPLE_PROTO_SRCS})
+set_property(TARGET fuzzer-example-proto
+ PROPERTY COMPILE_FLAGS ${NO_FUZZING_FLAGS})
+
+foreach(fuzzer libfuzzer_example libfuzzer_bin_example)
+ add_executable(${fuzzer} ${fuzzer}.cc)
+ target_link_libraries(${fuzzer}
+ fuzzer-example-proto
+ protobuf-mutator-libfuzzer
+ ${LIB_PROTO_MUTATOR_FUZZER_LIBRARIES})
+ set_property(TARGET ${fuzzer}
+ PROPERTY COMPILE_FLAGS ${FUZZING_FLAGS})
+ set_property(TARGET ${fuzzer}
+ PROPERTY LINK_FLAGS ${FUZZING_FLAGS_BINARY})
+ add_dependencies(libfuzzer_example_test ${fuzzer})
+endforeach(fuzzer)
diff --git a/examples/libfuzzer/libfuzzer_bin_example.cc b/examples/libfuzzer/libfuzzer_bin_example.cc
new file mode 100644
index 0000000..80c5cef
--- /dev/null
+++ b/examples/libfuzzer/libfuzzer_bin_example.cc
@@ -0,0 +1,31 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <cmath>
+
+#include "examples/libfuzzer/libfuzzer_example.pb.h"
+#include "src/libfuzzer/libfuzzer_macro.h"
+
+protobuf_mutator::protobuf::LogSilencer log_silincer;
+
+DEFINE_BINARY_PROTO_FUZZER(const libfuzzer_example::Msg& message) {
+ // Emulate a bug.
+ if (message.optional_string() == "FooBar" &&
+ message.optional_uint64() > 100 &&
+ !std::isnan(message.optional_float()) &&
+ std::fabs(message.optional_float()) > 1000 &&
+ std::fabs(message.optional_float()) < 1E10) {
+ abort();
+ }
+}
diff --git a/examples/libfuzzer/libfuzzer_example.cc b/examples/libfuzzer/libfuzzer_example.cc
new file mode 100644
index 0000000..68bd718
--- /dev/null
+++ b/examples/libfuzzer/libfuzzer_example.cc
@@ -0,0 +1,31 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <cmath>
+
+#include "examples/libfuzzer/libfuzzer_example.pb.h"
+#include "src/libfuzzer/libfuzzer_macro.h"
+
+protobuf_mutator::protobuf::LogSilencer log_silincer;
+
+DEFINE_PROTO_FUZZER(const libfuzzer_example::Msg& message) {
+ // Emulate a bug.
+ if (message.optional_string() == "FooBar" &&
+ message.optional_uint64() > 100 &&
+ !std::isnan(message.optional_float()) &&
+ std::fabs(message.optional_float()) > 1000 &&
+ std::fabs(message.optional_float()) < 1E10) {
+ abort();
+ }
+}
diff --git a/examples/libfuzzer/libfuzzer_example.proto b/examples/libfuzzer/libfuzzer_example.proto
new file mode 100644
index 0000000..71e5fc9
--- /dev/null
+++ b/examples/libfuzzer/libfuzzer_example.proto
@@ -0,0 +1,8 @@
+syntax = "proto2";
+package libfuzzer_example;
+
+message Msg {
+ optional float optional_float = 1;
+ optional uint64 optional_uint64 = 2;
+ optional string optional_string = 3;
+}
diff --git a/examples/libfuzzer/libfuzzer_example_test.cc b/examples/libfuzzer/libfuzzer_example_test.cc
new file mode 100644
index 0000000..e871d59
--- /dev/null
+++ b/examples/libfuzzer/libfuzzer_example_test.cc
@@ -0,0 +1,36 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "examples/fuzzer_test.h"
+#include "port/gtest.h"
+
+namespace {
+
+const int kDefaultLibFuzzerError = 77;
+
+class LibFuzzerExampleTest : public FuzzerTest {};
+
+int GetError(int exit_code) { return WSTOPSIG(exit_code); }
+
+TEST_F(LibFuzzerExampleTest, Text) {
+ EXPECT_EQ(kDefaultLibFuzzerError,
+ GetError(RunFuzzer("libfuzzer_example", 150, 10000000)));
+}
+
+TEST_F(LibFuzzerExampleTest, Binary) {
+ EXPECT_EQ(kDefaultLibFuzzerError,
+ GetError(RunFuzzer("libfuzzer_bin_example", 150, 10000000)));
+}
+
+} // namespace
diff --git a/examples/libxml2/CMakeLists.txt b/examples/libxml2/CMakeLists.txt
new file mode 100644
index 0000000..cf9f8a2
--- /dev/null
+++ b/examples/libxml2/CMakeLists.txt
@@ -0,0 +1,38 @@
+# Copyright 2017 Google Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set(LIBXML2_CFLAGS "${CMAKE_C_FLAGS} ${FUZZING_FLAGS} -w")
+set(LIBXML2_CXXFLAGS "${CMAKE_CXX_FLAGS} ${FUZZING_FLAGS} -w")
+include(libxml2)
+add_executable(libxml2_example
+ libxml2_example.cc)
+target_link_libraries(libxml2_example
+ protobuf-mutator-xml
+ ${LIB_PROTO_MUTATOR_FUZZER_LIBRARIES}
+ ${LIBXML2_LIBRARIES}
+ ${ZLIB_LIBRARIES}
+ ${LIBLZMA_LIBRARIES})
+set_property(TARGET libxml2_example
+ PROPERTY COMPILE_FLAGS ${FUZZING_FLAGS})
+set_property(TARGET libxml2_example
+ PROPERTY LINK_FLAGS ${FUZZING_FLAGS_BINARY})
+
+add_executable(libxml2_example_test
+ libxml2_example_test.cc)
+add_dependencies(libxml2_example_test libxml2_example)
+target_link_libraries(libxml2_example_test
+ ${GTEST_BOTH_LIBRARIES}
+ ${CMAKE_THREAD_LIBS_INIT})
+add_test(test.libxml2_example_test libxml2_example_test --gtest_color=yes AUTO)
+add_dependencies(check libxml2_example_test)
diff --git a/examples/libxml2/libxml2_example.cc b/examples/libxml2/libxml2_example.cc
new file mode 100644
index 0000000..9cbd442
--- /dev/null
+++ b/examples/libxml2/libxml2_example.cc
@@ -0,0 +1,53 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "libxml/parser.h"
+#include "libxml/xmlsave.h"
+
+#include "examples/xml/xml.pb.h"
+#include "examples/xml/xml_writer.h"
+#include "src/libfuzzer/libfuzzer_macro.h"
+
+namespace {
+protobuf_mutator::protobuf::LogSilencer log_silincer;
+void ignore(void* ctx, const char* msg, ...) {}
+
+template <class T, class D>
+std::unique_ptr<T, D> MakeUnique(T* obj, D del) {
+ return {obj, del};
+}
+}
+
+DEFINE_PROTO_FUZZER(const protobuf_mutator::xml::Input& message) {
+ std::string xml = MessageToXml(message.document());
+ int options = message.options();
+
+ // Network requests are too slow.
+ options |= XML_PARSE_NONET;
+ // These flags can cause network or file access and hangs.
+ options &= ~(XML_PARSE_NOENT | XML_PARSE_HUGE | XML_PARSE_DTDVALID |
+ XML_PARSE_DTDLOAD | XML_PARSE_DTDATTR);
+
+ xmlSetGenericErrorFunc(nullptr, &ignore);
+
+ if (auto doc =
+ MakeUnique(xmlReadMemory(xml.c_str(), static_cast<int>(xml.size()),
+ "", nullptr, options),
+ &xmlFreeDoc)) {
+ auto buf = MakeUnique(xmlBufferCreate(), &xmlBufferFree);
+ auto ctxt =
+ MakeUnique(xmlSaveToBuffer(buf.get(), nullptr, 0), &xmlSaveClose);
+ xmlSaveDoc(ctxt.get(), doc.get());
+ }
+}
diff --git a/examples/libxml2/libxml2_example_test.cc b/examples/libxml2/libxml2_example_test.cc
new file mode 100644
index 0000000..54b3628
--- /dev/null
+++ b/examples/libxml2/libxml2_example_test.cc
@@ -0,0 +1,30 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "port/gtest.h"
+
+#include "examples/fuzzer_test.h"
+
+using testing::Test;
+
+namespace {
+
+class LibXml2ExampleTest : public FuzzerTest {};
+
+TEST_F(LibXml2ExampleTest, Fuzz) {
+ EXPECT_EQ(0, RunFuzzer("libxml2_example", 500, 10000));
+ EXPECT_GT(CountFilesInDir(), 100);
+}
+
+} // namespace
diff --git a/examples/xml/CMakeLists.txt b/examples/xml/CMakeLists.txt
new file mode 100644
index 0000000..b06d224
--- /dev/null
+++ b/examples/xml/CMakeLists.txt
@@ -0,0 +1,32 @@
+# Copyright 2017 Google Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Libraries
+protobuf_generate_cpp(XML_PROTO_SRCS
+ XML_PROTO_HDRS
+ xml.proto)
+
+add_library(protobuf-mutator-xml
+ xml_writer.cc
+ ${XML_PROTO_SRCS})
+target_link_libraries(protobuf-mutator-xml
+ protobuf-mutator-libfuzzer)
+set_property(TARGET protobuf-mutator-xml
+ PROPERTY COMPILE_FLAGS "${NO_FUZZING_FLAGS}")
+
+
+add_executable(xml_converter
+ xml_converter.cc)
+target_link_libraries(xml_converter
+ protobuf-mutator-xml)
diff --git a/examples/xml/xml.proto b/examples/xml/xml.proto
new file mode 100644
index 0000000..38903dc
--- /dev/null
+++ b/examples/xml/xml.proto
@@ -0,0 +1,92 @@
+syntax = "proto2";
+package protobuf_mutator.xml;
+
+// Simplified definition of XML formant according https://www.w3.org/TR/xml/
+// Not all features are implemented and some rules are flattened.
+
+// There are no required fields to allow backward compatibility with older
+// corpus.
+
+// document ::= prolog element Misc*
+// prolog ::= XMLDecl? Misc* (doctypedecl Misc*)?
+// XMLDecl ::= '<?xml' VersionInfo EncodingDecl? SDDecl? S? '?>'
+// doctypedecl ::=
+// '<!DOCTYPE' S Name (S ExternalID)? S? ('[' intSubset ']' S?)? '>'
+message Document {
+ // XMLDecl
+ optional string version = 1;
+ optional string encoding = 2;
+ optional bool standalone = 3;
+
+ repeated Misk misk1 = 4;
+ optional DoctypeDecl doctype = 5;
+ optional Element element = 6;
+ repeated Misk misk2 = 7;
+}
+
+message DoctypeDecl {
+ optional string name = 1;
+ optional string external_id = 2;
+ optional string int_subset = 3;
+ repeated Misk misk = 4;
+}
+
+message Misk {
+ oneof _ {
+ Pi pi = 1;
+ string comment = 2;
+ }
+}
+
+// element ::= EmptyElemTag | STag content ETag
+message Element {
+ optional Tag tag = 1;
+ // Use EmptyElemTag tag if missing, or STag and ETag otherwise.
+ repeated Content content = 2;
+}
+
+// EmptyElemTag ::= '<' Name (S Attribute)* S? '/>'
+// STag ::= '<' Name (S Attribute)* S? '>'
+// ETag ::= '</' Name S? '>'
+message Tag {
+ optional string name = 1;
+ repeated Attribute attribute = 2;
+}
+
+message Reference {
+ optional string name = 1;
+ optional bool entry = 2;
+}
+
+message Pi {
+ optional string target = 1;
+ optional string data = 2;
+}
+
+// content ::=
+// CharData? ((element | Reference | CDSect | PI | Comment) CharData?)*
+message Content {
+ oneof _ {
+ string char_data = 1;
+ Element element = 2;
+ Reference reference = 3;
+ string cdsect = 4;
+ Misk misk = 5;
+ }
+}
+
+// Attribute ::= Name Eq AttValue
+message Attribute {
+ optional string name = 1;
+ optional string value = 2;
+}
+
+message Input {
+ optional Document document = 1;
+
+ // Option will be sent into libxml2 parser.
+ // TODO(vitalybuka): Use proto extension. Options is libxml2 specific,
+ // other libs may need different data. At the moment mutator does not support
+ // extensions.
+ optional uint32 options = 2;
+}
diff --git a/examples/xml/xml_converter.cc b/examples/xml/xml_converter.cc
new file mode 100644
index 0000000..1c651b0
--- /dev/null
+++ b/examples/xml/xml_converter.cc
@@ -0,0 +1,128 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <getopt.h>
+
+#include <fstream>
+#include <iostream>
+
+#include "examples/xml/xml.pb.h"
+#include "examples/xml/xml_writer.h"
+#include "port/protobuf.h"
+#include "src/text_format.h"
+
+using protobuf_mutator::xml::Input;
+
+namespace {
+
+struct option const kLongOptions[] = {{"reverse", no_argument, NULL, 'r'},
+ {"verbose", no_argument, NULL, 'v'},
+ {"help", no_argument, NULL, 'h'},
+ {NULL, 0, NULL, 0}};
+
+void PrintUsage() {
+ std::cerr << "Usage: xml_converter [OPTION]... [INFILE [OUTFILE]]\n"
+ << "Converts between proto used by fuzzer and XML.\n\n"
+ << "\t-h, --help\tPrint this help\n"
+ << "\t-r, --reverse\tConverts from XML to proto\n"
+ << "\t-v, --verbose\tPrint input\n";
+}
+
+struct Options {
+ bool reverse = false;
+ bool verbose = false;
+ std::string in_file;
+ std::string out_file;
+};
+
+bool ParseOptions(int argc, char** argv, Options* options) {
+ int c = 0;
+ while ((c = getopt_long(argc, argv, "hrv", kLongOptions, nullptr)) != -1) {
+ switch (c) {
+ case 'v':
+ options->verbose = true;
+ break;
+ case 'r':
+ options->reverse = true;
+ break;
+ case 'h':
+ default:
+ return false;
+ }
+ }
+
+ int i = optind;
+ if (i < argc) options->in_file = argv[i++];
+ if (i < argc) options->out_file = argv[i++];
+ if (i != argc) return false;
+
+ return true;
+}
+
+} // namespace
+
+int main(int argc, char** argv) {
+ Options options;
+ if (!ParseOptions(argc, argv, &options)) {
+ PrintUsage();
+ return 1;
+ }
+
+ std::istream* cin = &std::cin;
+ std::ostream* cout = &std::cout;
+
+ std::ifstream in_file_stream;
+ if (!options.in_file.empty()) {
+ in_file_stream.open(options.in_file);
+ cin = &in_file_stream;
+ }
+
+ std::ofstream out_file_stream;
+ if (!options.out_file.empty()) {
+ out_file_stream.open(options.out_file);
+ cout = &out_file_stream;
+ }
+
+ std::string input;
+ std::vector<char> buff(1 << 20);
+ while (auto size = cin->readsome(buff.data(), buff.size())) {
+ input += std::string(buff.data(), size);
+ }
+ std::string output;
+
+ int ret = 0;
+
+ if (options.reverse) {
+ Input message;
+ message.mutable_document()->mutable_element()->add_content()->set_char_data(
+ input);
+ output = protobuf_mutator::SaveMessageAsText(message);
+ } else {
+ Input message;
+ bool is_proto = protobuf_mutator::ParseTextMessage(input.data(), &message);
+ output = MessageToXml(message.document());
+ if (!is_proto) {
+ ret = 2;
+ if (options.verbose) std::cerr << "Input is not proto\n";
+ }
+ }
+
+ if (options.verbose) {
+ std::cerr << input << "\n\n";
+ std::cerr.flush();
+ }
+ *cout << output;
+
+ return ret;
+}
diff --git a/examples/xml/xml_writer.cc b/examples/xml/xml_writer.cc
new file mode 100644
index 0000000..19df56c
--- /dev/null
+++ b/examples/xml/xml_writer.cc
@@ -0,0 +1,128 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "examples/xml/xml_writer.h"
+
+#include <algorithm>
+#include <sstream>
+
+#include "examples/xml/xml.pb.h"
+
+namespace protobuf_mutator {
+namespace xml {
+
+namespace {
+
+class XmlWriter {
+ public:
+ XmlWriter();
+ std::string ToXml(const Document& doc);
+
+ private:
+ void ToXml(const std::string& name, const std::string& value);
+ void ToXml(const Element& element);
+ void ToXml(const Content& content);
+ void ToXml(const Misk& misk);
+ void ToXml(const DoctypeDecl& doctype);
+
+ std::ostringstream out_;
+};
+
+XmlWriter::XmlWriter() {}
+
+void XmlWriter::ToXml(const std::string& name, const std::string& value) {
+ char quote = (name.size() % 2) ? '"' : '\'';
+ out_ << " " << name << "=" << quote << value << quote;
+}
+
+void XmlWriter::ToXml(const Misk& misk) {
+ if (misk.has_pi()) {
+ out_ << "<?" << misk.pi().target() << misk.pi().data() << "?>";
+ }
+
+ if (misk.has_comment()) {
+ out_ << "<!--" << misk.comment() << "-->";
+ }
+}
+
+void XmlWriter::ToXml(const DoctypeDecl& doctype) {
+ out_ << "<!DOCTYPE " << doctype.name();
+ if (doctype.has_external_id()) out_ << " " << doctype.external_id();
+ if (doctype.has_int_subset()) out_ << " [" << doctype.int_subset() << "]";
+ for (int i = 0; i < doctype.misk_size(); ++i) ToXml(doctype.misk(i));
+ out_ << ">";
+}
+
+void XmlWriter::ToXml(const Content& content) {
+ if (content.has_char_data()) out_ << content.char_data();
+ if (content.has_element()) ToXml(content.element());
+ if (content.has_reference()) {
+ out_ << (content.reference().entry() ? '&' : '%')
+ << content.reference().name() << ';';
+ }
+ if (content.has_cdsect()) out_ << "<![CDATA[" << content.cdsect() << "]]>";
+
+ if (content.has_misk()) ToXml(content.misk());
+}
+
+void XmlWriter::ToXml(const Element& element) {
+ std::string tag;
+ std::string name;
+ tag += element.tag().name();
+ out_ << "<" << tag;
+
+ for (int i = 0; i < element.tag().attribute_size(); ++i) {
+ ToXml(element.tag().attribute(i).name(),
+ element.tag().attribute(i).value());
+ }
+
+ if (element.content_size() == 0) {
+ out_ << "/>";
+ } else {
+ out_ << ">";
+ for (int i = 0; i < element.content_size(); ++i) ToXml(element.content(i));
+ out_ << "</" << tag << ">";
+ }
+}
+
+std::string XmlWriter::ToXml(const Document& doc) {
+ out_.str("");
+
+ if (doc.has_version() || doc.has_encoding() || doc.has_standalone()) {
+ out_ << "<?xml";
+ if (doc.has_version())
+ ToXml("version", (doc.version().size() == 7) ? "1.0" : doc.version());
+ if (doc.has_encoding()) ToXml("encoding", doc.encoding());
+ if (doc.has_standalone())
+ ToXml("encoding", doc.standalone() ? "yes" : "no");
+ out_ << "?>";
+ }
+
+ for (int i = 0; i < doc.misk1_size(); ++i) ToXml(doc.misk1(i));
+ if (doc.has_doctype()) ToXml(doc.doctype());
+ ToXml(doc.element());
+ for (int i = 0; i < doc.misk2_size(); ++i) ToXml(doc.misk2(i));
+
+ return out_.str();
+}
+
+} // namespace
+
+std::string MessageToXml(const Document& document) {
+ XmlWriter writer;
+ return writer.ToXml(document);
+}
+
+} // namespace xml
+} // namespace protobuf_mutator
diff --git a/examples/xml/xml_writer.h b/examples/xml/xml_writer.h
new file mode 100644
index 0000000..45b538d
--- /dev/null
+++ b/examples/xml/xml_writer.h
@@ -0,0 +1,29 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef EXAMPLES_XML_XML_WRITER_H_
+#define EXAMPLES_XML_XML_WRITER_H_
+
+#include <string>
+
+namespace protobuf_mutator {
+namespace xml {
+
+// Converts protobuf into XML.
+std::string MessageToXml(const class Document& document);
+
+} // namespace xml
+} // namespace protobuf_mutator
+
+#endif // EXAMPLES_XML_XML_WRITER_H_
diff --git a/port/gtest.h b/port/gtest.h
new file mode 100644
index 0000000..485aa98
--- /dev/null
+++ b/port/gtest.h
@@ -0,0 +1,20 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef PORT_GTEST_H_
+#define PORT_GTEST_H_
+
+#include "gtest/gtest.h"
+
+#endif // PORT_GTEST_H_
diff --git a/port/protobuf.h b/port/protobuf.h
new file mode 100644
index 0000000..eefe415
--- /dev/null
+++ b/port/protobuf.h
@@ -0,0 +1,34 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef PORT_PROTOBUF_H_
+#define PORT_PROTOBUF_H_
+
+#include <string>
+
+#include "google/protobuf/message.h"
+#include "google/protobuf/text_format.h"
+#include "google/protobuf/util/message_differencer.h"
+#include "google/protobuf/wire_format.h"
+
+namespace protobuf_mutator {
+
+namespace protobuf = google::protobuf;
+
+// String type used by google::protobuf.
+using String = std::string;
+
+} // namespace protobuf_mutator
+
+#endif // PORT_PROTOBUF_H_
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
new file mode 100644
index 0000000..5c13d2d
--- /dev/null
+++ b/src/CMakeLists.txt
@@ -0,0 +1,54 @@
+# Copyright 2017 Google Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+add_subdirectory(libfuzzer)
+
+add_library(protobuf-mutator
+ binary_format.cc
+ mutator.cc
+ text_format.cc
+ utf8_fix.cc)
+target_link_libraries(protobuf-mutator
+ ${PROTOBUF_LIBRARIES})
+set_property(TARGET protobuf-mutator
+ PROPERTY COMPILE_FLAGS "${NO_FUZZING_FLAGS}")
+
+protobuf_generate_cpp(PROTO_SRCS PROTO_HDRS
+ mutator_test_proto2.proto
+ mutator_test_proto3.proto)
+
+add_executable(mutator_test
+ mutator_test.cc
+ utf8_fix_test.cc
+ weighted_reservoir_sampler_test.cc
+ ${PROTO_SRCS})
+target_link_libraries(mutator_test
+ protobuf-mutator
+ ${ZLIB_LIBRARIES}
+ ${GTEST_BOTH_LIBRARIES}
+ ${CMAKE_THREAD_LIBS_INIT})
+
+ProcessorCount(CPU_COUNT)
+math(EXPR TEST_SHARDS_COUNT 2*${CPU_COUNT})
+math(EXPR TEST_SHARDS_MAX ${TEST_SHARDS_COUNT}-1)
+foreach(SHARD RANGE ${TEST_SHARDS_MAX})
+ add_test(test.protobuf_mutator_test_${SHARD} mutator_test --gtest_color=yes AUTO)
+ set_property(
+ TEST test.protobuf_mutator_test_${SHARD}
+ APPEND PROPERTY ENVIRONMENT
+ GTEST_SHARD_INDEX=${SHARD}
+ GTEST_TOTAL_SHARDS=${TEST_SHARDS_COUNT})
+endforeach(SHARD)
+
+add_dependencies(check mutator_test)
diff --git a/src/binary_format.cc b/src/binary_format.cc
new file mode 100644
index 0000000..2e9a8c7
--- /dev/null
+++ b/src/binary_format.cc
@@ -0,0 +1,50 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "src/binary_format.h"
+
+namespace protobuf_mutator {
+
+using protobuf::Message;
+
+bool ParseBinaryMessage(const uint8_t* data, size_t size, Message* output) {
+ return ParseBinaryMessage({data, data + size}, output);
+}
+
+bool ParseBinaryMessage(const std::string& data, protobuf::Message* output) {
+ output->Clear();
+ if (!output->ParsePartialFromString(data)) {
+ output->Clear();
+ return false;
+ }
+ return true;
+}
+
+size_t SaveMessageAsBinary(const Message& message, uint8_t* data,
+ size_t max_size) {
+ std::string result = SaveMessageAsBinary(message);
+ if (result.size() <= max_size) {
+ memcpy(data, result.data(), result.size());
+ return result.size();
+ }
+ return 0;
+}
+
+std::string SaveMessageAsBinary(const protobuf::Message& message) {
+ String tmp;
+ if (!message.SerializePartialToString(&tmp)) return {};
+ return tmp;
+}
+
+} // namespace protobuf_mutator
diff --git a/src/binary_format.h b/src/binary_format.h
new file mode 100644
index 0000000..1aceaad
--- /dev/null
+++ b/src/binary_format.h
@@ -0,0 +1,34 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef SRC_BINARY_FORMAT_H_
+#define SRC_BINARY_FORMAT_H_
+
+#include <string>
+
+#include "port/protobuf.h"
+
+namespace protobuf_mutator {
+
+// Binary serialization of protos.
+bool ParseBinaryMessage(const uint8_t* data, size_t size,
+ protobuf::Message* output);
+bool ParseBinaryMessage(const std::string& data, protobuf::Message* output);
+size_t SaveMessageAsBinary(const protobuf::Message& message, uint8_t* data,
+ size_t max_size);
+std::string SaveMessageAsBinary(const protobuf::Message& message);
+
+} // namespace protobuf_mutator
+
+#endif // SRC_BINARY_FORMAT_H_
diff --git a/src/field_instance.h b/src/field_instance.h
new file mode 100644
index 0000000..8c1c31f
--- /dev/null
+++ b/src/field_instance.h
@@ -0,0 +1,430 @@
+// Copyright 2016 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef SRC_FIELD_INSTANCE_H_
+#define SRC_FIELD_INSTANCE_H_
+
+#include <memory>
+#include <string>
+
+#include "port/protobuf.h"
+
+namespace protobuf_mutator {
+
+// Helper class for common protobuf fields operations.
+class ConstFieldInstance {
+ public:
+ static const size_t kInvalidIndex = -1;
+
+ struct Enum {
+ size_t index;
+ size_t count;
+ };
+
+ ConstFieldInstance()
+ : message_(nullptr), descriptor_(nullptr), index_(kInvalidIndex) {}
+
+ ConstFieldInstance(const protobuf::Message* message,
+ const protobuf::FieldDescriptor* field, size_t index)
+ : message_(message), descriptor_(field), index_(index) {
+ assert(message_);
+ assert(descriptor_);
+ assert(index_ != kInvalidIndex);
+ assert(descriptor_->is_repeated());
+ }
+
+ ConstFieldInstance(const protobuf::Message* message,
+ const protobuf::FieldDescriptor* field)
+ : message_(message), descriptor_(field), index_(kInvalidIndex) {
+ assert(message_);
+ assert(descriptor_);
+ assert(!descriptor_->is_repeated());
+ }
+
+ void GetDefault(int32_t* out) const {
+ *out = descriptor_->default_value_int32();
+ }
+
+ void GetDefault(int64_t* out) const {
+ *out = descriptor_->default_value_int64();
+ }
+
+ void GetDefault(uint32_t* out) const {
+ *out = descriptor_->default_value_uint32();
+ }
+
+ void GetDefault(uint64_t* out) const {
+ *out = descriptor_->default_value_uint64();
+ }
+
+ void GetDefault(double* out) const {
+ *out = descriptor_->default_value_double();
+ }
+
+ void GetDefault(float* out) const {
+ *out = descriptor_->default_value_float();
+ }
+
+ void GetDefault(bool* out) const { *out = descriptor_->default_value_bool(); }
+
+ void GetDefault(Enum* out) const {
+ const protobuf::EnumValueDescriptor* value =
+ descriptor_->default_value_enum();
+ const protobuf::EnumDescriptor* type = value->type();
+ *out = {static_cast<size_t>(value->index()),
+ static_cast<size_t>(type->value_count())};
+ }
+
+ void GetDefault(std::string* out) const {
+ *out = descriptor_->default_value_string();
+ }
+
+ void GetDefault(std::unique_ptr<protobuf::Message>* out) const {
+ out->reset(reflection()
+ .GetMessageFactory()
+ ->GetPrototype(descriptor_->message_type())
+ ->New());
+ }
+
+ void Load(int32_t* value) const {
+ *value = is_repeated()
+ ? reflection().GetRepeatedInt32(*message_, descriptor_, index_)
+ : reflection().GetInt32(*message_, descriptor_);
+ }
+
+ void Load(int64_t* value) const {
+ *value = is_repeated()
+ ? reflection().GetRepeatedInt64(*message_, descriptor_, index_)
+ : reflection().GetInt64(*message_, descriptor_);
+ }
+
+ void Load(uint32_t* value) const {
+ *value = is_repeated() ? reflection().GetRepeatedUInt32(*message_,
+ descriptor_, index_)
+ : reflection().GetUInt32(*message_, descriptor_);
+ }
+
+ void Load(uint64_t* value) const {
+ *value = is_repeated() ? reflection().GetRepeatedUInt64(*message_,
+ descriptor_, index_)
+ : reflection().GetUInt64(*message_, descriptor_);
+ }
+
+ void Load(double* value) const {
+ *value = is_repeated() ? reflection().GetRepeatedDouble(*message_,
+ descriptor_, index_)
+ : reflection().GetDouble(*message_, descriptor_);
+ }
+
+ void Load(float* value) const {
+ *value = is_repeated()
+ ? reflection().GetRepeatedFloat(*message_, descriptor_, index_)
+ : reflection().GetFloat(*message_, descriptor_);
+ }
+
+ void Load(bool* value) const {
+ *value = is_repeated()
+ ? reflection().GetRepeatedBool(*message_, descriptor_, index_)
+ : reflection().GetBool(*message_, descriptor_);
+ }
+
+ void Load(Enum* value) const {
+ const protobuf::EnumValueDescriptor* value_descriptor =
+ is_repeated()
+ ? reflection().GetRepeatedEnum(*message_, descriptor_, index_)
+ : reflection().GetEnum(*message_, descriptor_);
+ *value = {static_cast<size_t>(value_descriptor->index()),
+ static_cast<size_t>(value_descriptor->type()->value_count())};
+ }
+
+ void Load(std::string* value) const {
+ *value = is_repeated() ? reflection().GetRepeatedString(*message_,
+ descriptor_, index_)
+ : reflection().GetString(*message_, descriptor_);
+ }
+
+ void Load(std::unique_ptr<protobuf::Message>* value) const {
+ const protobuf::Message& source =
+ is_repeated()
+ ? reflection().GetRepeatedMessage(*message_, descriptor_, index_)
+ : reflection().GetMessage(*message_, descriptor_);
+ value->reset(source.New());
+ (*value)->CopyFrom(source);
+ }
+
+ std::string name() const { return descriptor_->name(); }
+
+ protobuf::FieldDescriptor::CppType cpp_type() const {
+ return descriptor_->cpp_type();
+ }
+
+ const protobuf::EnumDescriptor* enum_type() const {
+ return descriptor_->enum_type();
+ }
+
+ const protobuf::Descriptor* message_type() const {
+ return descriptor_->message_type();
+ }
+
+ bool EnforceUtf8() const {
+ return descriptor_->type() == protobuf::FieldDescriptor::TYPE_STRING &&
+ descriptor()->file()->syntax() ==
+ protobuf::FileDescriptor::SYNTAX_PROTO3;
+ }
+
+ protected:
+ bool is_repeated() const { return descriptor_->is_repeated(); }
+
+ const protobuf::Reflection& reflection() const {
+ return *message_->GetReflection();
+ }
+
+ const protobuf::FieldDescriptor* descriptor() const { return descriptor_; }
+
+ size_t index() const { return index_; }
+
+ private:
+ template <class Fn, class T>
+ friend struct FieldFunction;
+
+ const protobuf::Message* message_;
+ const protobuf::FieldDescriptor* descriptor_;
+ size_t index_;
+};
+
+class FieldInstance : public ConstFieldInstance {
+ public:
+ static const size_t kInvalidIndex = -1;
+
+ FieldInstance() : ConstFieldInstance(), message_(nullptr) {}
+
+ FieldInstance(protobuf::Message* message,
+ const protobuf::FieldDescriptor* field, size_t index)
+ : ConstFieldInstance(message, field, index), message_(message) {}
+
+ FieldInstance(protobuf::Message* message,
+ const protobuf::FieldDescriptor* field)
+ : ConstFieldInstance(message, field), message_(message) {}
+
+ void Delete() const {
+ if (!is_repeated()) return reflection().ClearField(message_, descriptor());
+ int field_size = reflection().FieldSize(*message_, descriptor());
+ // API has only method to delete the last message, so we move method from
+ // the
+ // middle to the end.
+ for (int i = index() + 1; i < field_size; ++i)
+ reflection().SwapElements(message_, descriptor(), i, i - 1);
+ reflection().RemoveLast(message_, descriptor());
+ }
+
+ template <class T>
+ void Create(const T& value) const {
+ if (!is_repeated()) return Store(value);
+ InsertRepeated(value);
+ }
+
+ void Store(int32_t value) const {
+ if (is_repeated())
+ reflection().SetRepeatedInt32(message_, descriptor(), index(), value);
+ else
+ reflection().SetInt32(message_, descriptor(), value);
+ }
+
+ void Store(int64_t value) const {
+ if (is_repeated())
+ reflection().SetRepeatedInt64(message_, descriptor(), index(), value);
+ else
+ reflection().SetInt64(message_, descriptor(), value);
+ }
+
+ void Store(uint32_t value) const {
+ if (is_repeated())
+ reflection().SetRepeatedUInt32(message_, descriptor(), index(), value);
+ else
+ reflection().SetUInt32(message_, descriptor(), value);
+ }
+
+ void Store(uint64_t value) const {
+ if (is_repeated())
+ reflection().SetRepeatedUInt64(message_, descriptor(), index(), value);
+ else
+ reflection().SetUInt64(message_, descriptor(), value);
+ }
+
+ void Store(double value) const {
+ if (is_repeated())
+ reflection().SetRepeatedDouble(message_, descriptor(), index(), value);
+ else
+ reflection().SetDouble(message_, descriptor(), value);
+ }
+
+ void Store(float value) const {
+ if (is_repeated())
+ reflection().SetRepeatedFloat(message_, descriptor(), index(), value);
+ else
+ reflection().SetFloat(message_, descriptor(), value);
+ }
+
+ void Store(bool value) const {
+ if (is_repeated())
+ reflection().SetRepeatedBool(message_, descriptor(), index(), value);
+ else
+ reflection().SetBool(message_, descriptor(), value);
+ }
+
+ void Store(const Enum& value) const {
+ assert(value.index < value.count);
+ const protobuf::EnumValueDescriptor* enum_value =
+ descriptor()->enum_type()->value(value.index);
+ if (is_repeated())
+ reflection().SetRepeatedEnum(message_, descriptor(), index(), enum_value);
+ else
+ reflection().SetEnum(message_, descriptor(), enum_value);
+ }
+
+ void Store(const std::string& value) const {
+ if (is_repeated())
+ reflection().SetRepeatedString(message_, descriptor(), index(), value);
+ else
+ reflection().SetString(message_, descriptor(), value);
+ }
+
+ void Store(const std::unique_ptr<protobuf::Message>& value) const {
+ protobuf::Message* mutable_message =
+ is_repeated() ? reflection().MutableRepeatedMessage(
+ message_, descriptor(), index())
+ : reflection().MutableMessage(message_, descriptor());
+ mutable_message->Clear();
+ if (value) mutable_message->CopyFrom(*value);
+ }
+
+ private:
+ template <class T>
+ void InsertRepeated(const T& value) const {
+ PushBackRepeated(value);
+ size_t field_size = reflection().FieldSize(*message_, descriptor());
+ if (field_size == 1) return;
+ // API has only method to add field to the end of the list. So we add
+ // descriptor()
+ // and move it into the middle.
+ for (size_t i = field_size - 1; i > index(); --i)
+ reflection().SwapElements(message_, descriptor(), i, i - 1);
+ }
+
+ void PushBackRepeated(int32_t value) const {
+ assert(is_repeated());
+ reflection().AddInt32(message_, descriptor(), value);
+ }
+
+ void PushBackRepeated(int64_t value) const {
+ assert(is_repeated());
+ reflection().AddInt64(message_, descriptor(), value);
+ }
+
+ void PushBackRepeated(uint32_t value) const {
+ assert(is_repeated());
+ reflection().AddUInt32(message_, descriptor(), value);
+ }
+
+ void PushBackRepeated(uint64_t value) const {
+ assert(is_repeated());
+ reflection().AddUInt64(message_, descriptor(), value);
+ }
+
+ void PushBackRepeated(double value) const {
+ assert(is_repeated());
+ reflection().AddDouble(message_, descriptor(), value);
+ }
+
+ void PushBackRepeated(float value) const {
+ assert(is_repeated());
+ reflection().AddFloat(message_, descriptor(), value);
+ }
+
+ void PushBackRepeated(bool value) const {
+ assert(is_repeated());
+ reflection().AddBool(message_, descriptor(), value);
+ }
+
+ void PushBackRepeated(const Enum& value) const {
+ assert(value.index < value.count);
+ const protobuf::EnumValueDescriptor* enum_value =
+ descriptor()->enum_type()->value(value.index);
+ assert(is_repeated());
+ reflection().AddEnum(message_, descriptor(), enum_value);
+ }
+
+ void PushBackRepeated(const std::string& value) const {
+ assert(is_repeated());
+ reflection().AddString(message_, descriptor(), value);
+ }
+
+ void PushBackRepeated(const std::unique_ptr<protobuf::Message>& value) const {
+ assert(is_repeated());
+ protobuf::Message* mutable_message =
+ reflection().AddMessage(message_, descriptor());
+ mutable_message->Clear();
+ if (value) mutable_message->CopyFrom(*value);
+ }
+
+ protobuf::Message* message_;
+};
+
+template <class Fn, class R = void>
+struct FieldFunction {
+ template <class Field, class... Args>
+ R operator()(const Field& field, const Args&... args) const {
+ assert(field.descriptor());
+ using protobuf::FieldDescriptor;
+ switch (field.cpp_type()) {
+ case FieldDescriptor::CPPTYPE_INT32:
+ return static_cast<const Fn*>(this)->template ForType<int32_t>(field,
+ args...);
+ case FieldDescriptor::CPPTYPE_INT64:
+ return static_cast<const Fn*>(this)->template ForType<int64_t>(field,
+ args...);
+ case FieldDescriptor::CPPTYPE_UINT32:
+ return static_cast<const Fn*>(this)->template ForType<uint32_t>(
+ field, args...);
+ case FieldDescriptor::CPPTYPE_UINT64:
+ return static_cast<const Fn*>(this)->template ForType<uint64_t>(
+ field, args...);
+ case FieldDescriptor::CPPTYPE_DOUBLE:
+ return static_cast<const Fn*>(this)->template ForType<double>(field,
+ args...);
+ case FieldDescriptor::CPPTYPE_FLOAT:
+ return static_cast<const Fn*>(this)->template ForType<float>(field,
+ args...);
+ case FieldDescriptor::CPPTYPE_BOOL:
+ return static_cast<const Fn*>(this)->template ForType<bool>(field,
+ args...);
+ case FieldDescriptor::CPPTYPE_ENUM:
+ return static_cast<const Fn*>(this)
+ ->template ForType<ConstFieldInstance::Enum>(field, args...);
+ case FieldDescriptor::CPPTYPE_STRING:
+ return static_cast<const Fn*>(this)->template ForType<std::string>(
+ field, args...);
+ case FieldDescriptor::CPPTYPE_MESSAGE:
+ return static_cast<const Fn*>(this)
+ ->template ForType<std::unique_ptr<protobuf::Message>>(field,
+ args...);
+ }
+ assert(false && "Unknown type");
+ abort();
+ }
+};
+
+} // namespace protobuf_mutator
+
+#endif // SRC_FIELD_INSTANCE_H_
diff --git a/src/libfuzzer/CMakeLists.txt b/src/libfuzzer/CMakeLists.txt
new file mode 100644
index 0000000..6677f5e
--- /dev/null
+++ b/src/libfuzzer/CMakeLists.txt
@@ -0,0 +1,22 @@
+# Copyright 2017 Google Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+add_library(protobuf-mutator-libfuzzer
+ libfuzzer_mutator.cc
+ libfuzzer_macro.cc)
+target_link_libraries(protobuf-mutator-libfuzzer
+ protobuf-mutator
+ ${PROTOBUF_LIBRARIES})
+set_property(TARGET protobuf-mutator-libfuzzer
+ PROPERTY COMPILE_FLAGS "${NO_FUZZING_FLAGS}")
diff --git a/src/libfuzzer/libfuzzer_macro.cc b/src/libfuzzer/libfuzzer_macro.cc
new file mode 100644
index 0000000..162c2ce
--- /dev/null
+++ b/src/libfuzzer/libfuzzer_macro.cc
@@ -0,0 +1,185 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "src/libfuzzer/libfuzzer_macro.h"
+
+#include "src/binary_format.h"
+#include "src/libfuzzer/libfuzzer_mutator.h"
+#include "src/text_format.h"
+
+namespace protobuf_mutator {
+namespace libfuzzer {
+
+namespace {
+
+class InputReader {
+ public:
+ InputReader(const uint8_t* data, size_t size) : data_(data), size_(size) {}
+ virtual ~InputReader() = default;
+
+ virtual bool Read(protobuf::Message* message) const = 0;
+
+ const uint8_t* data() const { return data_; }
+ size_t size() const { return size_; }
+
+ private:
+ const uint8_t* data_;
+ size_t size_;
+};
+
+class OutputWriter {
+ public:
+ OutputWriter(uint8_t* data, size_t size) : data_(data), size_(size) {}
+ virtual ~OutputWriter() = default;
+
+ virtual size_t Write(const protobuf::Message& message) = 0;
+
+ uint8_t* data() const { return data_; }
+ size_t size() const { return size_; }
+
+ private:
+ uint8_t* data_;
+ size_t size_;
+};
+
+class TextInputReader : public InputReader {
+ public:
+ using InputReader::InputReader;
+
+ bool Read(protobuf::Message* message) const override {
+ return ParseTextMessage(data(), size(), message);
+ }
+};
+
+class TextOutputWriter : public OutputWriter {
+ public:
+ using OutputWriter::OutputWriter;
+
+ size_t Write(const protobuf::Message& message) override {
+ return SaveMessageAsText(message, data(), size());
+ }
+};
+
+class BinaryInputReader : public InputReader {
+ public:
+ using InputReader::InputReader;
+
+ bool Read(protobuf::Message* message) const override {
+ return ParseBinaryMessage(data(), size(), message);
+ }
+};
+
+class BinaryOutputWriter : public OutputWriter {
+ public:
+ using OutputWriter::OutputWriter;
+
+ size_t Write(const protobuf::Message& message) override {
+ return SaveMessageAsBinary(message, data(), size());
+ }
+};
+
+size_t MutateMessage(unsigned int seed, const InputReader& input,
+ OutputWriter* output, protobuf::Message* message) {
+ RandomEngine random(seed);
+ Mutator mutator(&random);
+ input.Read(message);
+ mutator.Mutate(message, output->size() > input.size()
+ ? (output->size() - input.size())
+ : 0);
+ if (size_t new_size = output->Write(*message)) {
+ assert(new_size <= output->size());
+ return new_size;
+ }
+ return 0;
+}
+
+size_t CrossOverMessages(unsigned int seed, const InputReader& input1,
+ const InputReader& input2, OutputWriter* output,
+ protobuf::Message* message1,
+ protobuf::Message* message2) {
+ RandomEngine random(seed);
+ Mutator mutator(&random);
+ input1.Read(message1);
+ input2.Read(message2);
+ mutator.CrossOver(*message2, message1);
+ if (size_t new_size = output->Write(*message1)) {
+ assert(new_size <= output->size());
+ return new_size;
+ }
+ return 0;
+}
+
+size_t MutateTextMessage(uint8_t* data, size_t size, size_t max_size,
+ unsigned int seed, protobuf::Message* message) {
+ TextInputReader input(data, size);
+ TextOutputWriter output(data, max_size);
+ return MutateMessage(seed, input, &output, message);
+}
+
+size_t CrossOverTextMessages(const uint8_t* data1, size_t size1,
+ const uint8_t* data2, size_t size2, uint8_t* out,
+ size_t max_out_size, unsigned int seed,
+ protobuf::Message* message1,
+ protobuf::Message* message2) {
+ TextInputReader input1(data1, size1);
+ TextInputReader input2(data2, size2);
+ TextOutputWriter output(out, max_out_size);
+ return CrossOverMessages(seed, input1, input2, &output, message1, message2);
+}
+
+size_t MutateBinaryMessage(uint8_t* data, size_t size, size_t max_size,
+ unsigned int seed, protobuf::Message* message) {
+ BinaryInputReader input(data, size);
+ BinaryOutputWriter output(data, max_size);
+ return MutateMessage(seed, input, &output, message);
+}
+
+size_t CrossOverBinaryMessages(const uint8_t* data1, size_t size1,
+ const uint8_t* data2, size_t size2, uint8_t* out,
+ size_t max_out_size, unsigned int seed,
+ protobuf::Message* message1,
+ protobuf::Message* message2) {
+ BinaryInputReader input1(data1, size1);
+ BinaryInputReader input2(data2, size2);
+ BinaryOutputWriter output(out, max_out_size);
+ return CrossOverMessages(seed, input1, input2, &output, message1, message2);
+}
+
+} // namespace
+
+size_t CustomProtoMutator(bool binary, uint8_t* data, size_t size,
+ size_t max_size, unsigned int seed,
+ protobuf::Message* input) {
+ auto mutate = binary ? &MutateBinaryMessage : &MutateTextMessage;
+ return mutate(data, size, max_size, seed, input);
+}
+
+size_t CustomProtoCrossOver(bool binary, const uint8_t* data1, size_t size1,
+ const uint8_t* data2, size_t size2, uint8_t* out,
+ size_t max_out_size, unsigned int seed,
+ protobuf::Message* input1,
+ protobuf::Message* input2) {
+ auto cross = binary ? &CrossOverBinaryMessages : &CrossOverTextMessages;
+ return cross(data1, size1, data2, size2, out, max_out_size, seed, input1,
+ input2);
+}
+
+bool LoadProtoInput(bool binary, const uint8_t* data, size_t size,
+ protobuf::Message* input) {
+ return binary ? ParseBinaryMessage(data, size, input)
+ : ParseTextMessage(data, size, input);
+}
+
+} // namespace libfuzzer
+} // namespace protobuf_mutator
diff --git a/src/libfuzzer/libfuzzer_macro.h b/src/libfuzzer/libfuzzer_macro.h
new file mode 100644
index 0000000..59ae0ba
--- /dev/null
+++ b/src/libfuzzer/libfuzzer_macro.h
@@ -0,0 +1,91 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef SRC_LIBFUZZER_LIBFUZZER_MACRO_H_
+#define SRC_LIBFUZZER_LIBFUZZER_MACRO_H_
+
+#include <stddef.h>
+#include <cstdint>
+#include <functional>
+#include <type_traits>
+
+#include "port/protobuf.h"
+
+// Defines custom mutator, crossover and test functions using default
+// serialization format. Default is text.
+#define DEFINE_PROTO_FUZZER(arg) DEFINE_TEXT_PROTO_FUZZER(arg)
+// Defines custom mutator, crossover and test functions using text
+// serialization. This format is more convenient to read.
+#define DEFINE_TEXT_PROTO_FUZZER(arg) DEFINE_PROTO_FUZZER_IMPL(false, arg)
+// Defines custom mutator, crossover and test functions using binary
+// serialization. This makes mutations faster. However often test function is
+// significantly slower than mutator, so fuzzing rate may stay unchanged.
+#define DEFINE_BINARY_PROTO_FUZZER(arg) DEFINE_PROTO_FUZZER_IMPL(true, arg)
+
+// Implementation of macros above.
+#define DEFINE_CUSTOM_PROTO_MUTATOR_IMPL(use_binary, Proto) \
+ extern "C" size_t LLVMFuzzerCustomMutator( \
+ uint8_t* data, size_t size, size_t max_size, unsigned int seed) { \
+ using protobuf_mutator::libfuzzer::CustomProtoMutator; \
+ Proto input; \
+ return CustomProtoMutator(use_binary, data, size, max_size, seed, &input); \
+ }
+
+#define DEFINE_CUSTOM_PROTO_CROSSOVER_IMPL(use_binary, Proto) \
+ extern "C" size_t LLVMFuzzerCustomCrossOver( \
+ const uint8_t* data1, size_t size1, const uint8_t* data2, size_t size2, \
+ uint8_t* out, size_t max_out_size, unsigned int seed) { \
+ using protobuf_mutator::libfuzzer::CustomProtoCrossOver; \
+ Proto input1; \
+ Proto input2; \
+ return CustomProtoCrossOver(use_binary, data1, size1, data2, size2, out, \
+ max_out_size, seed, &input1, &input2); \
+ }
+
+#define DEFINE_TEST_ONE_PROTO_INPUT_IMPL(use_binary, Proto) \
+ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { \
+ using protobuf_mutator::libfuzzer::LoadProtoInput; \
+ Proto input; \
+ if (LoadProtoInput(use_binary, data, size, &input)) \
+ TestOneProtoInput(input); \
+ return 0; \
+ }
+
+#define DEFINE_PROTO_FUZZER_IMPL(use_binary, arg) \
+ static void TestOneProtoInput(arg); \
+ using FuzzerProtoType = std::remove_const<std::remove_reference< \
+ std::function<decltype(TestOneProtoInput)>::argument_type>::type>::type; \
+ DEFINE_CUSTOM_PROTO_MUTATOR_IMPL(use_binary, FuzzerProtoType) \
+ DEFINE_CUSTOM_PROTO_CROSSOVER_IMPL(use_binary, FuzzerProtoType) \
+ DEFINE_TEST_ONE_PROTO_INPUT_IMPL(use_binary, FuzzerProtoType) \
+ static void TestOneProtoInput(arg)
+
+namespace protobuf_mutator {
+namespace libfuzzer {
+
+size_t CustomProtoMutator(bool binary, uint8_t* data, size_t size,
+ size_t max_size, unsigned int seed,
+ protobuf::Message* input);
+size_t CustomProtoCrossOver(bool binary, const uint8_t* data1, size_t size1,
+ const uint8_t* data2, size_t size2, uint8_t* out,
+ size_t max_out_size, unsigned int seed,
+ protobuf::Message* input1,
+ protobuf::Message* input2);
+bool LoadProtoInput(bool binary, const uint8_t* data, size_t size,
+ protobuf::Message* input);
+
+} // namespace libfuzzer
+} // namespace protobuf_mutator
+
+#endif // SRC_LIBFUZZER_LIBFUZZER_MACRO_H_
diff --git a/src/libfuzzer/libfuzzer_mutator.cc b/src/libfuzzer/libfuzzer_mutator.cc
new file mode 100644
index 0000000..0da9552
--- /dev/null
+++ b/src/libfuzzer/libfuzzer_mutator.cc
@@ -0,0 +1,68 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "src/libfuzzer/libfuzzer_mutator.h"
+
+#include <string.h>
+#include <cassert>
+#include <memory>
+#include <string>
+
+#include "port/protobuf.h"
+#include "src/mutator.h"
+
+extern "C" size_t LLVMFuzzerMutate(uint8_t*, size_t, size_t)
+ __attribute__((weak));
+
+namespace protobuf_mutator {
+namespace libfuzzer {
+
+namespace {
+
+template <class T>
+T MutateValue(T v) {
+ size_t size =
+ LLVMFuzzerMutate(reinterpret_cast<uint8_t*>(&v), sizeof(v), sizeof(v));
+ memset(reinterpret_cast<uint8_t*>(&v) + size, 0, sizeof(v) - size);
+ return v;
+}
+
+} // namespace
+
+int32_t Mutator::MutateInt32(int32_t value) { return MutateValue(value); }
+
+int64_t Mutator::MutateInt64(int64_t value) { return MutateValue(value); }
+
+uint32_t Mutator::MutateUInt32(uint32_t value) { return MutateValue(value); }
+
+uint64_t Mutator::MutateUInt64(uint64_t value) { return MutateValue(value); }
+
+float Mutator::MutateFloat(float value) { return MutateValue(value); }
+
+double Mutator::MutateDouble(double value) { return MutateValue(value); }
+
+std::string Mutator::MutateString(const std::string& value,
+ size_t size_increase_hint) {
+ // Randomly return empty strings as LLVMFuzzerMutate does not produce them.
+ if (!std::uniform_int_distribution<uint8_t>(0, 20)(*random())) return {};
+ std::string result = value;
+ result.resize(value.size() + size_increase_hint);
+ if (result.empty()) result.push_back(0);
+ result.resize(LLVMFuzzerMutate(reinterpret_cast<uint8_t*>(&result[0]),
+ value.size(), result.size()));
+ return result;
+}
+
+} // namespace libfuzzer
+} // namespace protobuf_mutator
diff --git a/src/libfuzzer/libfuzzer_mutator.h b/src/libfuzzer/libfuzzer_mutator.h
new file mode 100644
index 0000000..45ea908
--- /dev/null
+++ b/src/libfuzzer/libfuzzer_mutator.h
@@ -0,0 +1,46 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef SRC_LIBFUZZER_LIBFUZZER_MUTATOR_H_
+#define SRC_LIBFUZZER_LIBFUZZER_MUTATOR_H_
+
+#include <string>
+
+#include "src/mutator.h"
+
+namespace protobuf_mutator {
+namespace libfuzzer {
+
+// Overrides protobuf_mutator::Mutator::Mutate* methods with implementation
+// which uses libFuzzer library. protobuf_mutator::Mutator has very basic
+// implementation of this methods.
+class Mutator : public protobuf_mutator::Mutator {
+ public:
+ using protobuf_mutator::Mutator::Mutator;
+
+ protected:
+ int32_t MutateInt32(int32_t value) override;
+ int64_t MutateInt64(int64_t value) override;
+ uint32_t MutateUInt32(uint32_t value) override;
+ uint64_t MutateUInt64(uint64_t value) override;
+ float MutateFloat(float value) override;
+ double MutateDouble(double value) override;
+ std::string MutateString(const std::string& value,
+ size_t size_increase_hint) override;
+};
+
+} // namespace libfuzzer
+} // namespace protobuf_mutator
+
+#endif // SRC_LIBFUZZER_LIBFUZZER_MUTATOR_H_
diff --git a/src/mutator.cc b/src/mutator.cc
new file mode 100644
index 0000000..2aa9693
--- /dev/null
+++ b/src/mutator.cc
@@ -0,0 +1,670 @@
+// Copyright 2016 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "src/mutator.h"
+
+#include <algorithm>
+#include <functional>
+#include <map>
+#include <random>
+#include <string>
+
+#include "src/field_instance.h"
+#include "src/utf8_fix.h"
+#include "src/weighted_reservoir_sampler.h"
+
+namespace protobuf_mutator {
+
+using protobuf::Descriptor;
+using protobuf::FieldDescriptor;
+using protobuf::FileDescriptor;
+using protobuf::Message;
+using protobuf::OneofDescriptor;
+using protobuf::Reflection;
+using protobuf::util::MessageDifferencer;
+using std::placeholders::_1;
+
+namespace {
+
+const int kMaxInitializeDepth = 200;
+const uint64_t kDefaultMutateWeight = 1000000;
+
+enum class Mutation {
+ None,
+ Add, // Adds new field with default value.
+ Mutate, // Mutates field contents.
+ Delete, // Deletes field.
+ Copy, // Copy values copied from another field.
+
+ // TODO(vitalybuka):
+ // Clone, // Adds new field with value copied from another field.
+};
+
+// Return random integer from [0, count)
+size_t GetRandomIndex(RandomEngine* random, size_t count) {
+ assert(count > 0);
+ if (count == 1) return 0;
+ return std::uniform_int_distribution<size_t>(0, count - 1)(*random);
+}
+
+// Flips random bit in the buffer.
+void FlipBit(size_t size, uint8_t* bytes, RandomEngine* random) {
+ size_t bit = GetRandomIndex(random, size * 8);
+ bytes[bit / 8] ^= (1u << (bit % 8));
+}
+
+// Flips random bit in the value.
+template <class T>
+T FlipBit(T value, RandomEngine* random) {
+ FlipBit(sizeof(value), reinterpret_cast<uint8_t*>(&value), random);
+ return value;
+}
+
+// Return true with probability about 1-of-n.
+bool GetRandomBool(RandomEngine* random, size_t n = 2) {
+ return GetRandomIndex(random, n) == 0;
+}
+
+bool IsProto3SimpleField(const FieldDescriptor& field) {
+ assert(field.file()->syntax() == FileDescriptor::SYNTAX_PROTO3 ||
+ field.file()->syntax() == FileDescriptor::SYNTAX_PROTO2);
+ return field.file()->syntax() == FileDescriptor::SYNTAX_PROTO3 &&
+ field.cpp_type() != FieldDescriptor::CPPTYPE_MESSAGE &&
+ !field.containing_oneof() && !field.is_repeated();
+}
+
+struct CreateDefaultField : public FieldFunction<CreateDefaultField> {
+ template <class T>
+ void ForType(const FieldInstance& field) const {
+ T value;
+ field.GetDefault(&value);
+ field.Create(value);
+ }
+};
+
+struct DeleteField : public FieldFunction<DeleteField> {
+ template <class T>
+ void ForType(const FieldInstance& field) const {
+ field.Delete();
+ }
+};
+
+struct CopyField : public FieldFunction<CopyField> {
+ template <class T>
+ void ForType(const ConstFieldInstance& source,
+ const FieldInstance& field) const {
+ T value;
+ source.Load(&value);
+ field.Store(value);
+ }
+};
+
+struct AppendField : public FieldFunction<AppendField> {
+ template <class T>
+ void ForType(const ConstFieldInstance& source,
+ const FieldInstance& field) const {
+ T value;
+ source.Load(&value);
+ field.Create(value);
+ }
+};
+
+class IsEqualValueField : public FieldFunction<IsEqualValueField, bool> {
+ public:
+ template <class T>
+ bool ForType(const ConstFieldInstance& a, const ConstFieldInstance& b) const {
+ T aa;
+ a.Load(&aa);
+ T bb;
+ b.Load(&bb);
+ return IsEqual(aa, bb);
+ }
+
+ private:
+ bool IsEqual(const ConstFieldInstance::Enum& a,
+ const ConstFieldInstance::Enum& b) const {
+ assert(a.count == b.count);
+ return a.index == b.index;
+ }
+
+ bool IsEqual(const std::unique_ptr<protobuf::Message>& a,
+ const std::unique_ptr<protobuf::Message>& b) const {
+ return MessageDifferencer::Equals(*a, *b);
+ }
+
+ template <class T>
+ bool IsEqual(const T& a, const T& b) const {
+ return a == b;
+ }
+};
+
+// Selects random field and mutation from the given proto message.
+class MutationSampler {
+ public:
+ MutationSampler(bool keep_initialized, RandomEngine* random, Message* message)
+ : keep_initialized_(keep_initialized), random_(random), sampler_(random) {
+ Sample(message);
+ assert(mutation() != Mutation::None ||
+ message->GetDescriptor()->field_count() == 0);
+ }
+
+ // Returns selected field.
+ const FieldInstance& field() const { return sampler_.selected().field; }
+
+ // Returns selected mutation.
+ Mutation mutation() const { return sampler_.selected().mutation; }
+
+ private:
+ void Sample(Message* message) {
+ const Descriptor* descriptor = message->GetDescriptor();
+ const Reflection* reflection = message->GetReflection();
+
+ int field_count = descriptor->field_count();
+ for (int i = 0; i < field_count; ++i) {
+ const FieldDescriptor* field = descriptor->field(i);
+ if (const OneofDescriptor* oneof = field->containing_oneof()) {
+ // Handle entire oneof group on the first field.
+ if (field->index_in_oneof() == 0) {
+ assert(oneof->field_count());
+ const FieldDescriptor* current_field =
+ reflection->GetOneofFieldDescriptor(*message, oneof);
+ for (;;) {
+ const FieldDescriptor* add_field =
+ oneof->field(GetRandomIndex(random_, oneof->field_count()));
+ if (add_field != current_field) {
+ sampler_.Try(kDefaultMutateWeight,
+ {{message, add_field}, Mutation::Add});
+ break;
+ }
+ if (oneof->field_count() < 2) break;
+ }
+ if (current_field) {
+ if (current_field->cpp_type() != FieldDescriptor::CPPTYPE_MESSAGE) {
+ sampler_.Try(kDefaultMutateWeight,
+ {{message, current_field}, Mutation::Mutate});
+ }
+ sampler_.Try(kDefaultMutateWeight,
+ {{message, current_field}, Mutation::Delete});
+ sampler_.Try(kDefaultMutateWeight,
+ {{message, current_field}, Mutation::Copy});
+ }
+ }
+ } else {
+ if (field->is_repeated()) {
+ int field_size = reflection->FieldSize(*message, field);
+ sampler_.Try(
+ kDefaultMutateWeight,
+ {{message, field, GetRandomIndex(random_, field_size + 1)},
+ Mutation::Add});
+
+ if (field_size) {
+ size_t random_index = GetRandomIndex(random_, field_size);
+ if (field->cpp_type() != FieldDescriptor::CPPTYPE_MESSAGE) {
+ sampler_.Try(kDefaultMutateWeight,
+ {{message, field, random_index}, Mutation::Mutate});
+ }
+ sampler_.Try(kDefaultMutateWeight,
+ {{message, field, random_index}, Mutation::Delete});
+ sampler_.Try(kDefaultMutateWeight,
+ {{message, field, random_index}, Mutation::Copy});
+ }
+ } else {
+ if (reflection->HasField(*message, field) ||
+ IsProto3SimpleField(*field)) {
+ if (field->cpp_type() != FieldDescriptor::CPPTYPE_MESSAGE)
+ sampler_.Try(kDefaultMutateWeight,
+ {{message, field}, Mutation::Mutate});
+ if (!IsProto3SimpleField(*field) &&
+ (!field->is_required() || !keep_initialized_)) {
+ sampler_.Try(kDefaultMutateWeight,
+ {{message, field}, Mutation::Delete});
+ }
+ sampler_.Try(kDefaultMutateWeight,
+ {{message, field}, Mutation::Copy});
+ } else {
+ sampler_.Try(kDefaultMutateWeight,
+ {{message, field}, Mutation::Add});
+ }
+ }
+ }
+
+ if (field->cpp_type() == FieldDescriptor::CPPTYPE_MESSAGE) {
+ if (field->is_repeated()) {
+ const int field_size = reflection->FieldSize(*message, field);
+ for (int j = 0; j < field_size; ++j)
+ Sample(reflection->MutableRepeatedMessage(message, field, j));
+ } else if (reflection->HasField(*message, field)) {
+ Sample(reflection->MutableMessage(message, field));
+ }
+ }
+ }
+ }
+
+ bool keep_initialized_ = false;
+
+ RandomEngine* random_;
+
+ struct Result {
+ Result() = default;
+ Result(const FieldInstance& f, Mutation m) : field(f), mutation(m) {}
+
+ FieldInstance field;
+ Mutation mutation = Mutation::None;
+ };
+ WeightedReservoirSampler<Result, RandomEngine> sampler_;
+};
+
+// Selects random field of compatible type to use for clone mutations.
+class DataSourceSampler {
+ public:
+ DataSourceSampler(const ConstFieldInstance& match, RandomEngine* random,
+ Message* message)
+ : match_(match), random_(random), sampler_(random) {
+ Sample(message);
+ }
+
+ // Returns selected field.
+ const ConstFieldInstance& field() const {
+ assert(!IsEmpty());
+ return sampler_.selected();
+ }
+
+ bool IsEmpty() const { return sampler_.IsEmpty(); }
+
+ private:
+ void Sample(Message* message) {
+ const Descriptor* descriptor = message->GetDescriptor();
+ const Reflection* reflection = message->GetReflection();
+
+ int field_count = descriptor->field_count();
+ for (int i = 0; i < field_count; ++i) {
+ const FieldDescriptor* field = descriptor->field(i);
+ if (field->cpp_type() == FieldDescriptor::CPPTYPE_MESSAGE) {
+ if (field->is_repeated()) {
+ const int field_size = reflection->FieldSize(*message, field);
+ for (int j = 0; j < field_size; ++j) {
+ Sample(reflection->MutableRepeatedMessage(message, field, j));
+ }
+ } else if (reflection->HasField(*message, field)) {
+ Sample(reflection->MutableMessage(message, field));
+ }
+ }
+
+ if (field->cpp_type() != match_.cpp_type()) continue;
+ if (match_.cpp_type() == FieldDescriptor::CPPTYPE_ENUM) {
+ if (field->enum_type() != match_.enum_type()) continue;
+ } else if (match_.cpp_type() == FieldDescriptor::CPPTYPE_MESSAGE) {
+ if (field->message_type() != match_.message_type()) continue;
+ }
+
+ if (field->is_repeated()) {
+ if (int field_size = reflection->FieldSize(*message, field)) {
+ ConstFieldInstance source(message, field,
+ GetRandomIndex(random_, field_size));
+ if (match_.EnforceUtf8() && !source.EnforceUtf8()) continue;
+ if (!IsEqualValueField()(match_, source))
+ sampler_.Try(field_size, source);
+ }
+ } else {
+ if (reflection->HasField(*message, field)) {
+ ConstFieldInstance source(message, field);
+ if (match_.EnforceUtf8() && !source.EnforceUtf8()) continue;
+ if (!IsEqualValueField()(match_, source)) sampler_.Try(1, source);
+ }
+ }
+ }
+ }
+
+ ConstFieldInstance match_;
+ RandomEngine* random_;
+
+ WeightedReservoirSampler<ConstFieldInstance, RandomEngine> sampler_;
+};
+
+} // namespace
+
+class FieldMutator {
+ public:
+ FieldMutator(size_t size_increase_hint, bool enforce_changes,
+ bool enforce_utf8_strings, Mutator* mutator)
+ : size_increase_hint_(size_increase_hint),
+ enforce_changes_(enforce_changes),
+ enforce_utf8_strings_(enforce_utf8_strings),
+ mutator_(mutator) {}
+
+ void Mutate(int32_t* value) const {
+ RepeatMutate(value, std::bind(&Mutator::MutateInt32, mutator_, _1));
+ }
+
+ void Mutate(int64_t* value) const {
+ RepeatMutate(value, std::bind(&Mutator::MutateInt64, mutator_, _1));
+ }
+
+ void Mutate(uint32_t* value) const {
+ RepeatMutate(value, std::bind(&Mutator::MutateUInt32, mutator_, _1));
+ }
+
+ void Mutate(uint64_t* value) const {
+ RepeatMutate(value, std::bind(&Mutator::MutateUInt64, mutator_, _1));
+ }
+
+ void Mutate(float* value) const {
+ RepeatMutate(value, std::bind(&Mutator::MutateFloat, mutator_, _1));
+ }
+
+ void Mutate(double* value) const {
+ RepeatMutate(value, std::bind(&Mutator::MutateDouble, mutator_, _1));
+ }
+
+ void Mutate(bool* value) const {
+ RepeatMutate(value, std::bind(&Mutator::MutateBool, mutator_, _1), 2);
+ }
+
+ void Mutate(FieldInstance::Enum* value) const {
+ RepeatMutate(&value->index,
+ std::bind(&Mutator::MutateEnum, mutator_, _1, value->count),
+ std::max<size_t>(value->count, 1));
+ assert(value->index < value->count);
+ }
+
+ void Mutate(std::string* value) const {
+ if (enforce_utf8_strings_) {
+ RepeatMutate(value, std::bind(&Mutator::MutateUtf8String, mutator_, _1,
+ size_increase_hint_));
+ } else {
+ RepeatMutate(value, std::bind(&Mutator::MutateString, mutator_, _1,
+ size_increase_hint_));
+ }
+ }
+
+ void Mutate(std::unique_ptr<Message>* message) const {
+ assert(!enforce_changes_);
+ assert(*message);
+ if (GetRandomBool(mutator_->random(), 100)) return;
+ mutator_->Mutate(message->get(), size_increase_hint_);
+ }
+
+ private:
+ template <class T, class F>
+ void RepeatMutate(T* value, F mutate,
+ size_t unchanged_one_out_of = 100) const {
+ if (!enforce_changes_ &&
+ GetRandomBool(mutator_->random(), unchanged_one_out_of)) {
+ return;
+ }
+ T tmp = *value;
+ for (int i = 0; i < 10; ++i) {
+ *value = mutate(*value);
+ if (!enforce_changes_ || *value != tmp) return;
+ }
+ }
+
+ size_t size_increase_hint_;
+ size_t enforce_changes_;
+ bool enforce_utf8_strings_;
+ Mutator* mutator_;
+};
+
+namespace {
+
+struct MutateField : public FieldFunction<MutateField> {
+ template <class T>
+ void ForType(const FieldInstance& field, size_t size_increase_hint,
+ Mutator* mutator) const {
+ T value;
+ field.Load(&value);
+ FieldMutator(size_increase_hint, true, field.EnforceUtf8(), mutator)
+ .Mutate(&value);
+ field.Store(value);
+ }
+};
+
+struct CreateField : public FieldFunction<CreateField> {
+ public:
+ template <class T>
+ void ForType(const FieldInstance& field, size_t size_increase_hint,
+ Mutator* mutator) const {
+ T value;
+ field.GetDefault(&value);
+ FieldMutator field_mutator(size_increase_hint,
+ false /* defaults could be useful */,
+ field.EnforceUtf8(), mutator);
+ field_mutator.Mutate(&value);
+ field.Create(value);
+ }
+};
+
+} // namespace
+
+Mutator::Mutator(RandomEngine* random) : random_(random) {}
+
+void Mutator::Mutate(Message* message, size_t size_increase_hint) {
+ bool repeat;
+ do {
+ repeat = false;
+ MutationSampler mutation(keep_initialized_, random_, message);
+ switch (mutation.mutation()) {
+ case Mutation::None:
+ break;
+ case Mutation::Add:
+ CreateField()(mutation.field(), size_increase_hint / 2, this);
+ break;
+ case Mutation::Mutate:
+ MutateField()(mutation.field(), size_increase_hint / 2, this);
+ break;
+ case Mutation::Delete:
+ DeleteField()(mutation.field());
+ break;
+ case Mutation::Copy: {
+ DataSourceSampler source(mutation.field(), random_, message);
+ if (source.IsEmpty()) {
+ repeat = true;
+ break;
+ }
+ CopyField()(source.field(), mutation.field());
+ break;
+ }
+ default:
+ assert(false && "unexpected mutation");
+ }
+ } while (repeat);
+
+ InitializeAndTrim(message, kMaxInitializeDepth);
+ assert(!keep_initialized_ || message->IsInitialized());
+}
+
+void Mutator::CrossOver(const protobuf::Message& message1,
+ protobuf::Message* message2) {
+ // CrossOver can produce result which still equals to inputs. So we backup
+ // message2 to later comparison. message1 is already constant.
+ std::unique_ptr<protobuf::Message> message2_copy(message2->New());
+ message2_copy->CopyFrom(*message2);
+
+ CrossOverImpl(message1, message2);
+
+ InitializeAndTrim(message2, kMaxInitializeDepth);
+ assert(!keep_initialized_ || message2->IsInitialized());
+
+ // Can't call mutate from crossover because of a bug in libFuzzer.
+ return;
+ // if (MessageDifferencer::Equals(*message2_copy, *message2) ||
+ // MessageDifferencer::Equals(message1, *message2)) {
+ // Mutate(message2, 0);
+ // }
+}
+
+void Mutator::CrossOverImpl(const protobuf::Message& message1,
+ protobuf::Message* message2) {
+ const Descriptor* descriptor = message2->GetDescriptor();
+ const Reflection* reflection = message2->GetReflection();
+ assert(message1.GetDescriptor() == descriptor);
+ assert(message1.GetReflection() == reflection);
+
+ for (int i = 0; i < descriptor->field_count(); ++i) {
+ const FieldDescriptor* field = descriptor->field(i);
+
+ if (field->is_repeated()) {
+ const int field_size1 = reflection->FieldSize(message1, field);
+ int field_size2 = reflection->FieldSize(*message2, field);
+ for (int j = 0; j < field_size1; ++j) {
+ ConstFieldInstance source(&message1, field, j);
+ FieldInstance destination(message2, field, field_size2++);
+ AppendField()(source, destination);
+ }
+
+ assert(field_size2 == reflection->FieldSize(*message2, field));
+
+ // Shuffle
+ for (int j = 0; j < field_size2; ++j) {
+ if (int k = GetRandomIndex(random_, field_size2 - j)) {
+ reflection->SwapElements(message2, field, j, j + k);
+ }
+ }
+
+ int keep = GetRandomIndex(random_, field_size2 + 1);
+
+ if (field->cpp_type() == FieldDescriptor::CPPTYPE_MESSAGE) {
+ int remove = field_size2 - keep;
+ // Cross some message to keep with messages to remove.
+ int cross = GetRandomIndex(random_, std::min(keep, remove) + 1);
+ for (int j = 0; j < cross; ++j) {
+ int k = GetRandomIndex(random_, keep);
+ int r = keep + GetRandomIndex(random_, remove);
+ assert(k != r);
+ CrossOverImpl(reflection->GetRepeatedMessage(*message2, field, r),
+ reflection->MutableRepeatedMessage(message2, field, k));
+ }
+ }
+
+ for (int j = keep; j < field_size2; ++j)
+ reflection->RemoveLast(message2, field);
+ assert(keep == reflection->FieldSize(*message2, field));
+
+ } else if (field->cpp_type() == FieldDescriptor::CPPTYPE_MESSAGE) {
+ if (!reflection->HasField(message1, field)) {
+ if (GetRandomBool(random_))
+ DeleteField()(FieldInstance(message2, field));
+ } else if (!reflection->HasField(*message2, field)) {
+ if (GetRandomBool(random_)) {
+ ConstFieldInstance source(&message1, field);
+ CopyField()(source, FieldInstance(message2, field));
+ }
+ } else {
+ CrossOverImpl(reflection->GetMessage(message1, field),
+ reflection->MutableMessage(message2, field));
+ }
+ } else {
+ if (GetRandomBool(random_)) {
+ if (reflection->HasField(message1, field)) {
+ ConstFieldInstance source(&message1, field);
+ CopyField()(source, FieldInstance(message2, field));
+ } else {
+ DeleteField()(FieldInstance(message2, field));
+ }
+ }
+ }
+ }
+}
+
+void Mutator::InitializeAndTrim(Message* message, int max_depth) {
+ const Descriptor* descriptor = message->GetDescriptor();
+ const Reflection* reflection = message->GetReflection();
+ for (int i = 0; i < descriptor->field_count(); ++i) {
+ const FieldDescriptor* field = descriptor->field(i);
+ if (keep_initialized_ && field->is_required() &&
+ !reflection->HasField(*message, field))
+ CreateDefaultField()(FieldInstance(message, field));
+
+ if (field->cpp_type() == FieldDescriptor::CPPTYPE_MESSAGE) {
+ if (max_depth <= 0 && !field->is_required()) {
+ // Clear deep optional fields to avoid stack overflow.
+ reflection->ClearField(message, field);
+ if (field->is_repeated())
+ assert(!reflection->FieldSize(*message, field));
+ else
+ assert(!reflection->HasField(*message, field));
+ continue;
+ }
+
+ if (field->is_repeated()) {
+ const int field_size = reflection->FieldSize(*message, field);
+ for (int j = 0; j < field_size; ++j) {
+ Message* nested_message =
+ reflection->MutableRepeatedMessage(message, field, j);
+ InitializeAndTrim(nested_message, max_depth - 1);
+ }
+ } else if (reflection->HasField(*message, field)) {
+ Message* nested_message = reflection->MutableMessage(message, field);
+ InitializeAndTrim(nested_message, max_depth - 1);
+ }
+ }
+ }
+}
+
+int32_t Mutator::MutateInt32(int32_t value) { return FlipBit(value, random_); }
+
+int64_t Mutator::MutateInt64(int64_t value) { return FlipBit(value, random_); }
+
+uint32_t Mutator::MutateUInt32(uint32_t value) {
+ return FlipBit(value, random_);
+}
+
+uint64_t Mutator::MutateUInt64(uint64_t value) {
+ return FlipBit(value, random_);
+}
+
+float Mutator::MutateFloat(float value) { return FlipBit(value, random_); }
+
+double Mutator::MutateDouble(double value) { return FlipBit(value, random_); }
+
+bool Mutator::MutateBool(bool value) { return !value; }
+
+size_t Mutator::MutateEnum(size_t index, size_t item_count) {
+ if (item_count <= 1) return 0;
+ return (index + 1 + GetRandomIndex(random_, item_count - 1)) % item_count;
+}
+
+std::string Mutator::MutateString(const std::string& value,
+ size_t size_increase_hint) {
+ std::string result = value;
+
+ while (!result.empty() && GetRandomBool(random_)) {
+ result.erase(GetRandomIndex(random_, result.size()), 1);
+ }
+
+ while (result.size() < size_increase_hint && GetRandomBool(random_)) {
+ size_t index = GetRandomIndex(random_, result.size() + 1);
+ result.insert(result.begin() + index, GetRandomIndex(random_, 1 << 8));
+ }
+
+ if (result != value) return result;
+
+ if (result.empty()) {
+ result.push_back(GetRandomIndex(random_, 1 << 8));
+ return result;
+ }
+
+ if (!result.empty())
+ FlipBit(result.size(), reinterpret_cast<uint8_t*>(&result[0]), random_);
+ return result;
+}
+
+std::string Mutator::MutateUtf8String(const std::string& value,
+ size_t size_increase_hint) {
+ std::string str = MutateString(value, size_increase_hint);
+ FixUtf8String(&str, random_);
+ return str;
+}
+
+} // namespace protobuf_mutator
diff --git a/src/mutator.h b/src/mutator.h
new file mode 100644
index 0000000..47139bd
--- /dev/null
+++ b/src/mutator.h
@@ -0,0 +1,93 @@
+// Copyright 2016 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef SRC_MUTATOR_H_
+#define SRC_MUTATOR_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <memory>
+#include <random>
+#include <string>
+
+#include "port/protobuf.h"
+#include "src/random.h"
+
+namespace protobuf_mutator {
+
+// Randomly makes incremental change in the given protobuf.
+// Usage example:
+// protobuf_mutator::Mutator mutator(1);
+// MyMessage message;
+// message.ParseFromString(encoded_message);
+// mutator.Mutate(&message, 10000);
+//
+// Class implements very basic mutations of fields. E.g. it just flips bits for
+// integers, floats and strings. Also it increases, decreases size of
+// strings only by one. For better results users should override
+// protobuf_mutator::Mutator::Mutate* methods with more useful logic, e.g. using
+// library like libFuzzer.
+class Mutator {
+ public:
+ // seed: value to initialize random number generator.
+ explicit Mutator(RandomEngine* random);
+ virtual ~Mutator() = default;
+
+ // message: message to mutate.
+ // size_increase_hint: approximate number of bytes which can be added to the
+ // message. Method does not guarantee that real result size increase will be
+ // less than the value. It only changes probabilities of mutations which can
+ // cause size increase. Caller could repeat mutation if result was larger than
+ // requested.
+ void Mutate(protobuf::Message* message, size_t size_increase_hint);
+
+ void CrossOver(const protobuf::Message& message1,
+ protobuf::Message* message2);
+
+ protected:
+ // TODO(vitalybuka): Consider to replace with single mutate (uint8_t*, size).
+ virtual int32_t MutateInt32(int32_t value);
+ virtual int64_t MutateInt64(int64_t value);
+ virtual uint32_t MutateUInt32(uint32_t value);
+ virtual uint64_t MutateUInt64(uint64_t value);
+ virtual float MutateFloat(float value);
+ virtual double MutateDouble(double value);
+ virtual bool MutateBool(bool value);
+ virtual size_t MutateEnum(size_t index, size_t item_count);
+ virtual std::string MutateString(const std::string& value,
+ size_t size_increase_hint);
+
+ // TODO(vitalybuka): Allow user to control proto level mutations:
+ // * Callbacks to recursive traversal.
+ // * Callbacks for particular proto level mutations.
+
+ RandomEngine* random() { return random_; }
+
+ private:
+ friend class FieldMutator;
+ friend class TestMutator;
+ void InitializeAndTrim(protobuf::Message* message, int max_depth);
+ void CrossOverImpl(const protobuf::Message& message1,
+ protobuf::Message* message2);
+ std::string MutateUtf8String(const std::string& value,
+ size_t size_increase_hint);
+
+ bool keep_initialized_ = true;
+ RandomEngine* random_;
+};
+
+} // namespace protobuf_mutator
+
+#endif // SRC_MUTATOR_H_
diff --git a/src/mutator_test.cc b/src/mutator_test.cc
new file mode 100644
index 0000000..34766c6
--- /dev/null
+++ b/src/mutator_test.cc
@@ -0,0 +1,647 @@
+// Copyright 2016 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "src/mutator.h"
+
+#include <algorithm>
+#include <set>
+#include <string>
+#include <tuple>
+#include <utility>
+#include <vector>
+
+#include "port/gtest.h"
+#include "src/binary_format.h"
+#include "src/mutator_test_proto2.pb.h"
+#include "src/mutator_test_proto3.pb.h"
+#include "src/text_format.h"
+
+namespace protobuf_mutator {
+
+using protobuf::util::MessageDifferencer;
+using testing::TestWithParam;
+using testing::ValuesIn;
+
+const char kMessages[] = R"(
+ required_msg {}
+ optional_msg {}
+ repeated_msg {}
+ repeated_msg {required_sint32: 56}
+ repeated_msg {}
+ repeated_msg {
+ required_msg {}
+ optional_msg {}
+ repeated_msg {}
+ repeated_msg { required_int32: 67 }
+ repeated_msg {}
+ }
+)";
+
+const char kMessagesProto3[] = R"(
+ optional_msg {}
+ repeated_msg {}
+ repeated_msg {optional_sint32: 56}
+ repeated_msg {}
+ repeated_msg {
+ optional_msg {}
+ repeated_msg {}
+ repeated_msg { optional_int32: 67 }
+ repeated_msg {}
+ }
+)";
+
+const char kRequiredFields[] = R"(
+ required_double: 1.26685288449177e-313
+ required_float: 5.9808638e-39
+ required_int32: 67
+ required_int64: 5285068
+ required_uint32: 14486213
+ required_uint64: 520229415
+ required_sint32: 56
+ required_sint64: -6057486163525532641
+ required_fixed32: 8812173
+ required_fixed64: 273731277756
+ required_sfixed32: 43142
+ required_sfixed64: 132
+ required_bool: false
+ required_string: "qwert"
+ required_bytes: "asdf"
+)";
+
+const char kOptionalFields[] = R"(
+ optional_double: 1.93177850152856e-314
+ optional_float: 4.7397519e-41
+ optional_int32: 40020
+ optional_int64: 10
+ optional_uint32: 40
+ optional_uint64: 159
+ optional_sint32: 44015
+ optional_sint64: 17493625000076
+ optional_fixed32: 193
+ optional_fixed64: 8542688694448488723
+ optional_sfixed32: 4926
+ optional_sfixed64: 60
+ optional_bool: true
+ optional_string: "QWERT"
+ optional_bytes: "ASDF"
+ optional_enum: ENUM_5
+)";
+
+const char kRepeatedFields[] = R"(
+ repeated_double: 1.93177850152856e-314
+ repeated_double: 1.26685288449177e-313
+ repeated_float: 4.7397519e-41
+ repeated_float: 5.9808638e-39
+ repeated_int32: 40020
+ repeated_int32: 67
+ repeated_int64: 10
+ repeated_int64: 5285068
+ repeated_uint32: 40
+ repeated_uint32: 14486213
+ repeated_uint64: 159
+ repeated_uint64: 520229415
+ repeated_sint32: 44015
+ repeated_sint32: 56
+ repeated_sint64: 17493625000076
+ repeated_sint64: -6057486163525532641
+ repeated_fixed32: 193
+ repeated_fixed32: 8812173
+ repeated_fixed64: 8542688694448488723
+ repeated_fixed64: 273731277756
+ repeated_sfixed32: 4926
+ repeated_sfixed32: 43142
+ repeated_sfixed64: 60
+ repeated_sfixed64: 132
+ repeated_bool: false
+ repeated_bool: true
+ repeated_string: "QWERT"
+ repeated_string: "qwert"
+ repeated_bytes: "ASDF"
+ repeated_bytes: "asdf"
+ repeated_enum: ENUM_5
+ repeated_enum: ENUM_4
+)";
+
+const char kRequiredNestedFields[] = R"(
+ required_int32: 123
+ optional_msg {
+ required_double: 1.26685288449177e-313
+ required_float: 5.9808638e-39
+ required_int32: 67
+ required_int64: 5285068
+ required_uint32: 14486213
+ required_uint64: 520229415
+ required_sint32: 56
+ required_sint64: -6057486163525532641
+ required_fixed32: 8812173
+ required_fixed64: 273731277756
+ required_sfixed32: 43142
+ required_sfixed64: 132
+ required_bool: false
+ required_string: "qwert"
+ required_bytes: "asdf"
+ }
+)";
+
+const char kOptionalNestedFields[] = R"(
+ optional_int32: 123
+ optional_msg {
+ optional_double: 1.93177850152856e-314
+ optional_float: 4.7397519e-41
+ optional_int32: 40020
+ optional_int64: 10
+ optional_uint32: 40
+ optional_uint64: 159
+ optional_sint32: 44015
+ optional_sint64: 17493625000076
+ optional_fixed32: 193
+ optional_fixed64: 8542688694448488723
+ optional_sfixed32: 4926
+ optional_sfixed64: 60
+ optional_bool: true
+ optional_string: "QWERT"
+ optional_bytes: "ASDF"
+ optional_enum: ENUM_5
+ }
+)";
+
+const char kRepeatedNestedFields[] = R"(
+ optional_int32: 123
+ optional_msg {
+ repeated_double: 1.93177850152856e-314
+ repeated_double: 1.26685288449177e-313
+ repeated_float: 4.7397519e-41
+ repeated_float: 5.9808638e-39
+ repeated_int32: 40020
+ repeated_int32: 67
+ repeated_int64: 10
+ repeated_int64: 5285068
+ repeated_uint32: 40
+ repeated_uint32: 14486213
+ repeated_uint64: 159
+ repeated_uint64: 520229415
+ repeated_sint32: 44015
+ repeated_sint32: 56
+ repeated_sint64: 17493625000076
+ repeated_sint64: -6057486163525532641
+ repeated_fixed32: 193
+ repeated_fixed32: 8812173
+ repeated_fixed64: 8542688694448488723
+ repeated_fixed64: 273731277756
+ repeated_sfixed32: 4926
+ repeated_sfixed32: 43142
+ repeated_sfixed64: 60
+ repeated_sfixed64: 132
+ repeated_bool: false
+ repeated_bool: true
+ repeated_string: "QWERT"
+ repeated_string: "qwert"
+ repeated_bytes: "ASDF"
+ repeated_bytes: "asdf"
+ repeated_enum: ENUM_5
+ repeated_enum: ENUM_4
+ }
+)";
+
+class TestMutator : public Mutator {
+ public:
+ explicit TestMutator(bool keep_initialized) : Mutator(&random_), random_(17) {
+ keep_initialized_ = keep_initialized;
+ }
+
+ // Avoids dedup logic for some tests.
+ void NoDeDupCrossOver(const protobuf::Message& message1,
+ protobuf::Message* message2) {
+ CrossOverImpl(message1, message2);
+ }
+
+ private:
+ RandomEngine random_;
+};
+
+class ReducedTestMutator : public TestMutator {
+ public:
+ ReducedTestMutator() : TestMutator(false) {
+ for (float i = 1000; i > 0.1; i /= 7) {
+ values_.push_back(i);
+ values_.push_back(-i);
+ }
+ values_.push_back(-1.0);
+ values_.push_back(0.0);
+ values_.push_back(1.0);
+ }
+
+ protected:
+ int32_t MutateInt32(int32_t value) override { return GetRandomValue(); }
+ int64_t MutateInt64(int64_t value) override { return GetRandomValue(); }
+ uint32_t MutateUInt32(uint32_t value) override {
+ return fabs(GetRandomValue());
+ }
+ uint64_t MutateUInt64(uint64_t value) override {
+ return fabs(GetRandomValue());
+ }
+ float MutateFloat(float value) override { return GetRandomValue(); }
+ double MutateDouble(double value) override { return GetRandomValue(); }
+ std::string MutateString(const std::string& value,
+ size_t size_increase_hint) override {
+ return strings_[std::uniform_int_distribution<uint8_t>(
+ 0, strings_.size() - 1)(*random())];
+ }
+
+ private:
+ float GetRandomValue() {
+ return values_[std::uniform_int_distribution<uint8_t>(
+ 0, values_.size() - 1)(*random())];
+ }
+
+ std::vector<float> values_;
+ std::vector<std::string> strings_ = {
+ "", "\001", "\000", "a", "b", "ab",
+ };
+};
+
+std::vector<std::string> Split(const std::string& str) {
+ std::istringstream iss(str);
+ std::vector<std::string> result;
+ for (std::string line; std::getline(iss, line, '\n');) result.push_back(line);
+ return result;
+}
+
+using TestParams = std::tuple<const protobuf::Message*, const char*, size_t>;
+
+template <class T>
+std::vector<TestParams> GetFieldTestParams(
+ const std::vector<const char*>& tests) {
+ std::vector<TestParams> results;
+ for (auto t : tests) {
+ auto lines = Split(t);
+ for (size_t i = 0; i != lines.size(); ++i) {
+ if (lines[i].find(':') != std::string::npos)
+ results.push_back(std::make_tuple(&T::default_instance(), t, i));
+ }
+ }
+ return results;
+}
+
+template <class T>
+std::vector<TestParams> GetMessageTestParams(
+ const std::vector<const char*>& tests) {
+ std::vector<TestParams> results;
+ for (auto t : tests) {
+ auto lines = Split(t);
+ for (size_t i = 0; i != lines.size(); ++i) {
+ if (lines[i].find("{}") != std::string::npos)
+ results.push_back(std::make_tuple(&T::default_instance(), t, i));
+ }
+ }
+ return results;
+}
+
+bool Mutate(const protobuf::Message& from, const protobuf::Message& to) {
+ EXPECT_FALSE(MessageDifferencer::Equals(from, to));
+ ReducedTestMutator mutator;
+ std::unique_ptr<protobuf::Message> message(from.New());
+ for (int j = 0; j < 1000000; ++j) {
+ message->CopyFrom(from);
+ mutator.Mutate(message.get(), 1000);
+ if (MessageDifferencer::Equals(*message, to)) return true;
+ }
+
+ ADD_FAILURE() << "Failed to get from:\n"
+ << SaveMessageAsText(from) << "\nto:\n"
+ << SaveMessageAsText(to);
+ return false;
+}
+
+class MutatorTest : public TestWithParam<TestParams> {
+ protected:
+ void SetUp() override {
+ m1_.reset(std::get<0>(GetParam())->New());
+ m2_.reset(std::get<0>(GetParam())->New());
+ text_ = std::get<1>(GetParam());
+ line_ = std::get<2>(GetParam());
+ }
+
+ void LoadMessage(protobuf::Message* message) {
+ EXPECT_TRUE(ParseTextMessage(text_, message));
+ }
+
+ bool LoadWithoutLine(protobuf::Message* message) {
+ std::ostringstream oss;
+ auto lines = Split(text_);
+ for (size_t i = 0; i != lines.size(); ++i) {
+ if (i != line_) oss << lines[i] << '\n';
+ }
+ return ParseTextMessage(oss.str(), message);
+ }
+
+ bool LoadWithChangedLine(protobuf::Message* message, int value) {
+ auto lines = Split(text_);
+ std::ostringstream oss;
+ for (size_t i = 0; i != lines.size(); ++i) {
+ if (i != line_) {
+ oss << lines[i] << '\n';
+ } else {
+ std::string s = lines[i];
+ s.resize(s.find(':') + 2);
+
+ if (lines[i].back() == '\"') {
+ // strings
+ s += value ? "\"\\" + std::to_string(value) + "\"" : "\"\"";
+ } else if (lines[i].back() == 'e') {
+ // bools
+ s += value ? "true" : "false";
+ } else {
+ s += std::to_string(value);
+ }
+ oss << s << '\n';
+ }
+ }
+ return ParseTextMessage(oss.str(), message);
+ }
+
+ std::string text_;
+ size_t line_;
+ std::unique_ptr<protobuf::Message> m1_;
+ std::unique_ptr<protobuf::Message> m2_;
+};
+
+// These tests are irrelevant for Proto3 as it has no required fields and
+// insertion/deletion.
+
+class MutatorFieldInsDelTest : public MutatorTest {};
+INSTANTIATE_TEST_CASE_P(Proto2, MutatorFieldInsDelTest,
+ ValuesIn(GetFieldTestParams<Msg>(
+ {kRequiredFields, kOptionalFields, kRepeatedFields,
+ kRequiredNestedFields, kOptionalNestedFields,
+ kRepeatedNestedFields})));
+
+TEST_P(MutatorFieldInsDelTest, DeleteField) {
+ LoadMessage(m1_.get());
+ LoadWithoutLine(m2_.get());
+ EXPECT_TRUE(Mutate(*m1_, *m2_));
+}
+
+TEST_P(MutatorFieldInsDelTest, InsertField) {
+ LoadWithoutLine(m1_.get());
+ LoadWithChangedLine(m2_.get(), 0);
+ EXPECT_TRUE(Mutate(*m1_, *m2_));
+}
+
+class MutatorFieldTest : public MutatorTest {
+ public:
+ template <class Msg>
+ void TestCopyField();
+};
+INSTANTIATE_TEST_CASE_P(Proto2, MutatorFieldTest,
+ ValuesIn(GetFieldTestParams<Msg>(
+ {kRequiredFields, kOptionalFields, kRepeatedFields,
+ kRequiredNestedFields, kOptionalNestedFields,
+ kRepeatedNestedFields})));
+INSTANTIATE_TEST_CASE_P(Proto3, MutatorFieldTest,
+ ValuesIn(GetFieldTestParams<Msg3>(
+ {kOptionalFields, kRepeatedFields,
+ kOptionalNestedFields, kRepeatedNestedFields})));
+
+TEST_P(MutatorFieldTest, Initialized) {
+ LoadWithoutLine(m1_.get());
+ TestMutator mutator(true);
+ mutator.Mutate(m1_.get(), 1000);
+ EXPECT_TRUE(m1_->IsInitialized());
+}
+
+TEST_P(MutatorFieldTest, ChangeField) {
+ LoadWithChangedLine(m1_.get(), 0);
+ LoadWithChangedLine(m2_.get(), 1);
+ EXPECT_TRUE(Mutate(*m1_, *m2_));
+ EXPECT_TRUE(Mutate(*m2_, *m1_));
+}
+
+template <class Msg>
+void MutatorFieldTest::TestCopyField() {
+ LoadWithChangedLine(m1_.get(), 7);
+ LoadWithChangedLine(m2_.get(), 0);
+
+ Msg from;
+ from.add_repeated_msg()->CopyFrom(*m1_);
+ from.add_repeated_msg()->CopyFrom(*m2_);
+
+ Msg to;
+ to.add_repeated_msg()->CopyFrom(*m1_);
+ to.add_repeated_msg()->CopyFrom(*m1_);
+ EXPECT_TRUE(Mutate(from, to));
+
+ to.Clear();
+ to.add_repeated_msg()->CopyFrom(*m2_);
+ to.add_repeated_msg()->CopyFrom(*m2_);
+ EXPECT_TRUE(Mutate(from, to));
+}
+
+TEST_P(MutatorFieldTest, CopyField) {
+ if (m1_->GetDescriptor() == Msg::descriptor())
+ TestCopyField<Msg>();
+ else
+ TestCopyField<Msg3>();
+}
+
+class MutatorSingleFieldTest : public MutatorTest {};
+INSTANTIATE_TEST_CASE_P(Proto2, MutatorSingleFieldTest,
+ ValuesIn(GetFieldTestParams<Msg>({
+ kRequiredFields, kOptionalFields,
+ kRequiredNestedFields, kOptionalNestedFields,
+ })));
+INSTANTIATE_TEST_CASE_P(Proto3, MutatorSingleFieldTest,
+ ValuesIn(GetFieldTestParams<Msg3>({
+ kOptionalFields, kOptionalNestedFields,
+ })));
+
+TEST_P(MutatorSingleFieldTest, CrossOver) {
+ LoadWithoutLine(m1_.get());
+ LoadMessage(m2_.get());
+
+ EXPECT_FALSE(MessageDifferencer::Equals(*m1_, *m2_));
+ TestMutator mutator(false);
+
+ int match_m1_ = 0;
+ int match_m2_ = 0;
+ int iterations = 1000;
+ std::unique_ptr<protobuf::Message> message(m1_->New());
+ for (int j = 0; j < iterations; ++j) {
+ message->CopyFrom(*m1_);
+ mutator.NoDeDupCrossOver(*m2_, message.get());
+ if (MessageDifferencer::Equals(*message, *m2_)) ++match_m2_;
+ if (MessageDifferencer::Equals(*message, *m1_)) ++match_m1_;
+ }
+
+ EXPECT_LT(iterations * .4, match_m1_);
+ EXPECT_GE(iterations * .6, match_m1_);
+ EXPECT_LT(iterations * .4, match_m2_);
+ EXPECT_GE(iterations * .6, match_m2_);
+}
+
+template <typename T>
+class MutatorTypedTest : public ::testing::Test {
+ public:
+ using Message = T;
+};
+
+using MutatorTypedTestTypes = testing::Types<Msg, Msg3>;
+TYPED_TEST_CASE(MutatorTypedTest, MutatorTypedTestTypes);
+
+TYPED_TEST(MutatorTypedTest, CrossOverRepeated) {
+ typename TestFixture::Message m1;
+ m1.add_repeated_int32(1);
+ m1.add_repeated_int32(2);
+ m1.add_repeated_int32(3);
+
+ typename TestFixture::Message m2;
+ m2.add_repeated_int32(4);
+ m2.add_repeated_int32(5);
+ m2.add_repeated_int32(6);
+
+ int iterations = 10000;
+ std::set<std::set<int>> sets;
+ TestMutator mutator(false);
+ for (int j = 0; j < iterations; ++j) {
+ typename TestFixture::Message message;
+ message.CopyFrom(m1);
+ mutator.NoDeDupCrossOver(m2, &message);
+ sets.insert(
+ {message.repeated_int32().begin(), message.repeated_int32().end()});
+ }
+
+ EXPECT_EQ(1u << 6, sets.size());
+}
+
+TYPED_TEST(MutatorTypedTest, CrossOverRepeatedMessages) {
+ typename TestFixture::Message m1;
+ auto* rm1 = m1.add_repeated_msg();
+ rm1->add_repeated_int32(1);
+ rm1->add_repeated_int32(2);
+
+ typename TestFixture::Message m2;
+ auto* rm2 = m2.add_repeated_msg();
+ rm2->add_repeated_int32(3);
+ rm2->add_repeated_int32(4);
+ rm2->add_repeated_int32(5);
+ rm2->add_repeated_int32(6);
+
+ int iterations = 10000;
+ std::set<std::set<int>> sets;
+ TestMutator mutator(false);
+ for (int j = 0; j < iterations; ++j) {
+ typename TestFixture::Message message;
+ message.CopyFrom(m1);
+ mutator.NoDeDupCrossOver(m2, &message);
+ for (const auto& msg : message.repeated_msg())
+ sets.insert({msg.repeated_int32().begin(), msg.repeated_int32().end()});
+ }
+
+ EXPECT_EQ(1u << 6, sets.size());
+}
+
+TYPED_TEST(MutatorTypedTest, FailedMutations) {
+ TestMutator mutator(false);
+ size_t crossovers = 0;
+ for (int i = 0; i < 10000; ++i) {
+ typename TestFixture::Message messages[2];
+ typename TestFixture::Message tmp;
+ for (int j = 0; j < 20; ++j) {
+ for (auto& m : messages) {
+ tmp.CopyFrom(m);
+ mutator.Mutate(&m, 1000);
+ // Mutate must not produce the same result.
+ EXPECT_FALSE(MessageDifferencer::Equals(m, tmp));
+ }
+ }
+
+ tmp.CopyFrom(messages[1]);
+ mutator.CrossOver(messages[0], &tmp);
+ if (MessageDifferencer::Equals(tmp, messages[1]) ||
+ MessageDifferencer::Equals(tmp, messages[0]))
+ ++crossovers;
+ }
+
+ // CrossOver may fail but very rare.
+ EXPECT_LT(crossovers, 100u);
+}
+
+TYPED_TEST(MutatorTypedTest, Serialization) {
+ TestMutator mutator(false);
+ for (int i = 0; i < 10000; ++i) {
+ typename TestFixture::Message message;
+ for (int j = 0; j < 5; ++j) {
+ mutator.Mutate(&message, 1000);
+ typename TestFixture::Message parsed;
+
+ EXPECT_TRUE(ParseTextMessage(SaveMessageAsText(message), &parsed));
+ EXPECT_TRUE(MessageDifferencer::Equals(parsed, message));
+
+ EXPECT_TRUE(ParseBinaryMessage(SaveMessageAsBinary(message), &parsed));
+ EXPECT_TRUE(MessageDifferencer::Equals(parsed, message));
+ }
+ }
+}
+
+class MutatorMessagesTest : public MutatorTest {};
+INSTANTIATE_TEST_CASE_P(Proto2, MutatorMessagesTest,
+ ValuesIn(GetMessageTestParams<Msg>({kMessages})));
+INSTANTIATE_TEST_CASE_P(
+ Proto3, MutatorMessagesTest,
+ ValuesIn(GetMessageTestParams<Msg3>({kMessagesProto3})));
+
+TEST_P(MutatorMessagesTest, DeletedMessage) {
+ LoadMessage(m1_.get());
+ LoadWithoutLine(m2_.get());
+ EXPECT_TRUE(Mutate(*m1_, *m2_));
+}
+
+TEST_P(MutatorMessagesTest, InsertMessage) {
+ LoadWithoutLine(m1_.get());
+ LoadMessage(m2_.get());
+ EXPECT_TRUE(Mutate(*m1_, *m2_));
+}
+
+// TODO(vitalybuka): Special tests for oneof.
+
+TEST(MutatorMessagesTest, UsageExample) {
+ SmallMessage message;
+ TestMutator mutator(false);
+
+ // Test that we can generate all variation of the message.
+ std::set<std::string> mutations;
+ for (int j = 0; j < 1000; ++j) {
+ mutator.Mutate(&message, 1000);
+ std::string str = SaveMessageAsText(message);
+ mutations.insert(str);
+ }
+
+ // 3 states for boolean and 5 for enum, including missing fields.
+ EXPECT_EQ(3u * 5u, mutations.size());
+}
+
+TEST(MutatorMessagesTest, EmptyMessage) {
+ EmptyMessage message;
+ TestMutator mutator(false);
+ for (int j = 0; j < 10000; ++j) mutator.Mutate(&message, 1000);
+}
+
+
+TEST(MutatorMessagesTest, Regressions) {
+ RegressionMessage message;
+ TestMutator mutator(false);
+ for (int j = 0; j < 10000; ++j) mutator.Mutate(&message, 1000);
+}
+
+} // namespace protobuf_mutator
diff --git a/src/mutator_test_proto2.proto b/src/mutator_test_proto2.proto
new file mode 100644
index 0000000..8f4d078
--- /dev/null
+++ b/src/mutator_test_proto2.proto
@@ -0,0 +1,125 @@
+syntax = "proto2";
+package protobuf_mutator;
+
+message Msg {
+ enum Enum {
+ ENUM_0 = 0;
+ ENUM_1 = 1;
+ ENUM_2 = 2;
+ ENUM_3 = 3;
+ ENUM_4 = 4;
+ ENUM_5 = 5;
+ ENUM_6 = 6;
+ ENUM_7 = 7;
+ ENUM_8 = 8;
+ ENUM_9 = 9;
+ }
+
+ message SubMsg {
+ optional int64 optional_int64 = 1;
+ }
+
+ required double required_double = 1;
+ required float required_float = 2;
+ required int32 required_int32 = 3;
+ required int64 required_int64 = 4;
+ required uint32 required_uint32 = 5;
+ required uint64 required_uint64 = 6;
+ required sint32 required_sint32 = 7;
+ required sint64 required_sint64 = 8;
+ required fixed32 required_fixed32 = 9;
+ required fixed64 required_fixed64 = 10;
+ required sfixed32 required_sfixed32 = 11;
+ required sfixed64 required_sfixed64 = 12;
+ required bool required_bool = 13;
+ required string required_string = 14;
+ required bytes required_bytes = 15;
+ required Enum required_enum = 16;
+ required SubMsg required_msg = 17;
+
+ optional double optional_double = 18;
+ optional float optional_float = 19;
+ optional int32 optional_int32 = 20;
+ optional int64 optional_int64 = 21;
+ optional uint32 optional_uint32 = 22;
+ optional uint64 optional_uint64 = 23;
+ optional sint32 optional_sint32 = 24;
+ optional sint64 optional_sint64 = 25;
+ optional fixed32 optional_fixed32 = 26;
+ optional fixed64 optional_fixed64 = 27;
+ optional sfixed32 optional_sfixed32 = 28;
+ optional sfixed64 optional_sfixed64 = 29;
+ optional bool optional_bool = 30;
+ optional string optional_string = 31;
+ optional bytes optional_bytes = 32;
+ optional Enum optional_enum = 33;
+ optional Msg optional_msg = 34;
+
+ repeated double repeated_double = 35;
+ repeated float repeated_float = 36;
+ repeated int32 repeated_int32 = 37;
+ repeated int64 repeated_int64 = 38;
+ repeated uint32 repeated_uint32 = 39;
+ repeated uint64 repeated_uint64 = 40;
+ repeated sint32 repeated_sint32 = 41;
+ repeated sint64 repeated_sint64 = 42;
+ repeated fixed32 repeated_fixed32 = 43;
+ repeated fixed64 repeated_fixed64 = 44;
+ repeated sfixed32 repeated_sfixed32 = 45;
+ repeated sfixed64 repeated_sfixed64 = 46;
+ repeated bool repeated_bool = 47;
+ repeated string repeated_string = 48;
+ repeated bytes repeated_bytes = 49;
+ repeated Enum repeated_enum = 50;
+ repeated Msg repeated_msg = 51;
+
+ oneof OneOf {
+ double oneof_double = 52;
+ float oneof_float = 53;
+ int32 oneof_int32 = 54;
+ int64 oneof_int64 = 55;
+ uint32 oneof_uint32 = 56;
+ uint64 oneof_uint64 = 57;
+ sint32 oneof_sint32 = 58;
+ sint64 oneof_sint64 = 59;
+ fixed32 oneof_fixed32 = 60;
+ fixed64 oneof_fixed64 = 61;
+ sfixed32 oneof_sfixed32 = 62;
+ sfixed64 oneof_sfixed64 = 63;
+ bool oneof_bool = 64;
+ string oneof_string = 65;
+ bytes oneof_bytes = 66;
+ Enum oneof_enum = 67;
+ Msg oneof_msg = 68;
+ }
+
+ // TODO(vitalybuka): Tests maps.
+ // map<string, uint64> map = 69;
+ // map<int32, bytes> map2 = 71;
+
+ required group Group = 70 {
+ required bool required_bool = 1;
+ optional bool optional_bool = 2;
+ repeated bool repeated_bool = 3;
+ }
+}
+
+message SmallMessage {
+ enum Enum {
+ ENUM_0 = 0;
+ ENUM_1 = 1;
+ ENUM_2 = 2;
+ ENUM_3 = 3;
+ }
+
+ optional bool opt_bool = 1;
+ optional Enum opt_enum = 2;
+}
+
+message RegressionMessage {
+ enum SingleValueEnum { ENUM_0 = 0; }
+ optional SingleValueEnum enum = 2;
+}
+
+message EmptyMessage {
+}
diff --git a/src/mutator_test_proto3.proto b/src/mutator_test_proto3.proto
new file mode 100644
index 0000000..7c7162e
--- /dev/null
+++ b/src/mutator_test_proto3.proto
@@ -0,0 +1,73 @@
+syntax = "proto3";
+package protobuf_mutator;
+
+message Msg3 {
+ enum Enum {
+ ENUM_0 = 0;
+ ENUM_1 = 1;
+ ENUM_2 = 2;
+ ENUM_3 = 3;
+ ENUM_4 = 4;
+ ENUM_5 = 5;
+ ENUM_6 = 6;
+ ENUM_7 = 7;
+ ENUM_8 = 8;
+ ENUM_9 = 9;
+ }
+
+ double optional_double = 18;
+ float optional_float = 19;
+ int32 optional_int32 = 20;
+ int64 optional_int64 = 21;
+ uint32 optional_uint32 = 22;
+ uint64 optional_uint64 = 23;
+ sint32 optional_sint32 = 24;
+ sint64 optional_sint64 = 25;
+ fixed32 optional_fixed32 = 26;
+ fixed64 optional_fixed64 = 27;
+ sfixed32 optional_sfixed32 = 28;
+ sfixed64 optional_sfixed64 = 29;
+ bool optional_bool = 30;
+ string optional_string = 31;
+ bytes optional_bytes = 32;
+ Enum optional_enum = 33;
+ Msg3 optional_msg = 34;
+
+ repeated double repeated_double = 35;
+ repeated float repeated_float = 36;
+ repeated int32 repeated_int32 = 37;
+ repeated int64 repeated_int64 = 38;
+ repeated uint32 repeated_uint32 = 39;
+ repeated uint64 repeated_uint64 = 40;
+ repeated sint32 repeated_sint32 = 41;
+ repeated sint64 repeated_sint64 = 42;
+ repeated fixed32 repeated_fixed32 = 43;
+ repeated fixed64 repeated_fixed64 = 44;
+ repeated sfixed32 repeated_sfixed32 = 45;
+ repeated sfixed64 repeated_sfixed64 = 46;
+ repeated bool repeated_bool = 47;
+ repeated string repeated_string = 48;
+ repeated bytes repeated_bytes = 49;
+ repeated Enum repeated_enum = 50;
+ repeated Msg3 repeated_msg = 51;
+
+ oneof OneOf {
+ double oneof_double = 52;
+ float oneof_float = 53;
+ int32 oneof_int32 = 54;
+ int64 oneof_int64 = 55;
+ uint32 oneof_uint32 = 56;
+ uint64 oneof_uint64 = 57;
+ sint32 oneof_sint32 = 58;
+ sint64 oneof_sint64 = 59;
+ fixed32 oneof_fixed32 = 60;
+ fixed64 oneof_fixed64 = 61;
+ sfixed32 oneof_sfixed32 = 62;
+ sfixed64 oneof_sfixed64 = 63;
+ bool oneof_bool = 64;
+ string oneof_string = 65;
+ bytes oneof_bytes = 66;
+ Enum oneof_enum = 67;
+ Msg3 oneof_msg = 68;
+ }
+}
diff --git a/src/random.h b/src/random.h
new file mode 100644
index 0000000..d4463d3
--- /dev/null
+++ b/src/random.h
@@ -0,0 +1,26 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef SRC_RANDOM_H_
+#define SRC_RANDOM_H_
+
+#include <random>
+
+namespace protobuf_mutator {
+
+using RandomEngine = std::mt19937;
+
+} // namespace protobuf_mutator
+
+#endif // SRC_RANDOM_H_
diff --git a/src/text_format.cc b/src/text_format.cc
new file mode 100644
index 0000000..9990d60
--- /dev/null
+++ b/src/text_format.cc
@@ -0,0 +1,54 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "src/text_format.h"
+#include "port/protobuf.h"
+
+namespace protobuf_mutator {
+
+using protobuf::Message;
+using protobuf::TextFormat;
+
+bool ParseTextMessage(const uint8_t* data, size_t size, Message* output) {
+ return ParseTextMessage({data, data + size}, output);
+}
+
+bool ParseTextMessage(const std::string& data, protobuf::Message* output) {
+ output->Clear();
+ TextFormat::Parser parser;
+ parser.AllowPartialMessage(true);
+ if (!parser.ParseFromString(data, output)) {
+ output->Clear();
+ return false;
+ }
+ return true;
+}
+
+size_t SaveMessageAsText(const Message& message, uint8_t* data,
+ size_t max_size) {
+ std::string result = SaveMessageAsText(message);
+ if (result.size() <= max_size) {
+ memcpy(data, result.data(), result.size());
+ return result.size();
+ }
+ return 0;
+}
+
+std::string SaveMessageAsText(const protobuf::Message& message) {
+ String tmp;
+ if (!protobuf::TextFormat::PrintToString(message, &tmp)) return {};
+ return tmp;
+}
+
+} // namespace protobuf_mutator
diff --git a/src/text_format.h b/src/text_format.h
new file mode 100644
index 0000000..319e01d
--- /dev/null
+++ b/src/text_format.h
@@ -0,0 +1,34 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef SRC_TEXT_FORMAT_H_
+#define SRC_TEXT_FORMAT_H_
+
+#include <string>
+
+#include "port/protobuf.h"
+
+namespace protobuf_mutator {
+
+// Text serialization of protos.
+bool ParseTextMessage(const uint8_t* data, size_t size,
+ protobuf::Message* output);
+bool ParseTextMessage(const std::string& data, protobuf::Message* output);
+size_t SaveMessageAsText(const protobuf::Message& message, uint8_t* data,
+ size_t max_size);
+std::string SaveMessageAsText(const protobuf::Message& message);
+
+} // namespace protobuf_mutator
+
+#endif // SRC_TEXT_FORMAT_H_
diff --git a/src/utf8_fix.cc b/src/utf8_fix.cc
new file mode 100644
index 0000000..50e6efd
--- /dev/null
+++ b/src/utf8_fix.cc
@@ -0,0 +1,90 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "src/utf8_fix.h"
+
+#include <algorithm>
+#include <cassert>
+
+namespace protobuf_mutator {
+
+namespace {
+
+void StoreCode(char* e, char32_t code, uint8_t size, uint8_t prefix) {
+ while (--size) {
+ *(--e) = 0x80 | (code & 0x3F);
+ code >>= 6;
+ }
+ *(--e) = prefix | code;
+}
+
+char* FixCode(char* b, const char* e, RandomEngine* random) {
+ const char* start = b;
+ assert(b < e);
+
+ e = std::min<const char*>(e, b + 4);
+ char32_t c = *b++;
+ for (; b < e && (*b & 0xC0) == 0x80; ++b) {
+ c = (c << 6) + (*b & 0x3F);
+ }
+ uint8_t size = b - start;
+ switch (size) {
+ case 1:
+ c &= 0x7F;
+ StoreCode(b, c, size, 0);
+ break;
+ case 2:
+ c &= 0x7FF;
+ if (c < 0x80) {
+ c = std::uniform_int_distribution<char32_t>(0x80, 0x7FF)(*random);
+ }
+ StoreCode(b, c, size, 0xC0);
+ break;
+ case 3:
+ c &= 0xFFFF;
+
+ // [0xD800, 0xE000) are reserved for UTF-16 surrogate halves.
+ if (c < 0x800 || (c >= 0xD800 && c < 0xE000)) {
+ uint32_t halves = 0xE000 - 0xD800;
+ c = std::uniform_int_distribution<char32_t>(0x800,
+ 0xFFFF - halves)(*random);
+ if (c >= 0xD800) c += halves;
+ }
+ StoreCode(b, c, size, 0xE0);
+ break;
+ case 4:
+ c &= 0x1FFFFF;
+ if (c < 0x10000 || c > 0x10FFFF) {
+ c = std::uniform_int_distribution<char32_t>(0x10000, 0x10FFFF)(*random);
+ }
+ StoreCode(b, c, size, 0xF0);
+ break;
+ default:
+ assert(false && "Unexpected size of UTF-8 sequence");
+ }
+ return b;
+}
+
+} // namespace
+
+void FixUtf8String(std::string* str, RandomEngine* random) {
+ if (str->empty()) return;
+ char* b = &(*str)[0];
+ const char* e = b + str->size();
+ while (b < e) {
+ b = FixCode(b, e, random);
+ }
+}
+
+} // namespace protobuf_mutator
diff --git a/src/utf8_fix.h b/src/utf8_fix.h
new file mode 100644
index 0000000..6637e74
--- /dev/null
+++ b/src/utf8_fix.h
@@ -0,0 +1,28 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef SRC_UTF8_FIX_H_
+#define SRC_UTF8_FIX_H_
+
+#include <string>
+
+#include "src/random.h"
+
+namespace protobuf_mutator {
+
+void FixUtf8String(std::string* str, RandomEngine* random);
+
+} // namespace protobuf_mutator
+
+#endif // SRC_UTF8_FIX_H_
diff --git a/src/utf8_fix_test.cc b/src/utf8_fix_test.cc
new file mode 100644
index 0000000..54f09cd
--- /dev/null
+++ b/src/utf8_fix_test.cc
@@ -0,0 +1,63 @@
+// Copyright 2017 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "src/utf8_fix.h"
+
+#include "port/gtest.h"
+#include "port/protobuf.h"
+
+namespace protobuf_mutator {
+
+protobuf::LogSilencer log_silincer;
+
+class FixUtf8StringTest : public ::testing::TestWithParam<int> {
+ public:
+ bool IsStructurallyValid(const std::string& s) {
+ using protobuf::internal::WireFormatLite;
+ return WireFormatLite::VerifyUtf8String(s.data(), s.length(),
+ WireFormatLite::PARSE, "");
+ }
+};
+
+TEST_F(FixUtf8StringTest, IsStructurallyValid) {
+ EXPECT_TRUE(IsStructurallyValid(""));
+ EXPECT_TRUE(IsStructurallyValid("abc"));
+ EXPECT_TRUE(IsStructurallyValid("\xC2\xA2"));
+ EXPECT_TRUE(IsStructurallyValid("\xE2\x82\xAC"));
+ EXPECT_TRUE(IsStructurallyValid("\xF0\x90\x8D\x88"));
+ EXPECT_FALSE(IsStructurallyValid("\xFF\xFF\xFF\xFF"));
+ EXPECT_FALSE(IsStructurallyValid("\xFF\x8F"));
+ EXPECT_FALSE(IsStructurallyValid("\x3F\xBF"));
+}
+
+INSTANTIATE_TEST_CASE_P(Size, FixUtf8StringTest, ::testing::Range(0, 10));
+
+TEST_P(FixUtf8StringTest, FixUtf8String) {
+ RandomEngine random(GetParam());
+ std::uniform_int_distribution<uint8_t> random8(0, 0xFF);
+
+ std::string str(random8(random), 0);
+ for (uint32_t run = 0; run < 10000; ++run) {
+ for (size_t i = 0; i < str.size(); ++i) str[i] = random8(random);
+ std::string fixed = str;
+ FixUtf8String(&fixed, &random);
+ if (IsStructurallyValid(str)) {
+ EXPECT_EQ(str, fixed);
+ } else {
+ EXPECT_TRUE(IsStructurallyValid(fixed));
+ }
+ }
+}
+
+} // namespace protobuf_mutator
diff --git a/src/weighted_reservoir_sampler.h b/src/weighted_reservoir_sampler.h
new file mode 100644
index 0000000..d272bb5
--- /dev/null
+++ b/src/weighted_reservoir_sampler.h
@@ -0,0 +1,59 @@
+// Copyright 2016 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef SRC_WEIGHTED_RESERVOIR_SAMPLER_H_
+#define SRC_WEIGHTED_RESERVOIR_SAMPLER_H_
+
+#include <cassert>
+#include <random>
+
+namespace protobuf_mutator {
+
+// Algorithm pick one item from the sequence of weighted items.
+// https://en.wikipedia.org/wiki/Reservoir_sampling#Algorithm_A-Chao
+//
+// Example:
+// WeightedReservoirSampler<int> sampler;
+// for(int i = 0; i < size; ++i)
+// sampler.Pick(weight[i], i);
+// return sampler.GetSelected();
+template <class T, class RandomEngine = std::default_random_engine>
+class WeightedReservoirSampler {
+ public:
+ explicit WeightedReservoirSampler(RandomEngine* random) : random_(random) {}
+
+ void Try(uint64_t weight, const T& item) {
+ if (Pick(weight)) selected_ = item;
+ }
+
+ const T& selected() const { return selected_; }
+
+ bool IsEmpty() const { return total_weight_ == 0; }
+
+ private:
+ bool Pick(uint64_t weight) {
+ if (weight == 0) return false;
+ total_weight_ += weight;
+ return weight == total_weight_ || std::uniform_int_distribution<uint64_t>(
+ 1, total_weight_)(*random_) <= weight;
+ }
+
+ T selected_ = {};
+ uint64_t total_weight_ = 0;
+ RandomEngine* random_;
+};
+
+} // namespace protobuf_mutator
+
+#endif // SRC_WEIGHTED_RESERVOIR_SAMPLER_H_
diff --git a/src/weighted_reservoir_sampler_test.cc b/src/weighted_reservoir_sampler_test.cc
new file mode 100644
index 0000000..e524620
--- /dev/null
+++ b/src/weighted_reservoir_sampler_test.cc
@@ -0,0 +1,75 @@
+// Copyright 2016 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "src/weighted_reservoir_sampler.h"
+
+#include <tuple>
+#include <vector>
+
+#include "port/gtest.h"
+
+using testing::TestWithParam;
+using testing::ValuesIn;
+using testing::Combine;
+using testing::Range;
+
+namespace protobuf_mutator {
+
+class WeightedReservoirSamplerTest
+ : public TestWithParam<std::tuple<int, std::vector<int>>> {};
+
+const int kRuns = 1000000;
+
+const std::vector<int> kTests[] = {
+ {1},
+ {1, 1, 1},
+ {1, 1, 0},
+ {1, 10, 100},
+ {100, 1, 10},
+ {1, 10000, 10000},
+ {1, 3, 7, 100, 105},
+ {93519, 52999, 354, 37837, 55285, 31787, 89096, 55695, 1587,
+ 18233, 77557, 67632, 59348, 51250, 17417, 96856, 78568, 44296,
+ 70170, 41328, 9206, 90187, 54086, 35602, 53167, 33791, 60118,
+ 52962, 10327, 80513, 49526, 18326, 83662, 49644, 70903, 4910,
+ 36309, 19196, 42982, 53316, 14773, 86607, 60835}};
+
+INSTANTIATE_TEST_CASE_P(AllTest, WeightedReservoirSamplerTest,
+ Combine(Range(1, 10, 3), ValuesIn(kTests)));
+
+TEST_P(WeightedReservoirSamplerTest, Test) {
+ std::vector<int> weights = std::get<1>(GetParam());
+ std::vector<int> counts(weights.size(), 0);
+
+ using RandomEngine = std::mt19937;
+ RandomEngine rand(std::get<0>(GetParam()));
+ for (int i = 0; i < kRuns; ++i) {
+ WeightedReservoirSampler<int, RandomEngine> sampler(&rand);
+ for (size_t j = 0; j < weights.size(); ++j) sampler.Try(weights[j], j);
+ ++counts[sampler.selected()];
+ }
+
+ int sum = std::accumulate(weights.begin(), weights.end(), 0);
+ for (size_t j = 0; j < weights.size(); ++j) {
+ float expected = weights[j];
+ expected /= sum;
+
+ float actual = counts[j];
+ actual /= kRuns;
+
+ EXPECT_NEAR(expected, actual, 0.01);
+ }
+}
+
+} // namespace protobuf_mutator
