projects/boost/boost_regex_fuzzer.cc

// From https://svn.boost.org/trac10/ticket/12818
// This fuzz target can likely be enhanced to exercise more code.
// The ideal place for this fuzz target is the boost repository.
#ifdef DEBUG
#include <iostream>
#endif

#include <boost/regex.hpp>
#include <fuzzer/FuzzedDataProvider.h>

namespace {
  void assertPostConditions(boost::match_results<std::string::const_iterator> const& match, boost::regex const& e)
  {
    // See https://www.boost.org/doc/libs/1_71_0/libs/regex/doc/html/boost_regex/ref/regex_match.html
    assert(match.size() == e.mark_count() + 1);
    assert(!match.empty());
    assert(!match.prefix().matched);
    assert(!match.suffix().matched);
  }
}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
  FuzzedDataProvider fuzzed_data(Data, Size);
  // First value is length of the regex string
  size_t regex_length = fuzzed_data.ConsumeIntegral<uint8_t>();
  // Second value is regexp string whose length is `regex_length`
  std::string regex_string = fuzzed_data.ConsumeBytesAsString(regex_length);
  boost::regex e(regex_string);
  // Last value is the text to be matched
  std::string text = fuzzed_data.ConsumeRemainingBytesAsString();

#ifdef DEBUG
    std::cout << "Regexp string: " << regex_string << "Size: " << regex_string.size() << std::endl;
    std::cout << "Text: " << text << "Size: " << text.size() << std::endl;
#endif

  try {
    boost::match_results<std::string::const_iterator> what;
    bool match = boost::regex_match(text, what, e,
                       boost::match_default | boost::match_partial);
    if (match)
      assertPostConditions(what, e);
  }
  catch (const std::runtime_error &) {
  }
  return 0;
}