Add simple hashbrown fuzzer. am: 5c09b7dc6d am: ec9dec08b4 am: 61407a7118
Original change: https://android-review.googlesource.com/c/platform/tools/security/+/1867152
Change-Id: I7ab9c074ac9651c75bade11d7f08e43b0640c059
diff --git a/fuzzing/orphans/hashbrown/Android.bp b/fuzzing/orphans/hashbrown/Android.bp
new file mode 100644
index 0000000..d69b019
--- /dev/null
+++ b/fuzzing/orphans/hashbrown/Android.bp
@@ -0,0 +1,26 @@
+// Copyright 2021, The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+rust_fuzz {
+ name: "hashbrown_hashmap_fuzzer",
+ srcs: ["hashbrown_hashmap_fuzzer.rs"],
+ rustlibs: [
+ "libarbitrary",
+ "libhashbrown",
+ ],
+ fuzz_config: {
+ fuzz_on_haiku_device: true,
+ fuzz_on_haiku_host: true,
+ },
+}
\ No newline at end of file
diff --git a/fuzzing/orphans/hashbrown/hashbrown_hashmap_fuzzer.rs b/fuzzing/orphans/hashbrown/hashbrown_hashmap_fuzzer.rs
new file mode 100644
index 0000000..8267cf0
--- /dev/null
+++ b/fuzzing/orphans/hashbrown/hashbrown_hashmap_fuzzer.rs
@@ -0,0 +1,87 @@
+// Copyright 2021, The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#![allow(missing_docs)]
+#![no_main]
+#![feature(bench_black_box)]
+
+use hashbrown::HashMap;
+use libfuzzer_sys::arbitrary::Arbitrary;
+use libfuzzer_sys::fuzz_target;
+
+const MAX_RESERVE: usize = 1024;
+
+#[derive(Arbitrary, Debug, Eq, Hash, PartialEq)]
+enum Data {
+ A,
+ B,
+ Int { val: u8 },
+}
+
+#[derive(Arbitrary, Debug)]
+enum HashMapMethods {
+ Insert { key: Data, value: Data },
+ Remove { key: Data },
+ ContainsKey { key: Data },
+ Get { key: Data },
+ EntryOrInsert { key: Data, value: Data },
+ Iter,
+ Drain,
+ Clear,
+ Reserve { additional: usize },
+ ShrinkToFit,
+ ShrinkTo { min_capacity: usize },
+}
+
+fuzz_target!(|commands: Vec<HashMapMethods>| {
+ let mut map = HashMap::new();
+ for command in commands {
+ match command {
+ HashMapMethods::Insert { key, value } => {
+ map.insert(key, value);
+ }
+ HashMapMethods::Remove { key } => {
+ map.remove(&key);
+ }
+ HashMapMethods::ContainsKey { key } => {
+ map.contains_key(&key);
+ }
+ HashMapMethods::Get { key } => {
+ map.get(&key);
+ }
+ HashMapMethods::EntryOrInsert { key, value } => {
+ map.entry(key).or_insert(value);
+ }
+ HashMapMethods::Iter => {
+ std::hint::black_box(map.iter().count());
+ }
+ HashMapMethods::Drain => {
+ std::hint::black_box(map.drain().count());
+ }
+ HashMapMethods::Clear => {
+ map.clear();
+ }
+ HashMapMethods::Reserve { additional } => {
+ // Avoid allocating too much memory and crashing the fuzzer.
+ map.reserve(additional % MAX_RESERVE);
+ }
+ HashMapMethods::ShrinkToFit => {
+ map.shrink_to_fit();
+ }
+ HashMapMethods::ShrinkTo { min_capacity } => {
+ map.shrink_to(min_capacity % MAX_RESERVE);
+ }
+ }
+ }
+});
