-
Notifications
You must be signed in to change notification settings - Fork 124
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add HTMLLayout fuzzer #454
base: master
Are you sure you want to change the base?
Conversation
Signed-off-by: Adam Korczynski <[email protected]>
std::string val4 = fdp.ConsumeRandomLengthString(); | ||
std::string ndcMessage = fdp.ConsumeRandomLengthString(); | ||
std::string loggerStr = fdp.ConsumeRandomLengthString(); | ||
std::string content = fdp.ConsumeRemainingBytesAsString(); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I believe you need to provide a maximum length to ConsumeRandomLengthString or all subsequent calls will return an empty string.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That is not the case. The fuzzer determines the length of the string in a deterministic manner. It can consist of the entire test case, but those odd cases are fine. Ref the doc:
"ConsumeRandomLengthString method returns a std::string as well, but its length is derived from the fuzz input and typically is hard to predict, though always deterministic. The caller can provide the max length argument."
I also tested it locally and found that the non-first invocations of fdp.ConsumeRandomLengthString()
do indeed generate strings.
The one that should always be last is ConsumeRemainingBytesAsString()
. If it is not, then the remaining attempts to generate strings will yield empty strings like you say.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Unfortunately the documentation (and the ConsumeRandomLengthString
function name) is missleading. When I build XMLLayoutFuzzer with an extra line log4cxx::helpers::LogLog::debug(result);
I get this result (for example):
log4cxx: <log4j:event logger="com.example.bar" timestamp="1737242190330" level="INFO" thread="0x728374e74000">
<log4j:message><![CDATA[]]></log4j:message>
<log4j:NDC><![CDATA[<envelope><faultstring><![CDATA[The EffectiveDate]]>]]><![CDATA[</faultstring><envelope>]]></log4j:NDC>
<log4j:locationInfo class="" method="LLVMFuzzerTestOneInput" file="/home/stephen/source/logging-log4cxx/src/fuzzers/cpp/XMLLayoutFuzzer.cpp" line="45"/>
<log4j:properties>
<log4j:data name=";▒" value=""/>
<log4j:data name=";▒" value=""/>
</log4j:properties>
</log4j:event>
Note also there is bug in XMLLayoutFuzzer. I believe
// Set MDC
log4cxx::MDC::put(key1, key2);
was supposed to be:
// Set MDC
log4cxx::MDC::put(key2, val2);
Signed-off-by: Adam Korczynski <[email protected]>
Adds a fuzzer for
HTMLLayout
.