Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add HTMLLayout fuzzer #454

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Add HTMLLayout fuzzer #454

wants to merge 2 commits into from

Conversation

AdamKorcz
Copy link
Contributor

Adds a fuzzer for HTMLLayout.

Signed-off-by: Adam Korczynski <[email protected]>
src/fuzzers/cpp/HTMLLayoutFuzzer.cpp Outdated Show resolved Hide resolved
src/fuzzers/cpp/HTMLLayoutFuzzer.cpp Outdated Show resolved Hide resolved
std::string val4 = fdp.ConsumeRandomLengthString();
std::string ndcMessage = fdp.ConsumeRandomLengthString();
std::string loggerStr = fdp.ConsumeRandomLengthString();
std::string content = fdp.ConsumeRemainingBytesAsString();
Copy link
Contributor

@swebb2066 swebb2066 Jan 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe you need to provide a maximum length to ConsumeRandomLengthString or all subsequent calls will return an empty string.

Copy link
Contributor Author

@AdamKorcz AdamKorcz Jan 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is not the case. The fuzzer determines the length of the string in a deterministic manner. It can consist of the entire test case, but those odd cases are fine. Ref the doc:

"ConsumeRandomLengthString method returns a std::string as well, but its length is derived from the fuzz input and typically is hard to predict, though always deterministic. The caller can provide the max length argument."

https://github.com/google/fuzzing/blob/master/docs/split-inputs.md#methods-for-extracting-sequences-of-bytes

I also tested it locally and found that the non-first invocations of fdp.ConsumeRandomLengthString() do indeed generate strings.

The one that should always be last is ConsumeRemainingBytesAsString(). If it is not, then the remaining attempts to generate strings will yield empty strings like you say.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately the documentation (and the ConsumeRandomLengthString function name) is missleading. When I build XMLLayoutFuzzer with an extra line log4cxx::helpers::LogLog::debug(result); I get this result (for example):

log4cxx: <log4j:event logger="com.example.bar" timestamp="1737242190330" level="INFO" thread="0x728374e74000">
<log4j:message><![CDATA[]]></log4j:message>
<log4j:NDC><![CDATA[<envelope><faultstring><![CDATA[The EffectiveDate]]>]]&gt;<![CDATA[</faultstring><envelope>]]></log4j:NDC>
<log4j:locationInfo class="" method="LLVMFuzzerTestOneInput" file="/home/stephen/source/logging-log4cxx/src/fuzzers/cpp/XMLLayoutFuzzer.cpp" line="45"/>
<log4j:properties>
<log4j:data name=";▒" value=""/>
<log4j:data name=";▒" value=""/>
</log4j:properties>
</log4j:event>

Note also there is bug in XMLLayoutFuzzer. I believe

        // Set MDC
        log4cxx::MDC::put(key1, key2);

was supposed to be:

        // Set MDC
        log4cxx::MDC::put(key2, val2);

Signed-off-by: Adam Korczynski <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants