Line data    Source code

       1             : // Copyright (c) 2020-2021 The Bitcoin Core developers
       2             : // Distributed under the MIT software license, see the accompanying
       3             : // file COPYING or http://www.opensource.org/licenses/mit-license.php.
       4             : 
       5             : #include <test/fuzz/FuzzedDataProvider.h>
       6             : #include <test/fuzz/fuzz.h>
       7             : #include <test/fuzz/util.h>
       8             : #include <tinyformat.h>
       9             : #include <util/strencodings.h>
      10             : #include <util/translation.h>
      11             : 
      12             : #include <algorithm>
      13             : #include <cstdint>
      14             : #include <string>
      15             : #include <vector>
      16             : 
      17           4 : FUZZ_TARGET(str_printf)
      18             : {
      19           0 :     FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
      20           0 :     const std::string format_string = fuzzed_data_provider.ConsumeRandomLengthString(64);
      21           0 :     const bilingual_str bilingual_string{format_string, format_string};
      22             : 
      23           0 :     const int digits_in_format_specifier = std::count_if(format_string.begin(), format_string.end(), IsDigit);
      24             : 
      25           2 :     // Avoid triggering the following crash bug:
      26             :     // * strprintf("%987654321000000:", 1);
      27             :     //
      28             :     // Avoid triggering the following OOM bug:
      29             :     // * strprintf("%.222222200000000$", 1.1);
      30             :     //
      31             :     // Upstream bug report: https://github.com/c42f/tinyformat/issues/70
      32           0 :     if (format_string.find('%') != std::string::npos && digits_in_format_specifier >= 7) {
      33           0 :         return;
      34             :     }
      35             : 
      36             :     // Avoid triggering the following crash bug:
      37             :     // * strprintf("%1$*1$*", -11111111);
      38             :     //
      39             :     // Upstream bug report: https://github.com/c42f/tinyformat/issues/70
      40           0 :     if (format_string.find('%') != std::string::npos && format_string.find('$') != std::string::npos && format_string.find('*') != std::string::npos && digits_in_format_specifier > 0) {
      41           0 :         return;
      42             :     }
      43             : 
      44             :     // Avoid triggering the following crash bug:
      45             :     // * strprintf("%.1s", (char*)nullptr);
      46             :     //
      47             :     // (void)strprintf(format_string, (char*)nullptr);
      48             :     //
      49             :     // Upstream bug report: https://github.com/c42f/tinyformat/issues/70
      50             : 
      51             :     try {
      52           0 :         CallOneOf(
      53             :             fuzzed_data_provider,
      54           0 :             [&] {
      55           0 :                 (void)strprintf(format_string, fuzzed_data_provider.ConsumeRandomLengthString(32));
      56           0 :                 (void)tinyformat::format(bilingual_string, fuzzed_data_provider.ConsumeRandomLengthString(32));
      57           0 :             },
      58           0 :             [&] {
      59           0 :                 (void)strprintf(format_string, fuzzed_data_provider.ConsumeRandomLengthString(32).c_str());
      60           0 :                 (void)tinyformat::format(bilingual_string, fuzzed_data_provider.ConsumeRandomLengthString(32).c_str());
      61           0 :             },
      62           0 :             [&] {
      63           0 :                 (void)strprintf(format_string, fuzzed_data_provider.ConsumeIntegral<signed char>());
      64           0 :                 (void)tinyformat::format(bilingual_string, fuzzed_data_provider.ConsumeIntegral<signed char>());
      65           0 :             },
      66           0 :             [&] {
      67           0 :                 (void)strprintf(format_string, fuzzed_data_provider.ConsumeIntegral<unsigned char>());
      68           0 :                 (void)tinyformat::format(bilingual_string, fuzzed_data_provider.ConsumeIntegral<unsigned char>());
      69           0 :             },
      70           0 :             [&] {
      71           0 :                 (void)strprintf(format_string, fuzzed_data_provider.ConsumeIntegral<char>());
      72           0 :                 (void)tinyformat::format(bilingual_string, fuzzed_data_provider.ConsumeIntegral<char>());
      73           0 :             },
      74           2 :             [&] {
      75           0 :                 (void)strprintf(format_string, fuzzed_data_provider.ConsumeBool());
      76           0 :                 (void)tinyformat::format(bilingual_string, fuzzed_data_provider.ConsumeBool());
      77           0 :             });
      78           0 :     } catch (const tinyformat::format_error&) {
      79           0 :     }
      80             : 
      81           0 :     if (format_string.find('%') != std::string::npos && format_string.find('c') != std::string::npos) {
      82             :         // Avoid triggering the following:
      83             :         // * strprintf("%c", 1.31783e+38);
      84             :         // tinyformat.h:244:36: runtime error: 1.31783e+38 is outside the range of representable values of type 'char'
      85           0 :         return;
      86             :     }
      87             : 
      88           0 :     if (format_string.find('%') != std::string::npos && format_string.find('*') != std::string::npos) {
      89             :         // Avoid triggering the following:
      90             :         // * strprintf("%*", -2.33527e+38);
      91             :         // tinyformat.h:283:65: runtime error: -2.33527e+38 is outside the range of representable values of type 'int'
      92             :         // * strprintf("%*", -2147483648);
      93             :         // tinyformat.h:763:25: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself
      94           0 :         return;
      95             :     }
      96             : 
      97             :     try {
      98           0 :         CallOneOf(
      99             :             fuzzed_data_provider,
     100           0 :             [&] {
     101           0 :                 (void)strprintf(format_string, fuzzed_data_provider.ConsumeFloatingPoint<float>());
     102           0 :                 (void)tinyformat::format(bilingual_string, fuzzed_data_provider.ConsumeFloatingPoint<float>());
     103           0 :             },
     104           0 :             [&] {
     105           0 :                 (void)strprintf(format_string, fuzzed_data_provider.ConsumeFloatingPoint<double>());
     106           0 :                 (void)tinyformat::format(bilingual_string, fuzzed_data_provider.ConsumeFloatingPoint<double>());
     107           0 :             },
     108           0 :             [&] {
     109           0 :                 (void)strprintf(format_string, fuzzed_data_provider.ConsumeIntegral<int16_t>());
     110           0 :                 (void)tinyformat::format(bilingual_string, fuzzed_data_provider.ConsumeIntegral<int16_t>());
     111           0 :             },
     112           0 :             [&] {
     113           0 :                 (void)strprintf(format_string, fuzzed_data_provider.ConsumeIntegral<uint16_t>());
     114           0 :                 (void)tinyformat::format(bilingual_string, fuzzed_data_provider.ConsumeIntegral<uint16_t>());
     115           0 :             },
     116           0 :             [&] {
     117           0 :                 (void)strprintf(format_string, fuzzed_data_provider.ConsumeIntegral<int32_t>());
     118           0 :                 (void)tinyformat::format(bilingual_string, fuzzed_data_provider.ConsumeIntegral<int32_t>());
     119           0 :             },
     120           0 :             [&] {
     121           0 :                 (void)strprintf(format_string, fuzzed_data_provider.ConsumeIntegral<uint32_t>());
     122           0 :                 (void)tinyformat::format(bilingual_string, fuzzed_data_provider.ConsumeIntegral<uint32_t>());
     123           0 :             },
     124           0 :             [&] {
     125           0 :                 (void)strprintf(format_string, fuzzed_data_provider.ConsumeIntegral<int64_t>());
     126           0 :                 (void)tinyformat::format(bilingual_string, fuzzed_data_provider.ConsumeIntegral<int64_t>());
     127           0 :             },
     128           0 :             [&] {
     129           0 :                 (void)strprintf(format_string, fuzzed_data_provider.ConsumeIntegral<uint64_t>());
     130           0 :                 (void)tinyformat::format(bilingual_string, fuzzed_data_provider.ConsumeIntegral<uint64_t>());
     131           0 :             });
     132           0 :     } catch (const tinyformat::format_error&) {
     133           0 :     }
     134           0 : }