While LibFuzzer supports rejecting unwanted inputs, it looks like Honggfuzz treats anything other than 0 as fatal error. https://llvm.org/docs/LibFuzzer.html#rejecting-unwanted-inputs https://github.com/google/honggfuzz/blob/348a47213919f14b9453e89a663b1515369bd9a2/libhfuzz/persistent.c#L67 This LOG_F calls exit(EXIT_FAILURE)
Unified · Split
| @@ -27,15 +27,15 @@ · 26 unmodified lines | |||
| 27 | int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) | 27 | int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) |
| 28 | { | 28 | { |
| 29 | if (size <= 1 || data[size - 1] != '\0') | 29 | if (size <= 1 || data[size - 1] != '\0') |
| 30 | return -1; | 30 | return 0; |
| 31 | 31 | ||
| 32 | // Exlude data with null bytes inside | 32 | // Exlude data with null bytes inside |
| 33 | if (strlen(data) != size - 1) | 33 | if (strlen(data) != size - 1) |
| 34 | return -1; | 34 | return 0; |
| 35 | 35 | ||
| 36 | #ifdef MPV_PROTO | 36 | #ifdef MPV_PROTO |
| 37 | if (!str_startswith(data, size - 1, MPV_STRINGIFY(MPV_PROTO) "://", sizeof(MPV_STRINGIFY(MPV_PROTO) "://") - 1)) | 37 | if (!str_startswith(data, size - 1, MPV_STRINGIFY(MPV_PROTO) "://", sizeof(MPV_STRINGIFY(MPV_PROTO) "://") - 1)) |
| 38 | return -1; | 38 | return 0; |
| 39 | #endif | 39 | #endif |
| 40 | 40 | ||
| 41 | #if !defined(MPV_PROTO) || defined(MPV_PROTO_FILE) | 41 | #if !defined(MPV_PROTO) || defined(MPV_PROTO_FILE) |
| @@ -49,13 +49,13 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) · 7 unmodified lines | |||
| 49 | // Exclude some common paths that are not useful for testing. | 49 | // Exclude some common paths that are not useful for testing. |
| 50 | // Exclude - | 50 | // Exclude - |
| 51 | if (size_check == 2 && !strncmp(data_check, "-", 1)) | 51 | if (size_check == 2 && !strncmp(data_check, "-", 1)) |
| 52 | return -1; | 52 | return 0; |
| 53 | // Exclude relative paths | 53 | // Exclude relative paths |
| 54 | if (str_startswith(data_check, size_check - 1, ".", 1)) | 54 | if (str_startswith(data_check, size_check - 1, ".", 1)) |
| 55 | return -1; | 55 | return 0; |
| 56 | // Exclude absolute paths | 56 | // Exclude absolute paths |
| 57 | if (str_startswith(data_check, size_check - 1, "/", 1)) | 57 | if (str_startswith(data_check, size_check - 1, "/", 1)) |
| 58 | return -1; | 58 | return 0; |
| 59 | #endif | 59 | #endif |
| 60 | 60 | ||
| 61 | mpv_handle *ctx = mpv_create(); | 61 | mpv_handle *ctx = mpv_create(); |
| @@ -27,7 +27,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) · 26 unmodified lines | |||
| 27 | case MPV_FORMAT_STRING: | 27 | case MPV_FORMAT_STRING: |
| 28 | value_len = strnlen(data, size); | 28 | value_len = strnlen(data, size); |
| 29 | if (!value_len || value_len == size) | 29 | if (!value_len || value_len == size) |
| 30 | return -1; | 30 | return 0; |
| 31 | value_len += 1; | 31 | value_len += 1; |
| 32 | break; | 32 | break; |
| 33 | case MPV_FORMAT_FLAG: | 33 | case MPV_FORMAT_FLAG: |
| @@ -46,12 +46,12 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) · 12 unmodified lines | |||
| 46 | 46 | ||
| 47 | // at least two bytes for the name | 47 | // at least two bytes for the name |
| 48 | if (size < value_len + 2) | 48 | if (size < value_len + 2) |
| 49 | return -1; | 49 | return 0; |
| 50 | 50 | ||
| 51 | const char *name = (const char *)data + value_len; | 51 | const char *name = (const char *)data + value_len; |
| 52 | size_t name_len = strnlen(name, size - value_len); | 52 | size_t name_len = strnlen(name, size - value_len); |
| 53 | if (!name_len || name_len != size - value_len - 1) | 53 | if (!name_len || name_len != size - value_len - 1) |
| 54 | return -1; | 54 | return 0; |
| 55 | 55 | ||
| 56 | mpv_handle *ctx = mpv_create(); | 56 | mpv_handle *ctx = mpv_create(); |
| 57 | if (!ctx) | 57 | if (!ctx) |