/* * Licensed to the Apache Software Foundation (ASF) under one * or more contributor license agreements. See the NOTICE file * distributed with this work for additional information * regarding copyright ownership. The ASF licenses this file * to you under the Apache License, Version 2.0 (the * "License"); you may not use this file except in compliance * with the License. You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, * software distributed under the License is distributed on an * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY * KIND, either express or implied. See the License for the * specific language governing permissions and limitations * under the License. */ #ifndef THRIFT_TEST_FUZZ_COMMON_TCC_ #define THRIFT_TEST_FUZZ_COMMON_TCC_ #include #include #include #include #include #include #include #include #include #include "gen-cpp/FuzzTest_types.h" namespace apache { namespace thrift { namespace fuzzer { using namespace apache::thrift::transport; using namespace apache::thrift::protocol; using namespace fuzz; // 10MB message size limit to prevent over-allocation during fuzzing const int FUZZ_MAX_MESSAGE_SIZE = 10 * 1024 * 1024; inline bool is_nan_false_positive(FuzzTest& test1, FuzzTest& test2) { BasicTypes& b1 = test1.basic; BasicTypes& b2 = test2.basic; if (std::isnan(b1.double_field) && std::isnan(b2.double_field)) { b1.double_field = 0.0; b2.double_field = 0.0; } // Check for NaN in containers if they contain doubles // This is a simplified version - may need adjustment based on actual schema return test1 == test2; } // Simple parse-only fuzzer template int fuzz_parse(const uint8_t* data, size_t size) { try { std::shared_ptr config(new TConfiguration(FUZZ_MAX_MESSAGE_SIZE)); std::shared_ptr trans(new TMemoryBuffer(const_cast(data), size, TMemoryBuffer::OBSERVE, config)); std::shared_ptr proto(new ProtocolType(trans)); FuzzTest test; test.read(proto.get()); } catch (const TException&) { // Ignore any Thrift exceptions - they're expected when fuzzing } return 0; } // Roundtrip fuzzer that verifies serialization/deserialization template int fuzz_roundtrip(const uint8_t* data, size_t size) { try { std::shared_ptr config(new TConfiguration(FUZZ_MAX_MESSAGE_SIZE)); // First parse std::shared_ptr trans(new TMemoryBuffer(const_cast(data), size, TMemoryBuffer::OBSERVE, config)); std::shared_ptr proto(new ProtocolType(trans)); FuzzTest test1; test1.read(proto.get()); // Serialize back std::shared_ptr outTrans(new TMemoryBuffer(config)); std::shared_ptr outProto(new ProtocolType(outTrans)); test1.write(outProto.get()); // Get serialized data std::string serialized = outTrans->getBufferAsString(); // Deserialize again std::shared_ptr reTrans(new TMemoryBuffer(config)); reTrans->write((const uint8_t*)serialized.data(), static_cast(serialized.size())); std::shared_ptr reProto(new ProtocolType(reTrans)); FuzzTest test2; test2.read(reProto.get()); // Verify equality if (!(test1 == test2) && !is_nan_false_positive(test1, test2)) { const std::string str1(apache::thrift::ThriftDebugString(test1)); const std::string str2(apache::thrift::ThriftDebugString(test2)); std::cout << "Expected:\n" << str1 << "\nGotten:\n" << str2 << std::endl; throw std::runtime_error("Roundtrip failed"); } } catch (const TException&) { // Ignore any Thrift exceptions - they're expected when fuzzing } return 0; } }}} // apache::thrift::fuzzer #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION __attribute__((weak)) int main(int argc, char** argv) { return 0; } #endif #endif // THRIFT_TEST_FUZZ_COMMON_TCC_