8000 Add a fuzzer for `Py_CompileStringExFlags` by bradlarsen · Pull Request #111721 · python/cpython · GitHub
[go: up one dir, main page]
Skip to content

Add a fuzzer for Py_CompileStringExFlags #111721

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Dec 10, 2023
Merged

Add a fuzzer for Py_CompileStringExFlags #111721

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
9ebf163
Add a fuzzer for `Py_CompileStringExFlags`
bradlarsen Nov 4, 2023
3701f3b
Fix buffer indexing error in fuzzer
bradlarsen Nov 6, 2023
9ff4067
Merge branch 'main' into main
bradlarsen Nov 25, 2023
96d6c0e
Merge branch 'main' into main
bradlarsen Dec 10, 2023
ce5ca48
Simplify how the input gets NUL-terminated
bradlarsen Dec 10, 2023
3d8147e
Apply suggestions from code review
bradlarsen Dec 10, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Simplify how the input gets NUL-terminated
  • Loading branch information
@bradlarsen
bradlarsen committed Dec 10, 2023
commit ce5ca48d7c4fa6b194af0dcc41f9f77be935f28f
12 changes: 7 additions & 5 deletions Modules/_xxtestfuzz/fuzzer.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -513,12 +513,13 @@ const size_t NUM_OPTIMIZE_VALS = sizeof(optimize_vals) / sizeof(optimize_vals[0]
/* Fuzz `PyCompileStringExFlags` using a variety of input parameters.
* That function is essentially behind the `compile` builtin */
static int fuzz_pycompile(const char* data, size_t size) {
if (size > sizeof(pycompile_scratch)) {
// Ignore overly-large inputs, and account for a NUL terminator
if (size > sizeof(pycompile_scratch) - 1) {
return 0;
}

// Need 2 bytes for parameter selection plus 1 for null terminator
if (size < 2 + 1)
// Need 2 bytes for parameter selection
if (size < 2)
return 0;

// Use first byte to determine element of `start_vals` to use
Expand All @@ -529,9 +530,10 @@ static int fuzz_pycompile(const char* data, size_t size) {
unsigned char optimize_idx = (unsigned char) data[1];
int optimize = optimize_vals[optimize_idx % NUM_OPTIMIZE_VALS];

// Create a null-terminated C string from the remaining input
// Create a NUL-terminated C string from the remaining input
memcpy(pycompile_scratch, data + 2, size - 2);
pycompile_scratch[size - 2 - 1] = '\0';
// Put a NUL terminator just after the copied data. (Space was reserved already.)
pycompile_scratch[size - 2] = '\0';

// XXX: instead of always using NULL for the `flags` value to
// `Py_CompileStringExFlags`, there are many flags that conditionally
Expand Down
0