Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merge the fuzzers #1199

Merged
merged 1 commit into from
Jun 30, 2019
Merged

Merge the fuzzers #1199

merged 1 commit into from
Jun 30, 2019

Conversation

pauldreik
Copy link
Contributor

I agree that my contributions are licensed under the {fmt} license, and agree to future changes to the licensing.

Should perhaps the safe duration cast be on by default, not only during fuzzing?

Copy link
Contributor

@vitaut vitaut left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot for the PR! A few comments inline, otherwise looks great.

.gitignore Outdated Show resolved Hide resolved
include/fmt/chrono.h Outdated Show resolved Hide resolved
CMakeLists.txt Show resolved Hide resolved
CMakeLists.txt Outdated Show resolved Hide resolved
include/fmt/chrono.h Outdated Show resolved Hide resolved
test/fuzzing/chrono_duration.cpp Outdated Show resolved Hide resolved
test/fuzzing/chrono_duration.cpp Outdated Show resolved Hide resolved
test/fuzzing/fuzzer_common.h Outdated Show resolved Hide resolved
test/fuzzing/main.cpp Outdated Show resolved Hide resolved
test/fuzzing/main.cpp Outdated Show resolved Hide resolved
@pauldreik
Copy link
Contributor Author

I handled all the review comments - hopefully you are happy with the resolution, tried to comment what I did and handle the comments top down in a commit each so it is easy to follow.
Now waiting for the CI builds!

Copy link
Contributor

@vitaut vitaut left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry for slow reply. It's super busy time of year close to the ISO C++ standards committee meeting in Cologne.

include/fmt/format-inl.h Outdated Show resolved Hide resolved
@pauldreik
Copy link
Contributor Author

Sorry for the delay, I have been moving. I don't think there is anything more I can do for now on this pull request?
I see that you have been working on a scan function, so I guess I will add another fuzzer at a later stage :-)

@vitaut
Copy link
Contributor

vitaut commented Jun 29, 2019

I don't think there is anything more I can do for now on this pull request?

Is it possible to reduce the number of FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION checks in the library? Since all the output is written through the memory buffer, just the check in memory_buffer::grow might be enough.

@pauldreik
Copy link
Contributor Author

I had actually already tried removing the checks, but had to do it again to convince myself...

The check in grisu_prettify for num_zeros is needed to avoid excessive cpu use when it counts the necessary size(?). When it is internal::counting_iterator<char>(), the check in grow() will not be exercised since it is not connected to a buffer. So this check must remain, or else one runs into occasional long running cases (25 seconds or more), compared to the usual 5000 executions per second. oss fuzz will report that as a bug.

The check for precision in sprintf_format is necessary, because the system provided snprintf() allocates internally. If this check is removed, the fuzzer may suddenly trigger a large allocation, and it will terminate due to the maximum allocation size. In oss-fuzz, as well as the default in libfuzzer, I believe the memory limit is 2GB, which is easily hit.
I moved this check inside format_float to make it closer to the point of where it is needed. But it must remain in the code, unfortunately.

So, all three checks must remain! If you think it's noisy, they could perhaps be reduced to a oneline macro at the point of use?

@vitaut
Copy link
Contributor

vitaut commented Jun 30, 2019

So, all three checks must remain!

Seems reasonable, thanks for the explanation.

If you think it's noisy, they could perhaps be reduced to a oneline macro at the point of use?

I think it's OK for now. We can introduce a macro later.

I'll be happy to merge the PR. Could you rebase it?

see google/oss-fuzz#2381

the history of the fuzz branch is long and messy and
is difficult to rebase on top of the current master.

Squashed commit of the following:

commit b9d6db5
Author: Paul Dreik <github@pauldreik.se>
Date:   Sat Jun 29 21:50:34 2019 +0200

    update exception with a more accurate description

commit f3fbaf6
Author: Paul Dreik <github@pauldreik.se>
Date:   Sat Jun 29 21:34:55 2019 +0200

    fix missing flags in reproduce build

commit 40a17be
Author: Paul Dreik <github@pauldreik.se>
Date:   Sat Jun 29 21:22:48 2019 +0200

    move check for large precision values closer to where needed

commit ef6e23e
Author: Paul Dreik <github@pauldreik.se>
Date:   Fri Jun 28 20:55:34 2019 +0200

    simplify the fuzzer build script

commit eadee6e
Author: Paul Dreik <github@pauldreik.se>
Date:   Fri Jun 28 20:47:54 2019 +0200

    minimize source code pollution

commit 1ece641
Merge: f404079 037b84f
Author: Paul Dreik <github@pauldreik.se>
Date:   Fri Jun 28 20:22:52 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

    # Conflicts:
    #	CMakeLists.txt

commit f404079
Author: Paul Dreik <github@pauldreik.se>
Date:   Fri Jun 28 20:20:52 2019 +0200

    make named_arg write into a string or a memory_buffer

    this makes the fuzzer consistent with the others.

commit 545dbe1
Author: Paul Dreik <github@pauldreik.se>
Date:   Thu Jun 20 06:34:17 2019 +0200

    tidy up extra newlines, missing std:: etc.

commit 2d816ef
Author: Paul Dreik <github@pauldreik.se>
Date:   Mon Jun 17 20:49:08 2019 +0200

    update unit test to handle expected result following review comment

commit a5b9a26
Author: Paul Dreik <github@pauldreik.se>
Date:   Mon Jun 17 20:40:06 2019 +0200

    update build script to reflect changes after review

commit 8411cb7
Author: Paul Dreik <github@pauldreik.se>
Date:   Mon Jun 17 20:39:39 2019 +0200

    review comment: clarify what the .gitignore is for

commit 18d9e7b
Author: Paul Dreik <github@pauldreik.se>
Date:   Mon Jun 17 20:36:56 2019 +0200

    review comment: don't touch root .gitignore

commit 7683d7f
Author: Paul Dreik <github@pauldreik.se>
Date:   Mon Jun 17 20:35:40 2019 +0200

    review comment: condiionally include main.cpp

commit be0bdae
Author: Paul Dreik <github@pauldreik.se>
Date:   Mon Jun 17 20:31:28 2019 +0200

    review comment: drop commented out code not working on travis

commit 0134298
Author: Paul Dreik <github@pauldreik.se>
Date:   Mon Jun 17 20:30:26 2019 +0200

    review comment: renumber case labels

    the old ones were to be able to reuse the corpus, let's drop it

commit f66fe7b
Author: Paul Dreik <github@pauldreik.se>
Date:   Mon Jun 17 20:06:47 2019 +0200

    review comment: libfmt->fmt

commit 4a4ddb6
Author: Paul Dreik <github@pauldreik.se>
Date:   Mon Jun 17 20:05:32 2019 +0200

    reuse fmt_safe_duration_cast

commit 0a16794
Author: Paul Dreik <github@pauldreik.se>
Date:   Mon Jun 17 20:02:48 2019 +0200

    review comment: name convention, better name

    C was for "chrono duration"

commit 63084ca
Author: Paul Dreik <github@pauldreik.se>
Date:   Mon Jun 17 20:00:50 2019 +0200

    reuse earlier extract fmt_safe_... function

commit b23388d
Author: Paul Dreik <github@pauldreik.se>
Date:   Mon Jun 17 19:58:55 2019 +0200

    review comment: don't output inf.inf

commit 6f861f1
Author: Paul Dreik <github@pauldreik.se>
Date:   Mon Jun 17 19:57:00 2019 +0200

    review comment: extract function for invoking safe_duration_cast

commit df19bc8
Author: Paul Dreik <github@pauldreik.se>
Date:   Mon Jun 17 19:47:30 2019 +0200

    review comment: leftover garbage

commit 84eea80
Author: Paul Dreik <github@pauldreik.se>
Date:   Mon Jun 17 19:45:22 2019 +0200

    review comment: turn cmake option into macro for SAFE_DURATION_CAST

    decided to have it on by default

commit c3a1594
Author: Paul Dreik <github@pauldreik.se>
Date:   Mon Jun 17 19:40:14 2019 +0200

    review comment: extra newline

commit aa55687
Author: Paul Dreik <github@pauldreik.se>
Date:   Mon Jun 17 19:38:49 2019 +0200

    review comment: file name convention

commit 4102d82
Merge: 28add37 4912cff
Author: Paul Dreik <github@pauldreik.se>
Date:   Mon Jun 17 16:29:29 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

commit 28add37
Author: Paul Dreik <github@pauldreik.se>
Date:   Fri Jun 14 21:44:06 2019 +0200

    disable check to pass travis

commit 4119378
Author: Paul Dreik <github@pauldreik.se>
Date:   Fri Jun 14 21:32:39 2019 +0200

    add missing include

commit ba2efb8
Author: Paul Dreik <github@pauldreik.se>
Date:   Fri Jun 14 21:04:41 2019 +0200

    try working around build issue on travis

commit 380671a
Author: Paul Dreik <github@pauldreik.se>
Date:   Fri Jun 14 20:22:41 2019 +0200

    write positive infinity without sign

commit fd72b9a
Author: Paul Dreik <github@pauldreik.se>
Date:   Fri Jun 14 20:20:50 2019 +0200

    remove leftover from merge

commit 1ae3128
Author: Paul Dreik <github@pauldreik.se>
Date:   Fri Jun 14 20:14:45 2019 +0200

    format to buffer instead of string

commit 1d83a56
Author: Paul Dreik <github@pauldreik.se>
Date:   Fri Jun 14 19:50:19 2019 +0200

    fix warnings

commit a33b45a
Author: Paul Dreik <github@pauldreik.se>
Date:   Fri Jun 14 19:43:46 2019 +0200

    refactor and fix warnings

commit 02afb12
Author: Paul Dreik <github@pauldreik.se>
Date:   Fri Jun 14 19:17:27 2019 +0200

    use fixed size input

commit 35f84c8
Author: Paul Dreik <github@pauldreik.se>
Date:   Fri Jun 14 19:07:43 2019 +0200

    factor out main into a separate file

commit a23b7a1
Author: Paul Dreik <github@pauldreik.se>
Date:   Fri Jun 14 18:56:40 2019 +0200

    refactor

commit 9a3f4cf
Merge: 7842582 12f4683
Author: Paul Dreik <github@pauldreik.se>
Date:   Fri Jun 14 18:20:03 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

    # Conflicts:
    #	include/fmt/chrono.h

commit 7842582
Merge: 90cab5a cbbee1b
Author: Paul Dreik <github@pauldreik.se>
Date:   Thu Jun 13 10:41:34 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

commit 90cab5a
Merge: 8feb8a3 e5422db
Author: Paul Dreik <github@pauldreik.se>
Date:   Wed Jun 12 18:49:08 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

commit 8feb8a3
Merge: e9fabac 87fbc6f
Author: Paul Dreik <github@pauldreik.se>
Date:   Tue Jun 11 19:18:35 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

commit e9fabac
Merge: eaff931 e1a67b5
Author: Paul Dreik <github@pauldreik.se>
Date:   Mon Jun 10 22:38:36 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

commit eaff931
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 22:29:01 2019 +0200

    drop old crashes

commit 7f861e4
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 21:47:30 2019 +0200

    build fuzzers as part of the linux clang 6 build

commit 42c3390
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 21:42:12 2019 +0200

    travis has old libs

commit 9264e3a
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 21:33:26 2019 +0200

    more travis workarounds

commit c6eed3a
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 21:27:49 2019 +0200

    travis workaround

commit 5e230d6
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 21:15:36 2019 +0200

    fix constexpr issues

commit cc5fc03
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 21:11:13 2019 +0200

    add a fuzzer build

commit 3997375
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 20:53:04 2019 +0200

    fix minor documentation errors

commit 1572411
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 20:49:25 2019 +0200

    polish the documentation

commit 9e52744
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 20:32:45 2019 +0200

    remove unused headers

commit 4b2492a
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 20:28:12 2019 +0200

    clang format

commit a0004eb
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 20:27:02 2019 +0200

    format also void*

commit 820142e
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 20:12:21 2019 +0200

    improve two_args with lessons learnt from the others

commit 7b8fd7f
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 20:11:18 2019 +0200

    improve function names

commit 641bf36
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 20:07:29 2019 +0200

    clang format

commit 7975c0c
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 20:06:02 2019 +0200

    apply lessons learned from chrono fuzzer on sprintf

commit 972124c
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 19:55:49 2019 +0200

    format to buffer instead of string

commit 7b015c6
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 19:50:25 2019 +0200

    apply lessons learned from the chrono fuzzer at one_arg

commit daa8ea9
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 19:41:17 2019 +0200

    renumber cases

commit a667365
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 19:38:06 2019 +0200

    clang format

commit e0e361b
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 19:36:35 2019 +0200

    disable fuzzing by default

commit ccb4274
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 19:36:25 2019 +0200

    refresh named_arg with lessons learnt from the chrono fuzzer

commit 60da706
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 19:36:00 2019 +0200

    fix build error

commit e361bfc
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 19:00:11 2019 +0200

    add comment about formatting to string vs. memory buffer

commit 74c0ed0
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 18:51:23 2019 +0200

    try to use better names

commit 4efea36
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 18:46:07 2019 +0200

    fix clang build error

commit 03cdd2e
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 18:44:21 2019 +0200

    drop workarounds fixed upstream

commit e936829
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 18:41:02 2019 +0200

    move the fuzzers into the test/ subdirectory

commit 2967765
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 18:30:03 2019 +0200

    revert temporary tests handled upstream

commit 749c502
Merge: dee6908 5d9100f
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 17:49:00 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

commit dee6908
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 17:40:37 2019 +0200

    keep documentation comment formatted properly

commit 87d2c99
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 17:36:12 2019 +0200

    switch to fmt constexpr macros

commit c23fa59
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 17:30:22 2019 +0200

    clang format

commit 9e58207
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 17:27:03 2019 +0200

    get rid of safe_duration_cast submodule

    replaced with an embedded miniature version

commit a4d36ea
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Jun 9 17:25:00 2019 +0200

    add safe_duration_cast into fmt

commit 7d5b0ec
Author: Paul Dreik <github@pauldreik.se>
Date:   Sat Jun 8 22:39:33 2019 +0200

    mark fmtlib#1194 as fixed

commit ee91514
Merge: 6056911 4faadff
Author: Paul Dreik <github@pauldreik.se>
Date:   Sat Jun 8 22:25:37 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

commit 6056911
Author: Paul Dreik <github@pauldreik.se>
Date:   Wed Jun 5 09:58:30 2019 +0200

    format to small size buffer instead of string

commit 9f00609
Author: Paul Dreik <github@pauldreik.se>
Date:   Wed Jun 5 09:45:23 2019 +0200

    switch to fmt::string_view and workaround reported bug

commit 387de0d
Author: Paul Dreik <github@pauldreik.se>
Date:   Wed Jun 5 06:26:15 2019 +0200

    ignore build directories

commit 55da271
Merge: 3716491 c264e64
Author: Paul Dreik <github@pauldreik.se>
Date:   Wed Jun 5 06:12:36 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

commit 3716491
Author: Paul Dreik <github@pauldreik.se>
Date:   Mon Jun 3 07:03:29 2019 +0200

    fix UB in on_second

commit 2740241
Merge: 1c25840 d54e64b
Author: Paul Dreik <github@pauldreik.se>
Date:   Mon Jun 3 06:37:18 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

    # Conflicts:
    #	include/fmt/chrono.h

commit 1c25840
Merge: ca9596d f57227a
Author: Paul Dreik <github@pauldreik.se>
Date:   Sat Jun 1 08:01:58 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

commit ca9596d
Merge: 1c274cf d07cc20
Author: Paul Dreik <github@pauldreik.se>
Date:   Thu May 30 19:42:33 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

commit 1c274cf
Author: Paul Dreik <github@pauldreik.se>
Date:   Thu May 30 08:12:10 2019 +0200

    make it easier for the chrono fuzzer to explore

    using a fixed size makes the cases cross pollinate
    each other better.

    the execution speed is much higher as well

commit f0d7ccc
Author: Paul Dreik <github@pauldreik.se>
Date:   Thu May 30 07:36:21 2019 +0200

    add a build adapted for analysis of fuzzing performance

commit 56f7cf3
Author: Paul Dreik <github@pauldreik.se>
Date:   Thu May 30 06:25:10 2019 +0200

    allow negative values again

commit a77a5fc
Author: Paul Dreik <github@pauldreik.se>
Date:   Thu May 30 05:45:55 2019 +0200

    fix UB on signed int overflow in chrono_formatter constructor

    see fmtlib#1179

commit b6a5927
Merge: 492a204 30bce6c
Author: Paul Dreik <github@pauldreik.se>
Date:   Thu May 30 05:26:30 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

    # Conflicts:
    #	include/fmt/chrono.h

commit 492a204
Author: Paul Dreik <github@pauldreik.se>
Date:   Wed May 29 21:36:00 2019 +0200

    fix bad assert

commit 0ae68b0
Author: Paul Dreik <github@pauldreik.se>
Date:   Wed May 29 21:35:49 2019 +0200

    add unsigned types for chrono fuzzing

commit 2753d7d
Author: Paul Dreik <github@pauldreik.se>
Date:   Wed May 29 20:25:21 2019 +0200

    use C++17

commit bc12742
Author: Paul Dreik <github@pauldreik.se>
Date:   Wed May 29 19:44:59 2019 +0200

    add symlink for safe_duration_cast

commit 67201d2
Author: Paul Dreik <github@pauldreik.se>
Date:   Wed May 29 19:40:40 2019 +0200

    turn on safe duration cast for the fuzzer builds

commit 31a7008
Author: Paul Dreik <github@pauldreik.se>
Date:   Wed May 29 19:32:52 2019 +0200

    clang format

commit 981e30c
Author: Paul Dreik <github@pauldreik.se>
Date:   Wed May 29 19:30:19 2019 +0200

    reduce maximum allocation size

commit 7ba51da
Author: Paul Dreik <github@pauldreik.se>
Date:   Wed May 29 19:30:01 2019 +0200

    make nan unit test pass

commit 95b4b9c
Author: Paul Dreik <github@pauldreik.se>
Date:   Wed May 29 18:39:08 2019 +0200

    special case nan and inf

commit 2673c96
Author: Paul Dreik <github@pauldreik.se>
Date:   Wed May 29 16:40:11 2019 +0200

    build a fast fuzzer, for making coverage fast

commit db52b62
Author: Paul Dreik <github@pauldreik.se>
Date:   Wed May 29 16:39:48 2019 +0200

    add safe duration cast as submodule

commit c8a028f
Author: Paul Dreik <github@pauldreik.se>
Date:   Wed May 29 16:00:26 2019 +0200

    enable chrono fuzzing for non-negative values

commit de3555c
Author: Paul Dreik <github@pauldreik.se>
Date:   Wed May 29 13:06:35 2019 +0200

    try start using safe duration cast

commit 5c32451
Author: Paul Dreik <github@pauldreik.se>
Date:   Wed May 29 09:59:34 2019 +0200

    add failing test

commit 3a565d3
Author: Paul Dreik <github@pauldreik.se>
Date:   Wed May 29 09:59:09 2019 +0200

    fix cmake option type (should be string, not bool)

commit 61c6756
Merge: 63e7b9e bb254d1
Author: Paul Dreik <github@pauldreik.se>
Date:   Wed May 29 07:03:42 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

commit 63e7b9e
Merge: 7dd1d80 5e7bdf1
Author: Paul Dreik <github@pauldreik.se>
Date:   Fri May 17 19:17:20 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

commit 7dd1d80
Merge: 2c9aa5a 2a9e8b5
Author: Paul Dreik <github@pauldreik.se>
Date:   Tue May 14 19:38:32 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

commit 2c9aa5a
Merge: 16a442c 2c77562
Author: Paul Dreik <github@pauldreik.se>
Date:   Tue May 14 06:33:16 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

commit 16a442c
Merge: b1d70b6 f4dfd6e
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun May 12 15:24:31 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

    # Conflicts:
    #	include/fmt/chrono.h

commit b1d70b6
Author: Paul Dreik <github@pauldreik.se>
Date:   Fri May 10 08:52:57 2019 +0200

    prevent excessive time (found by oss-fuzz)

    the following triggered this:
    std::string message =
          fmt::format("\377{:.214718908}\377", fmt::arg("/\0", 0.f));

    there are probably more places with calls to fill_n which could be checked

commit 9a91093
Merge: 7de0fde e9bab6d
Author: Paul Dreik <github@pauldreik.se>
Date:   Thu May 9 06:06:32 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

    # Conflicts:
    #	include/fmt/chrono.h

commit 7de0fde
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun May 5 20:08:53 2019 +0200

    clang format

commit bb375e1
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun May 5 19:47:10 2019 +0200

    seems to pass the unit test now (except for the nan stuff from victor)

commit 786b4b7
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun May 5 19:25:23 2019 +0200

    add assert triggering data, and unit test

commit 2790e48
Merge: fa859a0 ca978b3
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun May 5 18:42:51 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

commit fa859a0
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun May 5 18:18:54 2019 +0200

    add crash

commit 1f6e341
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun May 5 18:18:27 2019 +0200

    assert floating point is finite internally

commit 5087774
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun May 5 17:32:03 2019 +0200

    invoke undefined behaviour inside chrono

commit bac7ac4
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun May 5 17:31:35 2019 +0200

    refactor the fuzzer build script

commit b19c4cd
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun May 5 16:25:11 2019 +0200

    add one more crash

commit 7607592
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun May 5 16:24:05 2019 +0200

    add crashing input

commit b059a98
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun May 5 16:21:25 2019 +0200

    trigger undefined behaviour with NaN durations

commit 7cce332
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun May 5 16:20:51 2019 +0200

    add asan only fuzzer

commit 757319a
Merge: a574b21 c1d430e
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun May 5 06:34:59 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

    # Conflicts:
    #	test/chrono-test.cc

commit a574b21
Author: Paul Dreik <github@pauldreik.se>
Date:   Sat May 4 12:54:13 2019 +0200

    disable chrono fuzzing for now

    it triggers integer overflow and is not trivial to solve.

commit ff17322
Merge: d6a5985 29c10fb
Author: Paul Dreik <github@pauldreik.se>
Date:   Sat May 4 07:29:39 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

commit d6a5985
Merge: 663b159 4a4d72f
Author: Paul Dreik <github@pauldreik.se>
Date:   Wed May 1 20:44:16 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

    # Conflicts:
    #	test/chrono-test.cc

commit 663b159
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Apr 28 22:36:07 2019 +0200

    add crash case (triggers assertion)

commit 082a5cb
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Apr 28 21:44:19 2019 +0200

    add const

commit b8d7091
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Apr 28 21:29:43 2019 +0200

    provoke assertion

    fmt/include/fmt/core.h:246:
    typename std::make_unsigned<_Tp>::type fmt::v5::internal::to_unsigned(Int)
    [with Int = long int;
     typename std::make_unsigned<_Tp>::type = long unsigned int]:
    Assertion `(value >= 0) && "negative value"' failed.

commit e196601
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Apr 28 20:46:16 2019 +0200

    add more crashes

commit 1394ae3
Merge: 89338ca 4c721e3
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Apr 28 17:16:14 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

commit 89338ca
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Apr 28 09:40:32 2019 +0200

    add notes on how to reproduce crashes

commit 7dc3e4c
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Apr 28 09:28:20 2019 +0200

    add crashes from chrono duration

commit b62e8bc
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Apr 28 09:26:53 2019 +0200

    rename fuzzer

commit 7f4ab2b
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Apr 28 09:15:38 2019 +0200

    clang format

commit a6cc2a3
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Apr 28 09:12:04 2019 +0200

    add chrono duration fuzzer

commit 682713c
Merge: 8b934b3 8d8ea21
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Apr 28 08:07:56 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

commit 8b934b3
Author: Paul Dreik <github@pauldreik.se>
Date:   Sat Apr 27 10:23:44 2019 +0200

    clang format

commit 793d97b
Author: Paul Dreik <github@pauldreik.se>
Date:   Sat Apr 27 10:23:17 2019 +0200

    tighten memory allocation

commit e2301f2
Author: Paul Dreik <github@pauldreik.se>
Date:   Sat Apr 27 10:19:56 2019 +0200

    clean up and set license (BSD 2-clause simplified, same as fmt)

commit e64c3fb
Author: Paul Dreik <github@pauldreik.se>
Date:   Sat Apr 27 10:04:23 2019 +0200

    clean up and add afl

commit ab46241
Author: Paul Dreik <github@pauldreik.se>
Date:   Sat Apr 27 09:54:48 2019 +0200

    drop c++17 requirement

commit 20c01e1
Author: Paul Dreik <github@pauldreik.se>
Date:   Sat Apr 27 09:25:19 2019 +0200

    initial oss-fuzz compatible version

commit 6cbd91a
Author: Paul Dreik <github@pauldreik.se>
Date:   Sat Apr 27 08:42:51 2019 +0200

    initial commit of fuzzers from https://github.com/pauldreik/fuzzfmt

commit eaddfb1
Merge: e37d7db 134904c
Author: Paul Dreik <github@pauldreik.se>
Date:   Sat Apr 27 08:38:19 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

commit e37d7db
Merge: 99b2e08 bd516e3
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Apr 21 17:28:06 2019 +0200

    Merge remote-tracking branch 'upstream/master' into fuzz

commit 99b2e08
Author: Paul Dreik <github@pauldreik.se>
Date:   Sun Apr 21 10:30:56 2019 +0200

    stop high memory use when fuzzing
@pauldreik
Copy link
Contributor Author

Wow, ready to merge!
I tried to rebase but it was awful - you and I have worked on the same spots intermixed for the past two months. The commits did not apply cleanly, and trying to get them to make sense was very difficult. I squashed all my changes into a single commit, so some of the history is preserved. Sorry for the force push.

@vitaut vitaut merged commit 9d97201 into fmtlib:master Jun 30, 2019
@vitaut
Copy link
Contributor

vitaut commented Jun 30, 2019

My changes were just warning fixes that are OK to overwrite but squashing works too. Thanks!

pauldreik added a commit to pauldreik/oss-fuzz that referenced this pull request Jun 30, 2019
the fuzzers have been merged upstream, see
fmtlib/fmt#1199
jonathanmetzman pushed a commit to google/oss-fuzz that referenced this pull request Jun 30, 2019
The fuzzers have been merged upstream, see
fmtlib/fmt#1199
@vitaut
Copy link
Contributor

vitaut commented Jun 30, 2019

@pauldreik, please note that I've applied clang-format and other formatting tweaks in master so you might want to pull if you plan to submit more changes in the future.

@pauldreik
Copy link
Contributor Author

Sure! I'll just start a fresh branch from master. Did you see that oss-fuzz now points to this repo, not my clone? That means fmt fuzzing has reached a milestone!

@vitaut
Copy link
Contributor

vitaut commented Jun 30, 2019

Did you see that oss-fuzz now points to this repo, not my clone?

Yay! Now the next time I mess something up, the oss-fuzz is likely to catch it =).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants