Implement fuzzing for the GLSL parser (#1301)

* Implement fuzzing for the GLSL parser

* Remove arbitrary dependency from naga

Derive `Arbitrary` for proxy objects in `fuzz/fuzz_targets/glsl_parser.rs`
instead.
This commit is contained in:
Hans Christian Schmitz
2021-08-31 19:00:50 +02:00
committed by GitHub
parent bd411c28c2
commit 2069ea698f
2 changed files with 54 additions and 1 deletions

View File

@@ -9,11 +9,12 @@ edition = "2018"
cargo-fuzz = true
[dependencies]
arbitrary = { version = "1.0.2", features = ["derive"] }
libfuzzer-sys = "0.4"
[dependencies.naga]
path = ".."
features = ["spv-in", "wgsl-in"]
features = ["spv-in", "wgsl-in", "glsl-in"]
# Prevent this from interfering with workspaces
[workspace]
@@ -30,3 +31,9 @@ name = "wgsl_parser"
path = "fuzz_targets/wgsl_parser.rs"
test = false
doc = false
[[bin]]
name = "glsl_parser"
path = "fuzz_targets/glsl_parser.rs"
test = false
doc = false

View File

@@ -0,0 +1,46 @@
#![no_main]
use arbitrary::Arbitrary;
use libfuzzer_sys::fuzz_target;
use naga::{
front::glsl::{Options, Parser},
FastHashMap, ShaderStage,
};
#[derive(Debug, Arbitrary)]
enum ShaderStageProxy {
Vertex,
Fragment,
Compute,
}
impl From<ShaderStageProxy> for ShaderStage {
fn from(proxy: ShaderStageProxy) -> Self {
match proxy {
ShaderStageProxy::Vertex => ShaderStage::Vertex,
ShaderStageProxy::Fragment => ShaderStage::Fragment,
ShaderStageProxy::Compute => ShaderStage::Compute,
}
}
}
#[derive(Debug, Arbitrary)]
struct OptionsProxy {
pub stage: ShaderStageProxy,
pub defines: FastHashMap<String, String>,
}
impl From<OptionsProxy> for Options {
fn from(proxy: OptionsProxy) -> Self {
Options {
stage: proxy.stage.into(),
defines: proxy.defines,
}
}
}
fuzz_target!(|data: (OptionsProxy, String)| {
let (options, source) = data;
// Ensure the parser can handle potentially malformed strings without crashing.
let mut parser = Parser::default();
let _result = parser.parse(&options.into(), &source);
});