Fuzzing targets for minmax

Author: mclow

minmax/fuzzing/minmax.fuzz.cpp

@@ -0,0 +1,52 @@
+//  (C) Copyright Marshall Clow 2018
+//  Use, modification and distribution are subject to the
+//  Boost Software License, Version 1.0. (See accompanying file
+//  LICENSE_1_0.txt or copy at http://www.boost.org/LICENSE_1_0.txt)
+
+#include <boost/algorithm/minmax.hpp>
+
+//	Fuzzing tests for:
+//
+// 		template <class T>
+// 		tuple<T const&, T const&>
+// 		minmax(const T& a, const T& b);
+// 
+// 		template <class T, class BinaryPredicate>
+// 		tuple<T const&, T const&>
+// 		minmax(const T& a, const T& b, BinaryPredicate comp);
+
+
+bool greater(uint8_t lhs, uint8_t rhs) { return lhs > rhs; }
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t sz) {
+	typedef boost::tuple<uint8_t const&, uint8_t const&> result_t;
+	if (sz < 2) return 0; // we only need two elements
+	
+	{
+	result_t result = boost::minmax(data[0], data[1]);
+	uint8_t const& first  = result.get<0>();
+	uint8_t const& second = result.get<1>();
+
+//	first must be <= second
+	if (second < first) return 1;
+
+//	The references returned must be data[0] and data[1]
+	if (&first  != data && &first  != data + 1) return 2;
+	if (&second != data && &second != data + 1) return 2;
+	}
+	
+	{
+	result_t result = boost::minmax(data[0], data[1], greater);
+	uint8_t const& first  = result.get<0>();
+	uint8_t const& second = result.get<1>();
+
+//	first must be <= second
+	if (greater(second, first)) return 1;
+
+//	The references returned must be data[0] and data[1]
+	if (&first  != data && &first  != data + 1) return 2;
+	if (&second != data && &second != data + 1) return 2;
+	}
+
+  return 0;
+}

minmax/fuzzing/minmax_element.fuzz.cpp

@@ -0,0 +1,71 @@
+//  (C) Copyright Marshall Clow 2018
+//  Use, modification and distribution are subject to the
+//  Boost Software License, Version 1.0. (See accompanying file
+//  LICENSE_1_0.txt or copy at http://www.boost.org/LICENSE_1_0.txt)
+
+#include <iterator> // for std::distance
+
+#include <boost/algorithm/minmax_element.hpp>
+
+//	Fuzzing tests for:
+//
+//		template <class ForwardIterator>
+//		std::pair<ForwardIterator,ForwardIterator>
+//		minmax_element(ForwardIterator first, ForwardIterator last);
+//
+//		template <class ForwardIterator, class BinaryPredicate>
+//		std::pair<ForwardIterator,ForwardIterator>
+//		minmax_element(ForwardIterator first, ForwardIterator last,
+//	               		BinaryPredicate comp);
+
+
+bool greater(uint8_t lhs, uint8_t rhs) { return lhs > rhs; }
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t sz) {
+	typedef std::pair<const uint8_t *, const uint8_t *> result_t;
+	if (sz == 0) return 0; // we need at least one element
+	
+	{
+//	Find the min and max
+	result_t result = boost::minmax_element(data, data + sz);
+
+//	The iterators have to be in the sequence
+	if (std::distance(data, result.first)  >= sz) return 1;
+	if (std::distance(data, result.second) >= sz) return 1;
+	
+//	the minimum element can't be bigger than the max element
+	uint8_t min_value = *result.first;
+	uint8_t max_value = *result.second;
+	
+	if (max_value < min_value) return 2;
+
+//	None of the elements in the sequence can be less than the min, nor greater than the max
+	for (size_t i = 0; i < sz; ++i) {
+		if (data[i] < min_value) return 3;
+		if (max_value < data[i]) return 3;
+		}
+	}
+	
+	{
+//	Find the min and max
+	result_t result = boost::minmax_element(data, data + sz, greater);
+
+//	The iterators have to be in the sequence
+	if (std::distance(data, result.first)  >= sz) return 1;
+	if (std::distance(data, result.second) >= sz) return 1;
+
+//	the minimum element can't be bigger than the max element
+	uint8_t min_value = *result.first;
+	uint8_t max_value = *result.second;
+	
+	if (greater(max_value, min_value)) return 2;
+
+//	None of the elements in the sequence can be less than the min, nor greater than the max
+	for (size_t i = 0; i < sz; ++i) {
+		if (greater(data[i], min_value)) return 3;
+		if (greater(max_value, data[i])) return 3;
+		}
+	}
+
+  return 0;
+}