chore: import upstream snapshot with attribution

test/fuzzing/fuzz_amf.cpp

@@ -0,0 +1,81 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#include "brpc/amf.h"
+#include "butil/iobuf.h"
+
+#define kMinInputLength 5
+#define kMaxInputLength 4096
+
+extern "C" int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    if (size < kMinInputLength || size > kMaxInputLength){
+        return 1;
+    }
+
+    uint8_t mode = data[0] % 3;
+    const uint8_t *payload = data + 1;
+    size_t payload_size = size - 1;
+
+    butil::IOBuf buf;
+    buf.append(payload, payload_size);
+
+    switch (mode) {
+        case 0: {
+            // Read AMF object
+            butil::IOBufAsZeroCopyInputStream zc_stream(buf);
+            brpc::AMFInputStream stream(&zc_stream);
+            brpc::AMFObject obj;
+            brpc::ReadAMFObject(&obj, &stream);
+            break;
+        }
+        case 1: {
+            // Read AMF string
+            butil::IOBufAsZeroCopyInputStream zc_stream(buf);
+            brpc::AMFInputStream stream(&zc_stream);
+            std::string val;
+            brpc::ReadAMFString(&val, &stream);
+            break;
+        }
+        case 2: {
+            // Read raw AMF fields by consuming the stream directly
+            butil::IOBufAsZeroCopyInputStream zc_stream(buf);
+            brpc::AMFInputStream stream(&zc_stream);
+            uint8_t marker;
+            while (stream.good() && stream.cut_u8(&marker) == 1) {
+                // Try to identify marker type and read value
+                if (marker == brpc::AMF_MARKER_NUMBER) {
+                    uint64_t num;
+                    stream.cut_u64(&num);
+                } else if (marker == brpc::AMF_MARKER_BOOLEAN) {
+                    uint8_t b;
+                    stream.cut_u8(&b);
+                } else if (marker == brpc::AMF_MARKER_STRING) {
+                    uint16_t len;
+                    if (stream.cut_u16(&len) == 2 && len < 1024) {
+                        char tmp[1024];
+                        stream.cutn(tmp, len);
+                    }
+                }
+            }
+            break;
+        }
+    }
+
+    return 0;
+}

test/fuzzing/fuzz_baidu_rpc.cpp

@@ -0,0 +1,41 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#include "brpc/policy/baidu_rpc_protocol.h"
+#include "fuzz_common.h"
+
+#define kMinInputLength 5
+#define kMaxInputLength 4096
+
+extern "C" int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    if (size < kMinInputLength || size > kMaxInputLength){
+        return 1;
+    }
+
+    std::string input(reinterpret_cast<const char*>(data), size);
+    butil::IOBuf buf;
+    buf.append(input);
+
+    brpc::Socket* sock = get_fuzz_socket();
+    if (sock == NULL) {
+        return 0;
+    }
+    brpc::policy::ParseRpcMessage(&buf, sock, false, NULL);
+    return 0;
+}

test/fuzzing/fuzz_butil.cpp

@@ -0,0 +1,52 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#include "butil/base64.h"
+#include "butil/crc32c.h"
+#include "butil/hash.h"
+#include "butil/sha1.h"
+
+#define kMinInputLength 5
+#define kMaxInputLength 1024
+
+extern "C" int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    if (size < kMinInputLength || size > kMaxInputLength){
+        return 1;
+    }
+
+    std::string input(reinterpret_cast<const char*>(data), size);
+
+    {
+        std::string encoded;
+        std::string decoded;
+        butil::Base64Encode(input, &encoded);
+        butil::Base64Decode(input, &decoded);
+    }
+    {
+        butil::crc32c::Value(reinterpret_cast<const char*>(data), size);
+    }
+    {
+        butil::Hash(input);
+    }
+    {
+        butil::SHA1HashString(input);
+    }
+
+    return 0;
+}

test/fuzzing/fuzz_butil_seed_corpus/base64_decoded.txt

@@ -0,0 +1 @@
+aGVsbG8gd29ybGQ=

test/fuzzing/fuzz_butil_seed_corpus/base64_encoded.txt

@@ -0,0 +1 @@
+hello world

test/fuzzing/fuzz_common.h

@@ -0,0 +1,44 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#ifndef BRPC_TEST_FUZZING_FUZZ_COMMON_H
+#define BRPC_TEST_FUZZING_FUZZ_COMMON_H
+
+#include "brpc/socket.h"
+#include "butil/endpoint.h"
+
+// Create a valid Socket for use in fuzz harnesses that need a non-NULL Socket*.
+// Returns a raw Socket* that remains valid for the lifetime of the process
+// (held by the static SocketUniquePtr).
+inline brpc::Socket* get_fuzz_socket() {
+    static brpc::SocketId sid = 0;
+    static brpc::SocketUniquePtr sock_ptr;
+    static bool initialized = false;
+
+    if (!initialized) {
+        brpc::SocketOptions options;
+        options.remote_side = butil::EndPoint(butil::IP_ANY, 7777);
+        if (brpc::Socket::Create(options, &sid) == 0 &&
+            brpc::Socket::Address(sid, &sock_ptr) == 0) {
+            initialized = true;
+        }
+    }
+
+    return sock_ptr.get();
+}
+
+#endif // BRPC_TEST_FUZZING_FUZZ_COMMON_H

test/fuzzing/fuzz_couchbase.cpp

@@ -0,0 +1,41 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#include "brpc/policy/couchbase_protocol.h"
+#include "fuzz_common.h"
+
+#define kMinInputLength 5
+#define kMaxInputLength 4096
+
+extern "C" int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    if (size < kMinInputLength || size > kMaxInputLength){
+        return 1;
+    }
+
+    std::string input(reinterpret_cast<const char*>(data), size);
+    butil::IOBuf buf;
+    buf.append(input);
+
+    brpc::Socket* sock = get_fuzz_socket();
+    if (sock == NULL) {
+        return 0;
+    }
+    brpc::policy::ParseCouchbaseMessage(&buf, sock, false, NULL);
+    return 0;
+}

test/fuzzing/fuzz_esp.cpp

@@ -0,0 +1,43 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#include "brpc/policy/esp_protocol.h"
+#include "fuzz_common.h"
+
+#define kMinInputLength 5
+#define kMaxInputLength 1024
+
+extern "C" int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    if (size < kMinInputLength || size > kMaxInputLength){
+        return 1;
+    }
+
+    std::string input(reinterpret_cast<const char*>(data), size);
+
+    butil::IOBuf buf;
+    buf.append(input);
+
+    brpc::Socket* sock = get_fuzz_socket();
+    if (sock == NULL) {
+        return 0;
+    }
+    brpc::policy::ParseEspMessage(&buf, sock, false, NULL);
+
+    return 0;
+}

test/fuzzing/fuzz_hpack.cpp

@@ -0,0 +1,43 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#include "brpc/details/hpack.h"
+#include "butil/logging.h"
+
+#define kMinInputLength 5
+#define kMaxInputLength 1024
+
+extern "C" int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    if (size < kMinInputLength || size > kMaxInputLength){
+        return 1;
+    }
+
+    std::string input(reinterpret_cast<const char*>(data), size);
+
+    butil::IOBuf buf;
+    brpc::HPacker p2;
+    brpc::HPacker::Header h2;
+
+    p2.Init(4096);
+    buf.append(input);
+
+    p2.Decode(&buf, &h2);
+
+    return 0;
+}

test/fuzzing/fuzz_hpack_seed_corpus/header_never_indexed.hpack

@@ -0,0 +1 @@
+passwordsecret

test/fuzzing/fuzz_hpack_seed_corpus/header_with_indexing.hpack

@@ -0,0 +1,2 @@
+@
+custom-key

test/fuzzing/fuzz_hpack_seed_corpus/header_without_indexing.hpack

@@ -0,0 +1 @@
+/sample/path

test/fuzzing/fuzz_hpack_seed_corpus/requests_without_huffman.hpack

@@ -0,0 +1,2 @@
+‚‡…¿@
+custom-keycustom-value

test/fuzzing/fuzz_hpack_seed_corpus/responses_without_huffman.hpack

@@ -0,0 +1 @@
+H302XprivateaMon, 21 Oct 2013 20:13:21 GMTnhttps://www.example.com

test/fuzzing/fuzz_http.cpp

@@ -0,0 +1,45 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#include "brpc/details/http_message.h"
+#include "brpc/policy/http_rpc_protocol.h"
+
+#define kMinInputLength 5
+#define kMaxInputLength 1024
+
+extern "C" int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    if (size < kMinInputLength || size > kMaxInputLength){
+        return 1;
+    }
+
+    std::string input(reinterpret_cast<const char*>(data), size);
+
+    {
+        butil::IOBuf buf;
+        buf.append(input);
+        brpc::HttpMessage http_message;
+        http_message.ParseFromIOBuf(buf);
+    }
+    {
+        brpc::HttpMessage http_message;
+        http_message.ParseFromArray((char *)data, size);
+    }
+
+    return 0;
+}

test/fuzzing/fuzz_http_parser.cpp

@@ -0,0 +1,97 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#include <cstring>
+#include "brpc/details/http_parser.h"
+#include "brpc/http_method.h"
+
+#define kMinInputLength 5
+#define kMaxInputLength 4096
+
+static int on_url_cb(brpc::http_parser* p, const char* at, size_t length) { return 0; }
+static int on_header_field_cb(brpc::http_parser* p, const char* at, size_t length) { return 0; }
+static int on_header_value_cb(brpc::http_parser* p, const char* at, size_t length) { return 0; }
+static int on_body_cb(brpc::http_parser* p, const char* at, size_t length) { return 0; }
+static int on_message_begin_cb(brpc::http_parser* p) { return 0; }
+static int on_headers_complete_cb(brpc::http_parser* p) { return 0; }
+static int on_message_complete_cb(brpc::http_parser* p) { return 0; }
+
+extern "C" int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    if (size < kMinInputLength || size > kMaxInputLength){
+        return 1;
+    }
+
+    // Use first byte to select mode
+    uint8_t mode = data[0] % 4;
+    const uint8_t *payload = data + 1;
+    size_t payload_size = size - 1;
+
+    switch (mode) {
+        case 0: {
+            // Fuzz low-level HTTP request parsing
+            brpc::http_parser parser;
+            brpc::http_parser_init(&parser, brpc::HTTP_REQUEST);
+            brpc::http_parser_settings settings;
+            memset(&settings, 0, sizeof(settings));
+            settings.on_url = on_url_cb;
+            settings.on_header_field = on_header_field_cb;
+            settings.on_header_value = on_header_value_cb;
+            settings.on_body = on_body_cb;
+            settings.on_message_begin = on_message_begin_cb;
+            settings.on_headers_complete = on_headers_complete_cb;
+            settings.on_message_complete = on_message_complete_cb;
+            brpc::http_parser_execute(&parser, &settings,
+                               reinterpret_cast<const char*>(payload), payload_size);
+            break;
+        }
+        case 1: {
+            // Fuzz low-level HTTP response parsing
+            brpc::http_parser parser;
+            brpc::http_parser_init(&parser, brpc::HTTP_RESPONSE);
+            brpc::http_parser_settings settings;
+            memset(&settings, 0, sizeof(settings));
+            settings.on_url = on_url_cb;
+            settings.on_header_field = on_header_field_cb;
+            settings.on_header_value = on_header_value_cb;
+            settings.on_body = on_body_cb;
+            settings.on_message_begin = on_message_begin_cb;
+            settings.on_headers_complete = on_headers_complete_cb;
+            settings.on_message_complete = on_message_complete_cb;
+            brpc::http_parser_execute(&parser, &settings,
+                               reinterpret_cast<const char*>(payload), payload_size);
+            break;
+        }
+        case 2: {
+            // Fuzz URL parsing (not connect)
+            brpc::http_parser_url u;
+            brpc::http_parser_parse_url(reinterpret_cast<const char*>(payload),
+                                       payload_size, 0, &u);
+            break;
+        }
+        case 3: {
+            // Fuzz URL parsing (connect mode)
+            brpc::http_parser_url u;
+            brpc::http_parser_parse_url(reinterpret_cast<const char*>(payload),
+                                       payload_size, 1, &u);
+            break;
+        }
+    }
+
+    return 0;
+}

test/fuzzing/fuzz_http_seed_corpus/http_request.http

@@ -0,0 +1,9 @@
+GET /path/file.html?sdfsdf=sdfs HTTP/1.0
+From: someuser@jmarshall.com
+User-Agent: HTTPTool/1.0
+Content-Type: json
+Content-Length: 19
+Host: sdlfjslfd
+Accept: */*
+
+Message Body sdfsdf

test/fuzzing/fuzz_http_seed_corpus/http_request_v2.http

@@ -0,0 +1,23 @@
+GET /CloudApiControl/HttpServer/telematics/v3/weather?location=%E6%B5%B7%E5%8D%97%E7%9C%81%E7%9B%B4%E8%BE%96%E5%8E%BF%E7%BA%A7%E8%A1%8C%E6%94%BF%E5%8D%95%E4%BD%8D&output=json&ak=0l3FSP6qA0WbOzGRaafbmczS HTTP/1.1
+X-Host: api.map.baidu.com
+X-Forwarded-Proto: http
+Host: api.map.baidu.com
+User-Agent: IME/Android/4.4.2/N80.QHD.LT.X10.V3/N80.QHD.LT.X10.V3.20150812.031915
+Accept: application/json
+Accept-Charset: UTF-8,*;q=0.5
+Accept-Encoding: deflate,sdch
+Accept-Language: zh-CN,en-US;q=0.8,zh;q=0.6
+Bfe-Atk: NORMAL_BROWSER
+Bfe_logid: 8767802212038413243
+Bfeip: 10.26.124.40
+CLIENTIP: 119.29.102.26
+CLIENTPORT: 59863
+Cache-Control: max-age=0
+Content-Type: application/json;charset=utf8
+X-Forwarded-For: 119.29.102.26
+X-Forwarded-Port: 59863
+X-Ime-Imei: 35629601890905
+X_BD_LOGID: 3959476981
+X_BD_LOGID64: 16815814797661447369
+X_BD_PRODUCT: map
+X_BD_SUBSYS: apimap

test/fuzzing/fuzz_hulu.cpp

@@ -0,0 +1,43 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#include "brpc/policy/hulu_pbrpc_protocol.h"
+#include "fuzz_common.h"
+
+#define kMinInputLength 5
+#define kMaxInputLength 1024
+
+extern "C" int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    if (size < kMinInputLength || size > kMaxInputLength){
+        return 1;
+    }
+
+    std::string input(reinterpret_cast<const char*>(data), size);
+
+    butil::IOBuf buf;
+    buf.append(input);
+
+    brpc::Socket* sock = get_fuzz_socket();
+    if (sock == NULL) {
+        return 0;
+    }
+    brpc::policy::ParseHuluMessage(&buf, sock, false, NULL);
+
+    return 0;
+}

test/fuzzing/fuzz_json.cpp

@@ -0,0 +1,37 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#include "json2pb/json_to_pb.h"
+#include "addressbook1.pb.h"
+
+#define kMinInputLength 5
+#define kMaxInputLength 1024
+
+extern "C" int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    if (size < kMinInputLength || size > kMaxInputLength){
+        return 1;
+    }
+
+    std::string error;
+    JsonContextBody jsondata;
+    std::string input_data((char *)data,size);
+    json2pb::JsonToProtoMessage(input_data, &jsondata, &error);
+
+    return 0;
+}

test/fuzzing/fuzz_json_seed_corpus/info1.json

@@ -0,0 +1 @@
+{"judge":false, "spur":-2, "data":[], "info":[],"content":[]}

test/fuzzing/fuzz_json_seed_corpus/info2.json

@@ -0,0 +1 @@
+[{"container": 1000, "host": 1000, "size": 2}]

test/fuzzing/fuzz_json_seed_corpus/info3.json

@@ -0,0 +1 @@
+{"content":[{"distance":1,"unknown_member":2,"ext":{"age":1666666666, "databyte":"d2VsY29tZQ==", "enumtype":1},"uid":"someone"},{"distance":10,"unknown_member":20,"ext":{"age":1666666660, "databyte":"d2VsY29tZQ==","enumtype":2},"uid":"someone0"}], "judge":false,"spur":2, "data":[1,2,3,4,5,6,7,8,9,10]}

test/fuzzing/fuzz_memcache.cpp

@@ -0,0 +1,41 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#include "brpc/policy/memcache_binary_protocol.h"
+#include "fuzz_common.h"
+
+#define kMinInputLength 5
+#define kMaxInputLength 4096
+
+extern "C" int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    if (size < kMinInputLength || size > kMaxInputLength){
+        return 1;
+    }
+
+    std::string input(reinterpret_cast<const char*>(data), size);
+    butil::IOBuf buf;
+    buf.append(input);
+
+    brpc::Socket* sock = get_fuzz_socket();
+    if (sock == NULL) {
+        return 0;
+    }
+    brpc::policy::ParseMemcacheMessage(&buf, sock, false, NULL);
+    return 0;
+}

test/fuzzing/fuzz_mongo.cpp

@@ -0,0 +1,41 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#include "brpc/policy/mongo_protocol.h"
+#include "fuzz_common.h"
+
+#define kMinInputLength 5
+#define kMaxInputLength 4096
+
+extern "C" int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    if (size < kMinInputLength || size > kMaxInputLength){
+        return 1;
+    }
+
+    std::string input(reinterpret_cast<const char*>(data), size);
+    butil::IOBuf buf;
+    buf.append(input);
+
+    brpc::Socket* sock = get_fuzz_socket();
+    if (sock == NULL) {
+        return 0;
+    }
+    brpc::policy::ParseMongoMessage(&buf, sock, false, NULL);
+    return 0;
+}

test/fuzzing/fuzz_redis.cpp

@@ -0,0 +1,48 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#include <brpc/redis.h>
+#include <brpc/redis_command.h>
+
+#define kMinInputLength 5
+#define kMaxInputLength 1024
+
+extern "C" int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    if (size < kMinInputLength || size > kMaxInputLength){
+        return 1;
+    }
+
+    std::string input(reinterpret_cast<const char*>(data), size);
+    butil::IOBuf buf;
+    buf.append(input);
+    {
+        butil::Arena arena;
+        brpc::RedisCommandParser parser;
+        std::vector<butil::StringPiece> command_out;
+        parser.Consume(buf, &command_out, &arena);
+    }
+    {
+        butil::Arena arena;
+        brpc::RedisReply r2(&arena);
+        r2.ConsumePartialIOBuf(buf);
+    }
+
+    return 0;
+}
+

test/fuzzing/fuzz_redis_seed_corpus/command_parser.redis

@@ -0,0 +1,7 @@
+*3
+$3
+set
+$3
+abc
+$3
+def

test/fuzzing/fuzz_redis_seed_corpus/request.redis

@@ -0,0 +1 @@
+set a ''

test/fuzzing/fuzz_shead.cpp

@@ -0,0 +1,43 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+#include "brpc/policy/public_pbrpc_meta.pb.h"
+#include "brpc/policy/public_pbrpc_protocol.h"
+#include "brpc/policy/most_common_message.h"
+#include "fuzz_common.h"
+
+#define kMinInputLength 5
+#define kMaxInputLength 1024
+
+extern "C" int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    if (size < kMinInputLength || size > kMaxInputLength){
+        return 1;
+    }
+
+    std::string input(reinterpret_cast<const char*>(data), size);
+    butil::IOBuf buf;
+    buf.append(input);
+
+    brpc::Socket* sock = get_fuzz_socket();
+    if (sock == NULL) {
+        return 0;
+    }
+    brpc::policy::ParseNsheadMessage(&buf, sock, false, NULL);
+
+    return 0;
+}

test/fuzzing/fuzz_sofa.cpp

@@ -0,0 +1,44 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#include "brpc/policy/sofa_pbrpc_meta.pb.h"
+#include "brpc/policy/sofa_pbrpc_protocol.h"
+#include "brpc/policy/most_common_message.h"
+#include "fuzz_common.h"
+
+#define kMinInputLength 5
+#define kMaxInputLength 1024
+
+extern "C" int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    if (size < kMinInputLength || size > kMaxInputLength){
+        return 1;
+    }
+
+    std::string input(reinterpret_cast<const char*>(data), size);
+
+    butil::IOBuf buf;
+    buf.append(input);
+
+    brpc::Socket* sock = get_fuzz_socket();
+    if (sock == NULL) {
+        return 0;
+    }
+    brpc::policy::ParseSofaMessage(&buf, sock, false, NULL);
+    return 0;
+}

test/fuzzing/fuzz_streaming.cpp

@@ -0,0 +1,41 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#include "brpc/policy/streaming_rpc_protocol.h"
+#include "fuzz_common.h"
+
+#define kMinInputLength 5
+#define kMaxInputLength 4096
+
+extern "C" int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    if (size < kMinInputLength || size > kMaxInputLength){
+        return 1;
+    }
+
+    std::string input(reinterpret_cast<const char*>(data), size);
+    butil::IOBuf buf;
+    buf.append(input);
+
+    brpc::Socket* sock = get_fuzz_socket();
+    if (sock == NULL) {
+        return 0;
+    }
+    brpc::policy::ParseStreamingMessage(&buf, sock, false, NULL);
+    return 0;
+}

test/fuzzing/fuzz_thrift.cpp

@@ -0,0 +1,36 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#include "brpc/policy/thrift_protocol.h"
+
+#define kMinInputLength 5
+#define kMaxInputLength 4096
+
+extern "C" int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    if (size < kMinInputLength || size > kMaxInputLength){
+        return 1;
+    }
+
+    std::string input(reinterpret_cast<const char*>(data), size);
+    butil::IOBuf buf;
+    buf.append(input);
+
+    brpc::policy::ParseThriftMessage(&buf, NULL, false, NULL);
+    return 0;
+}

test/fuzzing/fuzz_uri.cpp

@@ -0,0 +1,52 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+#include "brpc/uri.h"
+#include "brpc/rtmp.h"
+
+#define kMinInputLength 5
+#define kMaxInputLength 1024
+
+extern "C" int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    if (size < kMinInputLength || size > kMaxInputLength){
+        return 1;
+    }
+
+    char *data_in = (char *)malloc(size + 1);
+    memcpy(data_in, data, size);
+    data_in[size] = '\0';
+
+
+    std::string input(reinterpret_cast<const char*>(data), size);
+    {
+        brpc::URI uri;
+        uri.SetHttpURL(input);
+    }
+    {
+        butil::StringPiece host;
+        butil::StringPiece vhost;
+        butil::StringPiece port;
+        butil::StringPiece app;
+        butil::StringPiece stream_name;
+
+        brpc::ParseRtmpURL(input, &host, &vhost, &port, &app, &stream_name);
+    }
+
+    return 0;
+}

test/fuzzing/fuzz_uri_seed_corpus/data_1.rtmp

@@ -0,0 +1 @@
+rtmp://HOST:8765//APP?vhost=abc///STREAM?queries

test/fuzzing/fuzz_uri_seed_corpus/data_1.uri

@@ -0,0 +1 @@
+www.baidu2.com/s?wd=uri2&nonkey=22#frag

test/fuzzing/fuzz_uri_seed_corpus/data_2.uri

@@ -0,0 +1 @@
+http://user:passwd@a.b.c/?d=c&a=b&e=f#frg1

test/fuzzing/oss-fuzz.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env sh
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+if [ "$SANITIZER" = "undefined" ]
+then
+    sed -i '/static void DoProfiling/i __attribute__((no_sanitize("undefined")))'   src/brpc/builtin/hotspots_service.cpp
+    sed -i '/void PProfService::heap/i __attribute__((no_sanitize("undefined")))'   src/brpc/builtin/pprof_service.cpp
+    sed -i '/void PProfService::growth/i __attribute__((no_sanitize("undefined")))' src/brpc/builtin/pprof_service.cpp
+fi
+
+mkdir -p build && cd build
+
+cmake \
+    -DCMAKE_C_COMPILER="$CC" -DCMAKE_CXX_COMPILER="$CXX" \
+    -DCMAKE_C_FLAGS="$CFLAGS" -DCMAKE_CXX_FLAGS="$CFLAGS" -DCMAKE_CPP_FLAGS="$CFLAGS" \
+    -DCMAKE_EXE_LINKER_FLAGS="$CFLAGS" -DLIB_FUZZING_ENGINE="$LIB_FUZZING_ENGINE" \
+    -DCMAKE_BUILD_TYPE=Debug -DBUILD_SHARED_LIBS=OFF -DWITH_SNAPPY=ON -DBUILD_UNIT_TESTS=ON -DBUILD_FUZZ_TESTS=ON ../.
+
+# https://github.com/google/oss-fuzz/pull/10898
+make \
+    fuzz_butil fuzz_esp fuzz_hpack fuzz_http fuzz_hulu fuzz_json \
+    fuzz_redis fuzz_shead fuzz_sofa fuzz_uri \
+    fuzz_baidu_rpc fuzz_mongo fuzz_memcache \
+    fuzz_couchbase fuzz_streaming fuzz_http_parser \
+    fuzz_amf --ignore-errors -j$(nproc)
+
+cp test/fuzz_* $OUT/
+
+pushd /lib/x86_64-linux-gnu/
+mkdir -p $OUT/lib/
+cp libgflags* libprotobuf* libleveldb* libprotoc* libsnappy* $OUT/lib/.
+popd
+
+pushd $SRC/brpc/test/fuzzing
+zip $OUT/fuzz_json_seed_corpus.zip  fuzz_json_seed_corpus/*
+zip $OUT/fuzz_uri_seed_corpus.zip   fuzz_uri_seed_corpus/*
+zip $OUT/fuzz_redis_seed_corpus.zip fuzz_redis_seed_corpus/*
+zip $OUT/fuzz_http_seed_corpus.zip  fuzz_http_seed_corpus/*
+zip $OUT/fuzz_butil_seed_corpus.zip fuzz_butil_seed_corpus/*
+zip $OUT/fuzz_hpack_seed_corpus.zip fuzz_hpack_seed_corpus/*
+popd