chore: import upstream snapshot with attribution

tensorflow/security/fuzzing/cc/ops/BUILD

@@ -0,0 +1,142 @@
+# Fuzzing TensorFlow ops with GFT
+# Most ops have a similar set of dependencies and a similar fuzzing
+# infrastructure. Hence, we gather everything in one single place.
+# Note that these fuzzers cover a large part of TF, they are not granular.
+
+load(
+    "//tensorflow/security/fuzzing:tf_fuzzing.bzl",
+    "tf_cc_fuzz_test",
+)
+
+# copybara:uncomment package(default_applicable_licenses = ["//tensorflow:license"])
+
+# A trivial fuzzer with no pre-specified corpus.
+tf_cc_fuzz_test(
+    name = "identity_fuzz",
+    srcs = ["identity_fuzz.cc"],
+    tags = ["no_oss"],
+    deps = [
+        "//tensorflow/cc:cc_ops",
+        "//tensorflow/core/framework:types_proto_cc",
+        "//tensorflow/core/kernels:array",
+        "//tensorflow/security/fuzzing/cc:fuzz_session",
+        "//tensorflow/security/fuzzing/cc/core/framework:tensor_domains",
+        "//tensorflow/security/fuzzing/cc/core/framework:tensor_shape_domains",
+        "@com_google_absl//absl/log",
+        "@com_google_absl//absl/status",
+    ],
+)
+
+tf_cc_fuzz_test(
+    name = "concat_fuzz",
+    srcs = ["concat_fuzz.cc"],
+    tags = ["no_oss"],
+    deps = [
+        "//tensorflow/cc:cc_ops",
+        "//tensorflow/core/framework:types_proto_cc",
+        "//tensorflow/core/kernels:array",
+        "//tensorflow/security/fuzzing/cc:fuzz_session",
+        "//tensorflow/security/fuzzing/cc/core/framework:tensor_domains",
+        "//tensorflow/security/fuzzing/cc/core/framework:tensor_shape_domains",
+        "@com_google_absl//absl/log",
+        "@com_google_absl//absl/status",
+    ],
+)
+
+tf_cc_fuzz_test(
+    name = "add_fuzz",
+    srcs = ["add_fuzz.cc"],
+    tags = ["no_oss"],
+    deps = [
+        "//tensorflow/cc:cc_ops",
+        "//tensorflow/core/framework:types_proto_cc",
+        "//tensorflow/core/kernels:array",
+        "//tensorflow/security/fuzzing/cc:fuzz_session",
+        "//tensorflow/security/fuzzing/cc/core/framework:datatype_domains",
+        "//tensorflow/security/fuzzing/cc/core/framework:tensor_domains",
+        "//tensorflow/security/fuzzing/cc/core/framework:tensor_shape_domains",
+    ],
+)
+
+tf_cc_fuzz_test(
+    name = "matmul_fuzz",
+    srcs = ["matmul_fuzz.cc"],
+    tags = [
+        "no_oss",
+        "noasan",  # b/283972985
+    ],
+    deps = [
+        "//tensorflow/cc:cc_ops",
+        "//tensorflow/core/framework:types_proto_cc",
+        "//tensorflow/core/kernels:array",
+        "//tensorflow/core/kernels:matmul_op",
+        "//tensorflow/security/fuzzing/cc:fuzz_session",
+        "//tensorflow/security/fuzzing/cc/core/framework:tensor_domains",
+    ],
+)
+
+tf_cc_fuzz_test(
+    name = "bincount_fuzz",
+    srcs = ["bincount_fuzz.cc"],
+    tags = ["no_oss"],
+    deps = [
+        "//tensorflow/cc:cc_ops",
+        "//tensorflow/core/framework:types_proto_cc",
+        "//tensorflow/core/kernels:array",
+        "//tensorflow/core/kernels:bincount_op",
+        "//tensorflow/security/fuzzing/cc:fuzz_session",
+        "//tensorflow/security/fuzzing/cc/core/framework:tensor_domains",
+        "//tensorflow/security/fuzzing/cc/core/framework:tensor_shape_domains",
+        "@com_google_absl//absl/log",
+        "@com_google_absl//absl/status",
+    ],
+)
+
+tf_cc_fuzz_test(
+    name = "string_to_number_fuzz",
+    srcs = ["string_to_number_fuzz.cc"],
+    tags = ["no_oss"],
+    deps = [
+        "//tensorflow/cc:cc_ops",
+        "//tensorflow/core/framework:types_proto_cc",
+        "//tensorflow/core/kernels:array",
+        "//tensorflow/core/kernels:string_to_number_op",
+        "//tensorflow/security/fuzzing/cc:fuzz_session",
+        "@com_google_absl//absl/log",
+        "@com_google_absl//absl/status",
+    ],
+)
+
+tf_cc_fuzz_test(
+    name = "string_ops_fuzz",
+    srcs = ["string_ops_fuzz.cc"],
+    tags = ["no_oss"],
+    deps = [
+        "//tensorflow/cc:cc_ops",
+        "//tensorflow/core/framework:types_proto_cc",
+        "//tensorflow/core/kernels:array",
+        "//tensorflow/core/kernels:string",
+        "//tensorflow/core/kernels:string_split_op",
+        "//tensorflow/security/fuzzing/cc:fuzz_session",
+        "@com_google_absl//absl/log",
+        "@com_google_absl//absl/status",
+    ],
+)
+
+tf_cc_fuzz_test(
+    name = "general_ops_fuzz",
+    srcs = ["general_ops_fuzz.cc"],
+    shard_count = 5,
+    deps = [
+        "//tensorflow/cc:cc_ops",
+        "//tensorflow/core/framework:tensor",
+        "//tensorflow/core/framework:types_proto_cc",
+        "//tensorflow/core/kernels:array",
+        "//tensorflow/core/kernels:decode_wav_op",
+        "//tensorflow/core/kernels/image",
+        "//tensorflow/core/kernels/image:decode_image_op",
+        "//tensorflow/core/ops:audio_ops_op_lib",
+        "//tensorflow/security/fuzzing/cc:fuzz_session",
+        "//tensorflow/security/fuzzing/cc/core/framework:tensor_domains",
+    ],
+)

tensorflow/security/fuzzing/cc/ops/add_fuzz.cc

@@ -0,0 +1,37 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "fuzztest/fuzztest.h"
+#include "tensorflow/cc/ops/math_ops.h"
+#include "tensorflow/cc/ops/standard_ops.h"
+#include "tensorflow/core/framework/types.pb.h"
+#include "tensorflow/security/fuzzing/cc/core/framework/datatype_domains.h"
+#include "tensorflow/security/fuzzing/cc/core/framework/tensor_domains.h"
+#include "tensorflow/security/fuzzing/cc/core/framework/tensor_shape_domains.h"
+#include "tensorflow/security/fuzzing/cc/fuzz_session.h"
+
+namespace tensorflow {
+namespace fuzzing {
+
+// Creates FuzzIdentity class that wraps a single operation node session.
+BINARY_INPUT_OP_FUZZER(DT_UINT8, DT_UINT8, Add);
+// Setup up fuzzing test.
+FUZZ_TEST_F(FuzzAdd, Fuzz)
+    .WithDomains(AnyValidNumericTensor(AnyValidTensorShape(3, 0, 5),
+                                       AnyValidDataType()),
+                 AnyValidNumericTensor(AnyValidTensorShape(3, 0, 5),
+                                       AnyValidDataType()));
+
+}  // end namespace fuzzing
+}  // end namespace tensorflow

tensorflow/security/fuzzing/cc/ops/bincount_fuzz.cc

@@ -0,0 +1,70 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <cstdint>
+#include <vector>
+
+#include "fuzztest/fuzztest.h"
+#include "absl/log/log.h"
+#include "absl/status/status.h"
+#include "tensorflow/cc/ops/standard_ops.h"
+#include "tensorflow/core/framework/types.pb.h"
+#include "tensorflow/security/fuzzing/cc/core/framework/tensor_domains.h"
+#include "tensorflow/security/fuzzing/cc/core/framework/tensor_shape_domains.h"
+#include "tensorflow/security/fuzzing/cc/fuzz_session.h"
+
+namespace tensorflow {
+namespace fuzzing {
+
+// Creates FuzzBincount class that wraps a single operation node session.
+class FuzzBincount : public FuzzSession<Tensor, int32_t, Tensor> {
+  void BuildGraph(const Scope& scope) override {
+    auto arr = tensorflow::ops::Placeholder(scope.WithOpName("arr"), DT_INT32);
+    auto size =
+        tensorflow::ops::Placeholder(scope.WithOpName("size"), DT_INT32);
+    auto weights =
+        tensorflow::ops::Placeholder(scope.WithOpName("weights"), DT_INT32);
+    tensorflow::ops::Bincount(scope.WithOpName("output"), arr, size, weights);
+  }
+  void FuzzImpl(const Tensor& arr, const int32_t& nbins,
+                const Tensor& weights) final {
+    Tensor size(DT_INT32, {});
+    size.flat<int32_t>()(0) = nbins;
+
+    absl::Status s = RunInputsWithStatus(
+        {{"arr", arr}, {"size", size}, {"weights", weights}});
+    if (!s.ok()) {
+      LOG(ERROR) << "Execution failed: " << s.message();
+    }
+  }
+};
+
+// Setup up fuzzing test.
+// TODO(unda, b/275737422): Make the values in arr be within [0, size) with high
+// chance
+FUZZ_TEST_F(FuzzBincount, Fuzz)
+    .WithDomains(fuzzing::AnyValidNumericTensor(fuzzing::AnyValidTensorShape(
+                                                    /*max_rank=*/5,
+                                                    /*dim_lower_bound=*/0,
+                                                    /*dim_upper_bound=*/10),
+                                                fuzztest::Just(DT_INT32)),
+                 fuzztest::InRange<int32_t>(0, 10),
+                 fuzzing::AnyValidNumericTensor(fuzzing::AnyValidTensorShape(
+                                                    /*max_rank=*/5,
+                                                    /*dim_lower_bound=*/0,
+                                                    /*dim_upper_bound=*/10),
+                                                fuzztest::Just(DT_INT32)));
+
+}  // end namespace fuzzing
+}  // end namespace tensorflow

tensorflow/security/fuzzing/cc/ops/concat_fuzz.cc

@@ -0,0 +1,72 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <cstdint>
+#include <vector>
+
+#include "fuzztest/fuzztest.h"
+#include "absl/log/log.h"
+#include "absl/status/status.h"
+#include "tensorflow/cc/ops/standard_ops.h"
+#include "tensorflow/core/framework/types.pb.h"
+#include "tensorflow/security/fuzzing/cc/core/framework/tensor_domains.h"
+#include "tensorflow/security/fuzzing/cc/core/framework/tensor_shape_domains.h"
+#include "tensorflow/security/fuzzing/cc/fuzz_session.h"
+
+namespace tensorflow {
+namespace fuzzing {
+
+// Creates FuzzConcat class that wraps a single operation node session.
+class FuzzConcat : public FuzzSession<Tensor, Tensor, int32_t> {
+  void BuildGraph(const Scope& scope) override {
+    auto value1 =
+        tensorflow::ops::Placeholder(scope.WithOpName("value1"), DT_INT32);
+    Input value1_input(value1);
+    auto value2 =
+        tensorflow::ops::Placeholder(scope.WithOpName("value2"), DT_INT32);
+    Input value2_input(value2);
+    InputList values_input_list({value1_input, value2_input});
+    auto axis =
+        tensorflow::ops::Placeholder(scope.WithOpName("axis"), DT_INT32);
+    tensorflow::ops::Concat(scope.WithOpName("output"), values_input_list,
+                            axis);
+  }
+  void FuzzImpl(const Tensor& value1, const Tensor& value2,
+                const int32_t& axis) final {
+    Tensor axis_tensor(DT_INT32, {});
+    axis_tensor.scalar<int32_t>()() = axis;
+    absl::Status s = RunInputsWithStatus(
+        {{"value1", value1}, {"value2", value2}, {"axis", axis_tensor}});
+    if (!s.ok()) {
+      LOG(ERROR) << "Execution failed: " << s.message();
+    }
+  }
+};
+
+// Setup up fuzzing test.
+FUZZ_TEST_F(FuzzConcat, Fuzz)
+    .WithDomains(fuzzing::AnyValidNumericTensor(fuzzing::AnyValidTensorShape(
+                                                    /*max_rank=*/5,
+                                                    /*dim_lower_bound=*/0,
+                                                    /*dim_upper_bound=*/10),
+                                                fuzztest::Just(DT_INT32)),
+                 fuzzing::AnyValidNumericTensor(fuzzing::AnyValidTensorShape(
+                                                    /*max_rank=*/5,
+                                                    /*dim_lower_bound=*/0,
+                                                    /*dim_upper_bound=*/10),
+                                                fuzztest::Just(DT_INT32)),
+                 fuzztest::InRange<int32_t>(0, 6));
+
+}  // end namespace fuzzing
+}  // end namespace tensorflow

tensorflow/security/fuzzing/cc/ops/general_ops_fuzz.cc

@@ -0,0 +1,100 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+
+#include "fuzztest/fuzztest.h"
+#include "tensorflow/cc/ops/array_ops.h"
+#include "tensorflow/cc/ops/audio_ops.h"
+#include "tensorflow/cc/ops/image_ops.h"
+#include "tensorflow/core/framework/types.pb.h"
+#include "tensorflow/security/fuzzing/cc/core/framework/tensor_domains.h"
+#include "tensorflow/security/fuzzing/cc/fuzz_session.h"
+
+namespace tensorflow::fuzzing {
+
+// Image op fuzzers
+// DecodePng
+SINGLE_INPUT_OP_FUZZER(DT_STRING, DecodePng);
+class FuzzDecodePngValidInput : public FuzzDecodePng {};
+FUZZ_TEST_F(FuzzDecodePngValidInput, Fuzz)
+    .WithDomains(fuzzing::AnyValidStringTensor({},
+                                               fuzztest::InRegexp("[-.0-9]+")));
+class FuzzDecodePngArbitraryInput : public FuzzDecodePng {};
+FUZZ_TEST_F(FuzzDecodePngArbitraryInput, Fuzz)
+    .WithDomains(fuzzing::AnyValidStringTensor({}));
+
+// DecodeJpeg
+SINGLE_INPUT_OP_FUZZER(DT_STRING, DecodeJpeg);
+class FuzzDecodeJpegValidInput : public FuzzDecodeJpeg {};
+FUZZ_TEST_F(FuzzDecodeJpegValidInput, Fuzz)
+    .WithDomains(fuzzing::AnyValidStringTensor({},
+                                               fuzztest::InRegexp("[-.0-9]+")));
+class FuzzDecodeJpegArbitraryInput : public FuzzDecodeJpeg {};
+FUZZ_TEST_F(FuzzDecodeJpegArbitraryInput, Fuzz)
+    .WithDomains(fuzzing::AnyValidStringTensor({}));
+
+// DecodeGif
+SINGLE_INPUT_OP_FUZZER(DT_STRING, DecodeGif);
+class FuzzDecodeGifValidInput : public FuzzDecodeGif {};
+FUZZ_TEST_F(FuzzDecodeGifValidInput, Fuzz)
+    .WithDomains(fuzzing::AnyValidStringTensor({},
+                                               fuzztest::InRegexp("[-.0-9]+")));
+class FuzzDecodeGifArbitraryInput : public FuzzDecodeGif {};
+FUZZ_TEST_F(FuzzDecodeGifArbitraryInput, Fuzz)
+    .WithDomains(fuzzing::AnyValidStringTensor({}));
+
+// DecodeImage
+SINGLE_INPUT_OP_FUZZER(DT_STRING, DecodeImage);
+class FuzzDecodeImageValidInput : public FuzzDecodeImage {};
+FUZZ_TEST_F(FuzzDecodeImageValidInput, Fuzz)
+    .WithDomains(fuzzing::AnyValidStringTensor({},
+                                               fuzztest::InRegexp("[-.0-9]+")));
+class FuzzDecodeImageArbitraryInput : public FuzzDecodeImage {};
+FUZZ_TEST_F(FuzzDecodeImageArbitraryInput, Fuzz)
+    .WithDomains(fuzzing::AnyValidStringTensor({}));
+
+// DecodeBmp
+SINGLE_INPUT_OP_FUZZER(DT_STRING, DecodeBmp);
+class FuzzDecodeBmpValidInput : public FuzzDecodeBmp {};
+FUZZ_TEST_F(FuzzDecodeBmpValidInput, Fuzz)
+    .WithDomains(fuzzing::AnyValidStringTensor({},
+                                               fuzztest::InRegexp("[-.0-9]+")));
+class FuzzDecodeBmpArbitraryInput : public FuzzDecodeBmp {};
+FUZZ_TEST_F(FuzzDecodeBmpArbitraryInput, Fuzz)
+    .WithDomains(fuzzing::AnyValidStringTensor({}));
+
+// DecodeAndCropJpeg
+BINARY_INPUT_OP_FUZZER(DT_STRING, DT_INT32, DecodeAndCropJpeg);
+class FuzzDecodeAndCropJpegValidInput : public FuzzDecodeAndCropJpeg {};
+FUZZ_TEST_F(FuzzDecodeAndCropJpegValidInput, Fuzz)
+    .WithDomains(fuzzing::AnyValidStringTensor({},
+                                               fuzztest::InRegexp("[-.0-9]+")),
+                 fuzzing::AnyValidNumericTensor({}, DT_INT32, 0, 4096));
+class FuzzDecodeAndCropJpegArbitraryInput : public FuzzDecodeAndCropJpeg {};
+FUZZ_TEST_F(FuzzDecodeAndCropJpegArbitraryInput, Fuzz)
+    .WithDomains(fuzzing::AnyValidStringTensor({}),
+                 fuzzing::AnyValidNumericTensor({}, DT_INT32, 0, 4096));
+
+// Audio op fuzzers
+// DecodeWav
+SINGLE_INPUT_OP_FUZZER(DT_STRING, DecodeWav);
+class FuzzDecodeWavValidInput : public FuzzDecodeWav {};
+FUZZ_TEST_F(FuzzDecodeWavValidInput, Fuzz)
+    .WithDomains(fuzzing::AnyValidStringTensor({},
+                                               fuzztest::InRegexp("[-.0-9]+")));
+class FuzzDecodeWavArbitraryInput : public FuzzDecodeWav {};
+FUZZ_TEST_F(FuzzDecodeWavArbitraryInput, Fuzz)
+    .WithDomains(fuzzing::AnyValidStringTensor({}));
+
+}  // end namespace tensorflow::fuzzing

tensorflow/security/fuzzing/cc/ops/identity_fuzz.cc

@@ -0,0 +1,53 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <vector>
+
+#include "fuzztest/fuzztest.h"
+#include "absl/log/log.h"
+#include "absl/status/status.h"
+#include "tensorflow/cc/ops/standard_ops.h"
+#include "tensorflow/core/framework/types.pb.h"
+#include "tensorflow/security/fuzzing/cc/core/framework/tensor_domains.h"
+#include "tensorflow/security/fuzzing/cc/core/framework/tensor_shape_domains.h"
+#include "tensorflow/security/fuzzing/cc/fuzz_session.h"
+
+namespace tensorflow {
+namespace fuzzing {
+
+// Creates FuzzIdentity class that wraps a single operation node session.
+class FuzzIdentity : public FuzzSession<Tensor> {
+  void BuildGraph(const Scope& scope) override {
+    auto op_node =
+        tensorflow::ops::Placeholder(scope.WithOpName("input"), DT_INT32);
+    tensorflow::ops::Identity(scope.WithOpName("output"), op_node);
+  }
+  void FuzzImpl(const Tensor& input_tensor) final {
+    absl::Status s = RunInputsWithStatus({{"input", input_tensor}});
+    if (!s.ok()) {
+      LOG(ERROR) << "Execution failed: " << s.message();
+    }
+  }
+};
+
+// Setup up fuzzing test.
+FUZZ_TEST_F(FuzzIdentity, Fuzz)
+    .WithDomains(fuzzing::AnyValidNumericTensor(fuzzing::AnyValidTensorShape(
+                                                    /*max_rank=*/5,
+                                                    /*dim_lower_bound=*/0,
+                                                    /*dim_upper_bound=*/10),
+                                                fuzztest::Just(DT_INT32)));
+
+}  // end namespace fuzzing
+}  // end namespace tensorflow

tensorflow/security/fuzzing/cc/ops/matmul_fuzz.cc

@@ -0,0 +1,33 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "fuzztest/fuzztest.h"
+#include "tensorflow/cc/ops/math_ops.h"
+#include "tensorflow/cc/ops/standard_ops.h"
+#include "tensorflow/core/framework/types.pb.h"
+#include "tensorflow/security/fuzzing/cc/core/framework/tensor_domains.h"
+#include "tensorflow/security/fuzzing/cc/fuzz_session.h"
+
+namespace tensorflow {
+namespace fuzzing {
+
+// Creates FuzzIdentity class that wraps a single operation node session.
+BINARY_INPUT_OP_FUZZER(DT_INT32, DT_INT32, MatMul);
+// Setup up fuzzing test.
+FUZZ_TEST_F(FuzzMatMul, Fuzz)
+    .WithDomains(fuzzing::AnySmallValidNumericTensor(),
+                 fuzzing::AnySmallValidNumericTensor());
+
+}  // end namespace fuzzing
+}  // end namespace tensorflow

tensorflow/security/fuzzing/cc/ops/string_ops_fuzz.cc

@@ -0,0 +1,119 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#include <string>
+
+#include "fuzztest/fuzztest.h"
+#include "absl/log/log.h"
+#include "absl/status/status.h"
+#include "tensorflow/cc/ops/standard_ops.h"
+#include "tensorflow/core/framework/types.pb.h"
+#include "tensorflow/security/fuzzing/cc/fuzz_session.h"
+
+namespace tensorflow {
+namespace fuzzing {
+
+class FuzzStringOpsStringSplit : public FuzzSession<std::string, std::string> {
+  void BuildGraph(const Scope& scope) override {
+    auto op_node =
+        tensorflow::ops::Placeholder(scope.WithOpName("input"), DT_STRING);
+    auto op_node2 =
+        tensorflow::ops::Placeholder(scope.WithOpName("delimiter"), DT_STRING);
+
+    tensorflow::ops::StringSplit(scope.WithOpName("output"), op_node, op_node2);
+  }
+
+  void FuzzImpl(const std::string& input_string,
+                const std::string& separator_string) final {
+    Tensor input_tensor(tensorflow::DT_STRING, {2});
+
+    auto svec = input_tensor.flat<tstring>();
+    svec(0) = input_string.c_str();
+    svec(1) = input_string.c_str();
+
+    Tensor separator_tensor(tensorflow::DT_STRING, TensorShape({}));
+    separator_tensor.scalar<tensorflow::tstring>()() = separator_string;
+
+    absl::Status s = RunInputsWithStatus(
+        {{"input", input_tensor}, {"delimiter", separator_tensor}});
+    if (!s.ok()) {
+      LOG(ERROR) << "Execution failed: " << s.message();
+    }
+  }
+};
+FUZZ_TEST_F(FuzzStringOpsStringSplit, Fuzz)
+    .WithDomains(fuzztest::OneOf(fuzztest::InRegexp("[-.0-9]+"),
+                                 fuzztest::Arbitrary<std::string>()),
+                 fuzztest::OneOf(fuzztest::InRegexp("[-.0-9]+"),
+                                 fuzztest::Arbitrary<std::string>()));
+
+class FuzzStringOpsStringSplitV2
+    : public FuzzSession<std::string, std::string> {
+  void BuildGraph(const Scope& scope) override {
+    auto op_node =
+        tensorflow::ops::Placeholder(scope.WithOpName("input"), DT_STRING);
+    auto op_node2 =
+        tensorflow::ops::Placeholder(scope.WithOpName("separator"), DT_STRING);
+
+    tensorflow::ops::StringSplitV2(scope.WithOpName("output"), op_node,
+                                   op_node2);
+  }
+
+  void FuzzImpl(const std::string& input_string,
+                const std::string& separator_string) final {
+    Tensor input_tensor(tensorflow::DT_STRING, {2});
+
+    auto svec = input_tensor.flat<tstring>();
+    svec(0) = input_string.c_str();
+    svec(1) = input_string.c_str();
+
+    Tensor separator_tensor(tensorflow::DT_STRING, TensorShape({}));
+    separator_tensor.scalar<tensorflow::tstring>()() = separator_string;
+
+    absl::Status s = RunInputsWithStatus(
+        {{"input", input_tensor}, {"separator", separator_tensor}});
+    if (!s.ok()) {
+      LOG(ERROR) << "Execution failed: " << s.message();
+    }
+  }
+};
+FUZZ_TEST_F(FuzzStringOpsStringSplitV2, Fuzz)
+    .WithDomains(fuzztest::OneOf(fuzztest::InRegexp("[-.0-9]+"),
+                                 fuzztest::Arbitrary<std::string>()),
+                 fuzztest::OneOf(fuzztest::InRegexp("[-.0-9]+"),
+                                 fuzztest::Arbitrary<std::string>()));
+
+class FuzzStringOpsStringUpper : public FuzzSession<std::string> {
+  void BuildGraph(const Scope& scope) override {
+    auto op_node =
+        tensorflow::ops::Placeholder(scope.WithOpName("input"), DT_STRING);
+
+    tensorflow::ops::StringUpper(scope.WithOpName("output"), op_node);
+  }
+
+  void FuzzImpl(const std::string& input_string) final {
+    Tensor input_tensor(tensorflow::DT_STRING, TensorShape({}));
+    input_tensor.scalar<tensorflow::tstring>()() = input_string;
+
+    absl::Status s = RunInputsWithStatus({{"input", input_tensor}});
+    if (!s.ok()) {
+      LOG(ERROR) << "Execution failed: " << s.message();
+    }
+  }
+};
+FUZZ_TEST_F(FuzzStringOpsStringUpper, Fuzz)
+    .WithDomains(fuzztest::OneOf(fuzztest::InRegexp("[-.0-9]+"),
+                                 fuzztest::Arbitrary<std::string>()));
+
+}  // end namespace fuzzing
+}  // end namespace tensorflow

tensorflow/security/fuzzing/cc/ops/string_to_number_fuzz.cc

@@ -0,0 +1,49 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#include <string>
+
+#include "fuzztest/fuzztest.h"
+#include "absl/log/log.h"
+#include "absl/status/status.h"
+#include "tensorflow/cc/ops/standard_ops.h"
+#include "tensorflow/core/framework/types.pb.h"
+#include "tensorflow/security/fuzzing/cc/fuzz_session.h"
+
+namespace tensorflow {
+namespace fuzzing {
+
+// Creates FuzzStringToNumber class that wraps a single operation node session.
+class FuzzStringToNumber : public FuzzSession<std::string> {
+  void BuildGraph(const Scope& scope) override {
+    auto op_node =
+        tensorflow::ops::Placeholder(scope.WithOpName("input"), DT_STRING);
+    tensorflow::ops::StringToNumber(scope.WithOpName("output"), op_node);
+  }
+  void FuzzImpl(const std::string& input_string) final {
+    Tensor input_tensor(tensorflow::DT_STRING, TensorShape({}));
+    input_tensor.scalar<tensorflow::tstring>()() = input_string;
+    absl::Status s = RunInputsWithStatus({{"input", input_tensor}});
+    if (!s.ok()) {
+      LOG(ERROR) << "Execution failed: " << s.message();
+    }
+  }
+};
+
+// Setup up fuzzing test.
+FUZZ_TEST_F(FuzzStringToNumber, Fuzz)
+    .WithDomains(fuzztest::OneOf(fuzztest::InRegexp("[-.0-9]+"),
+                                 fuzztest::Arbitrary<std::string>()));
+
+}  // end namespace fuzzing
+}  // end namespace tensorflow