diff --git a/test/src/fuzzer-driver_afl.cpp b/test/src/fuzzer-driver_afl.cpp index 6fc8527fc7..e59c296c20 100644 --- a/test/src/fuzzer-driver_afl.cpp +++ b/test/src/fuzzer-driver_afl.cpp @@ -14,25 +14,41 @@ Licensed under the MIT License . #include // for vector #include // for uint8_t #include // for cin +#include // for memcpy +#include // for read extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size); +static const std::size_t MaxInputSize = 1048576; // 1MiB +static uint8_t InputBuf[MaxInputSize]; + int main() { #ifdef __AFL_HAVE_MANUAL_CONTROL + /* AFL deferred fork */ + __AFL_INIT(); + + /* AFL persistent loop */ while (__AFL_LOOP(1000)) { #endif - // copy stdin to byte vector - std::vector vec; - char c; - while (std::cin.get(c)) + + /* read data*/ + ssize_t bytesReaded = read(0, InputBuf, MaxInputSize); + if (bytesReaded > 0) { - vec.push_back(static_cast(c)); - } + /* allocate memory, exactly bytesReaded to catch overflows */ + uint8_t* tmpBuf = (uint8_t*)malloc(bytesReaded); + memcpy(tmpBuf, InputBuf, bytesReaded); - LLVMFuzzerTestOneInput(vec.data(), vec.size()); #ifdef __AFL_HAVE_MANUAL_CONTROL - } + /* run harness*/ + LLVMFuzzerTestOneInput(tmpBuf, bytesReaded); + + /* clear */ + free(tmpBuf); + } #endif + } + return 0; }