@@ -4,12 +4,8 @@
#include <stdlib.h>
#include <string.h>
#include <getopt.h>
+#include "fuzz-emul.h"
-extern int LLVMFuzzerInitialize(int *argc, char ***argv);
-extern int LLVMFuzzerTestOneInput(const uint8_t *data_p, size_t size);
-extern unsigned int fuzz_minimal_input_size(void);
-
-#define INPUT_SIZE 4096
static uint8_t input[INPUT_SIZE];
int main(int argc, char **argv)
@@ -16,6 +16,7 @@
#include <xen/xen.h>
#include "x86-emulate.h"
+#include "fuzz-emul.h"
#define MSR_INDEX_MAX 16
@@ -29,7 +30,7 @@ struct fuzz_corpus
struct cpu_user_regs regs;
struct segment_register segments[SEG_NUM];
unsigned long options;
- unsigned char data[4096];
+ unsigned char data[INPUT_SIZE];
} input;
#define DATA_OFFSET offsetof(struct fuzz_corpus, data)
@@ -827,7 +828,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data_p, size_t size)
return 1;
}
- if ( size > sizeof(input) )
+ if ( size > INPUT_SIZE )
{
printf("Input too large\n");
return 1;
@@ -858,6 +859,8 @@ int LLVMFuzzerTestOneInput(const uint8_t *data_p, size_t size)
unsigned int fuzz_minimal_input_size(void)
{
+ BUILD_BUG_ON(DATA_OFFSET > INPUT_SIZE);
+
return DATA_OFFSET + 1;
}
new file mode 100644
@@ -0,0 +1,10 @@
+#ifndef FUZZ_EMUL_H
+# define FUZZ_EMUL_H
+
+extern int LLVMFuzzerInitialize(int *argc, char ***argv);
+extern int LLVMFuzzerTestOneInput(const uint8_t *data_p, size_t size);
+extern unsigned int fuzz_minimal_input_size(void);
+
+#define INPUT_SIZE 4096
+
+#endif /* ifdef FUZZ_EMUL_H */
Move fuzz-emul.c function prototypes into a header. Also share the definition of the input size (rather than hard-coding it in fuzz-emul.c). Signed-off-by: George Dunlap <george.dunlap@citrix.com> --- RFC: Worth trying to BUILD_BUG_ON(INPUT_SIZE < DATA_SIZE_FULL)? v4: - Move earlier in the queue. - Rebase over previous patch (getting rid of fuzz_corpus struct) - Add build-time assert v3: - New in this version CC: Ian Jackson <ian.jackson@citrix.com> CC: Wei Liu <wei.liu2@citrix.com> CC: Andrew Cooper <andrew.cooper3@citrix.com> CC: Jan Beulich <jbeulich@suse.com> --- tools/fuzz/x86_instruction_emulator/afl-harness.c | 6 +----- tools/fuzz/x86_instruction_emulator/fuzz-emul.c | 7 +++++-- tools/fuzz/x86_instruction_emulator/fuzz-emul.h | 10 ++++++++++ 3 files changed, 16 insertions(+), 7 deletions(-) create mode 100644 tools/fuzz/x86_instruction_emulator/fuzz-emul.h