Commit 3885b79e authored by Clemens Backes's avatar Clemens Backes Committed by Commit Bot

[fuzzer] Fix input validation in parser fuzzer

This fixes a simple error in the parser fuzzer, where we accessed the
{parentheses} vector without checking that it is non-empty.

Drive-by: Some formatting cleanup, and switch to {vector} for
  performance.

R=mstarzinger@chromium.org

Bug: chromium:1027132
Change-Id: I5faa39885801953f2fb698b1131eab1f138a524d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1936472Reviewed-by: 's avatarMichael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65179}
parent f817d3c7
......@@ -19,18 +19,14 @@
bool IsValidInput(const uint8_t* data, size_t size) {
// Ignore too long inputs as they tend to find OOM or timeouts, not real bugs.
if (size > 2048) {
return false;
}
if (size > 2048) return false;
std::list<char> parentheses;
std::vector<char> parentheses;
const char* ptr = reinterpret_cast<const char*>(data);
for (size_t i = 0; i != size; ++i) {
// Check that all characters in the data are valid.
if (!(std::isspace(ptr[i]) || std::isprint(ptr[i]))) {
return false;
}
if (!std::isspace(ptr[i]) && !std::isprint(ptr[i])) return false;
// Check balance of parentheses in the data.
switch (ptr[i]) {
......@@ -40,15 +36,15 @@ bool IsValidInput(const uint8_t* data, size_t size) {
parentheses.push_back(ptr[i]);
break;
case ')':
if (parentheses.back() != '(') return false;
if (parentheses.empty() || parentheses.back() != '(') return false;
parentheses.pop_back();
break;
case ']':
if (parentheses.back() != '[') return false;
if (parentheses.empty() || parentheses.back() != '[') return false;
parentheses.pop_back();
break;
case '}':
if (parentheses.back() != '{') return false;
if (parentheses.empty() || parentheses.back() != '{') return false;
parentheses.pop_back();
break;
default:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment