Commit 3885b79e authored by Clemens Backes's avatar Clemens Backes Committed by Commit Bot

[fuzzer] Fix input validation in parser fuzzer

This fixes a simple error in the parser fuzzer, where we accessed the
{parentheses} vector without checking that it is non-empty.

Drive-by: Some formatting cleanup, and switch to {vector} for
  performance.

R=mstarzinger@chromium.org

Bug: chromium:1027132
Change-Id: I5faa39885801953f2fb698b1131eab1f138a524d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1936472Reviewed-by: 's avatarMichael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65179}
parent f817d3c7
...@@ -19,18 +19,14 @@ ...@@ -19,18 +19,14 @@
bool IsValidInput(const uint8_t* data, size_t size) { bool IsValidInput(const uint8_t* data, size_t size) {
// Ignore too long inputs as they tend to find OOM or timeouts, not real bugs. // Ignore too long inputs as they tend to find OOM or timeouts, not real bugs.
if (size > 2048) { if (size > 2048) return false;
return false;
}
std::list<char> parentheses; std::vector<char> parentheses;
const char* ptr = reinterpret_cast<const char*>(data); const char* ptr = reinterpret_cast<const char*>(data);
for (size_t i = 0; i != size; ++i) { for (size_t i = 0; i != size; ++i) {
// Check that all characters in the data are valid. // Check that all characters in the data are valid.
if (!(std::isspace(ptr[i]) || std::isprint(ptr[i]))) { if (!std::isspace(ptr[i]) && !std::isprint(ptr[i])) return false;
return false;
}
// Check balance of parentheses in the data. // Check balance of parentheses in the data.
switch (ptr[i]) { switch (ptr[i]) {
...@@ -40,15 +36,15 @@ bool IsValidInput(const uint8_t* data, size_t size) { ...@@ -40,15 +36,15 @@ bool IsValidInput(const uint8_t* data, size_t size) {
parentheses.push_back(ptr[i]); parentheses.push_back(ptr[i]);
break; break;
case ')': case ')':
if (parentheses.back() != '(') return false; if (parentheses.empty() || parentheses.back() != '(') return false;
parentheses.pop_back(); parentheses.pop_back();
break; break;
case ']': case ']':
if (parentheses.back() != '[') return false; if (parentheses.empty() || parentheses.back() != '[') return false;
parentheses.pop_back(); parentheses.pop_back();
break; break;
case '}': case '}':
if (parentheses.back() != '{') return false; if (parentheses.empty() || parentheses.back() != '{') return false;
parentheses.pop_back(); parentheses.pop_back();
break; break;
default: default:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment