Skip to content

fuzz(asyoutypeformatter): use a valid region and phone-relevant input so the formatter is actually fuzzed - #4079

Open
sushant-me wants to merge 1 commit into
google:masterfrom
sushant-me:fix-fuzz-asyoutypeformatter-harness
Open

sushant-me wants to merge 1 commit into
google:masterfrom
sushant-me:fix-fuzz-asyoutypeformatter-harness

Conversation

@sushant-me

Copy link
Copy Markdown

Summary

The fuzz_asyoutypeformatter target is currently ineffective: it builds and runs, but
barely exercises AsYouTypeFormatter. In the OSS-Fuzz coverage report the target file
sits at 0.00% (0/532) lines / 0.00% (0/29) functions:

https://storage.googleapis.com/oss-fuzz-coverage/libphonenumber/reports/20250202/linux/file_view_index.html

Root cause (two compounding defects)

  1. Random region → empty metadata. The harness constructs the formatter with
    ConsumeBytesAsString(region_is_2_bytes ? 2 : 3), i.e. 2–3 arbitrary bytes that are
    essentially never a valid ISO-3166 alpha-2 code. AsYouTypeFormatter::GetMetadataForRegion
    then falls through to empty_metadata_ (zero NumberFormat entries), so
    possible_formats_ stays empty and no formatting template is ever built.

  2. Random char32_table_to_format_ = false. Each character is
    ConsumeIntegral<char32_t>(), a uniformly random 32-bit code point that is essentially
    never a digit (or a leading +). InputDigitWithOptionToRememberPosition immediately
    sets able_to_format_ = false and the formatter only echoes the raw input, so the
    digit state machine (AttemptToExtractIdd, AttemptToExtractCountryCode,
    AttemptToChooseFormattingPattern, InputDigitHelper, …) is never reached.

Fix

  • Select the region from a fixed set of real ISO-3166 codes so real metadata is loaded.
  • Feed characters from a phone-relevant alphabet (0123456789+*#() -) instead of
    arbitrary char32_t, keeping InputDigit on the formatting path while the fuzzer
    still controls the exact sequence/length.

Measured effect

Built from this repo with clang 22 source-based coverage and ran 20 000 executions from
an empty corpus, measuring asyoutypeformatter.cc:

harness line coverage function coverage
before 23.50% (125/532) 31.03% (9/29)
after 93.05% (495/532) 93.10% (27/29)

No sanitizer report in either run.

…nt characters

The existing harness constructs AsYouTypeFormatter with a 2-3 byte
random region string, which is essentially never a valid ISO-3166
alpha-2 code. AsYouTypeFormatter::GetMetadataForRegion then falls back
to the empty metadata instance (no NumberFormat entries), so
possible_formats_ stays empty and the formatting state machine is never
exercised. Additionally, each input character is a uniformly random
char32_t, which is essentially never a digit, so InputDigit sets
able_to_format_ = false on the first character and the formatter only
echoes the raw input.

Together these leave asyoutypeformatter.cc at 0% line/function coverage
in OSS-Fuzz (0/532 lines, 0/29 functions in the 2025-02-02 report).

Select the region from a fixed set of real region codes and feed
characters from a phone-relevant alphabet, raising local coverage from
23.5% to 93.1% of lines and 31.0% to 93.1% of functions in a 20k-run
empty-corpus comparison.
@sushant-me
sushant-me requested a review from a team as a code owner September 15, 2026 15:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant