fuzz(asyoutypeformatter): use a valid region and phone-relevant input so the formatter is actually fuzzed - #4079
Open
sushant-me wants to merge 1 commit into
Conversation
…nt characters The existing harness constructs AsYouTypeFormatter with a 2-3 byte random region string, which is essentially never a valid ISO-3166 alpha-2 code. AsYouTypeFormatter::GetMetadataForRegion then falls back to the empty metadata instance (no NumberFormat entries), so possible_formats_ stays empty and the formatting state machine is never exercised. Additionally, each input character is a uniformly random char32_t, which is essentially never a digit, so InputDigit sets able_to_format_ = false on the first character and the formatter only echoes the raw input. Together these leave asyoutypeformatter.cc at 0% line/function coverage in OSS-Fuzz (0/532 lines, 0/29 functions in the 2025-02-02 report). Select the region from a fixed set of real region codes and feed characters from a phone-relevant alphabet, raising local coverage from 23.5% to 93.1% of lines and 31.0% to 93.1% of functions in a 20k-run empty-corpus comparison.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
fuzz_asyoutypeformattertarget is currently ineffective: it builds and runs, butbarely exercises
AsYouTypeFormatter. In the OSS-Fuzz coverage report the target filesits at 0.00% (0/532) lines / 0.00% (0/29) functions:
Root cause (two compounding defects)
Random region → empty metadata. The harness constructs the formatter with
ConsumeBytesAsString(region_is_2_bytes ? 2 : 3), i.e. 2–3 arbitrary bytes that areessentially never a valid ISO-3166 alpha-2 code.
AsYouTypeFormatter::GetMetadataForRegionthen falls through to
empty_metadata_(zeroNumberFormatentries), sopossible_formats_stays empty and no formatting template is ever built.Random
char32_t→able_to_format_ = false. Each character isConsumeIntegral<char32_t>(), a uniformly random 32-bit code point that is essentiallynever a digit (or a leading
+).InputDigitWithOptionToRememberPositionimmediatelysets
able_to_format_ = falseand the formatter only echoes the raw input, so thedigit state machine (
AttemptToExtractIdd,AttemptToExtractCountryCode,AttemptToChooseFormattingPattern,InputDigitHelper, …) is never reached.Fix
0123456789+*#() -) instead ofarbitrary
char32_t, keepingInputDigiton the formatting path while the fuzzerstill controls the exact sequence/length.
Measured effect
Built from this repo with clang 22 source-based coverage and ran 20 000 executions from
an empty corpus, measuring
asyoutypeformatter.cc:No sanitizer report in either run.