Initial commit of a simple fuzzer based on tests/bincode.rs.

fuzz/.gitignore

@@ -0,0 +1,4 @@
+
+target
+corpus
+artifacts

fuzz/Cargo.toml

@@ -0,0 +1,33 @@
+
+[package]
+name = "serde-bench-fuzz"
+version = "0.0.0"
+authors = ["Automatically generated"]
+publish = false
+edition = "2018"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies.serde-bench]
+path = ".."
+[dependencies.libfuzzer-sys]
+git = "https://github.com/rust-fuzz/libfuzzer-sys.git"
+[dependencies.byteorder]
+version = "1.0"
+[dependencies.serde]
+version = "1.0"
+
+[dependencies.bincode]
+version = "1.0"
+[dev-dependencies.serde]
+version = "1.0"
+features = ["derive"]
+
+# Prevent this from interfering with workspaces
+[workspace]
+members = ["."]
+
+[[bin]]
+name = "bincode"
+path = "fuzz_targets/bincode.rs"

fuzz/README.md

@@ -0,0 +1,32 @@
+This directory contains the fuzz tests for serde-bench. To fuzz, we use the `cargo-fuzz` package.
+
+## Installation
+
+You may need to install the `cargo-fuzz` package to get the `cargo fuzz` subcommand. Use
+
+```sh
+$ cargo install cargo-fuzz
+```
+
+`cargo-fuzz` is documented in the [Rust Fuzz Book](https://rust-fuzz.github.io/book/cargo-fuzz.html).
+
+## Running the fuzzer
+
+Once `cargo-fuzz` is installed, you can run the `bincode` fuzzer with
+```sh
+cargo fuzz run bincode
+```
+
+You should see output that looks something like this:
+
+```
+INFO: Seed: 2073236486
+INFO: Loaded 1 modules   (16636 inline 8-bit counters): 16636 [0x55cf2eddac48, 0x55cf2edded44), 
+INFO: Loaded 1 PC tables (16636 PCs): 16636 [0x55cf2edded48,0x55cf2ee1fd08), 
+INFO:       26 files found in /home/nicholas/bench/fuzz/corpus/bincode
+INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
+INFO: seed corpus: files: 26 min: 1b max: 86b total: 1135b rss: 127Mb
+#27     INITED cov: 2901 ft: 3189 corp: 21/833b exec/s: 0 rss: 172Mb
+#2048   pulse  cov: 2901 ft: 3189 corp: 21/833b lim: 100 exec/s: 1024 rss: 174Mb
+```
+It will continue to generate random inputs forever, until it finds a bug or is terminated. The testcases for bugs it finds go into `fuzz/artifacts/bincode` and you can rerun the fuzzer on a single input by passing it on the command line `cargo fuzz run bincode my_testcase`.

fuzz/fuzz_targets/bincode.rs

@@ -0,0 +1,125 @@
+#![no_main]
+use libfuzzer_sys::fuzz_target;
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, PartialEq, Eq, Debug)]
+struct Foo {
+    some_str: String,
+    some_u8: u8,
+    some_u16: u16,
+    some_u32: u32,
+    some_u64: u64,
+    some_i8: i8,
+    some_i16: i16,
+    some_i32: i32,
+    some_i64: i64,
+    some_bool: bool,
+}
+
+fn serialize(foo: &Foo) -> Vec<u8> {
+    let bincode_bytes = bincode::serialize(&foo).unwrap();
+
+    let mut serde_bytes = Vec::new();
+    serde_bench::serialize(&mut serde_bytes, &foo).unwrap();
+
+    assert_eq!(bincode_bytes, serde_bytes);
+
+    serde_bytes
+}
+
+fn deserialize(bytes: &Vec<u8>) -> Foo {
+    let bincode_foo = bincode::deserialize::<Foo>(&bytes).unwrap();
+
+    let serde_foo = serde_bench::deserialize::<Foo>(&bytes).unwrap();
+
+    assert_eq!(serde_foo, bincode_foo);
+
+    serde_foo
+}
+
+fn extract(data: &[u8], cursor: &mut usize, len: usize) -> Vec<u8> {
+    let mut v: Vec<u8> = Vec::with_capacity(len);
+    let (left, right) = if len + *cursor < data.len() {
+        (len, 0)
+    } else {
+        (data.len() - *cursor, len - (data.len() - *cursor))
+    };
+    v.extend(&data[*cursor..(*cursor + left)]);
+    *cursor += left;
+    v.extend(std::iter::repeat(0u8).take(right));
+
+    assert_eq!(v.len(), len);
+
+    v
+}
+
+fn extract_u8(data: &[u8], cursor: &mut usize) -> u8 {
+    extract(&data, cursor, 1).pop().unwrap()
+}
+
+fn extract_u16(data: &[u8], cursor: &mut usize) -> u16 {
+    let v = extract(&data, cursor, 2);
+    u16::from_ne_bytes([v[0], v[1]])
+}
+
+fn extract_u32(data: &[u8], cursor: &mut usize) -> u32 {
+    let v = extract(&data, cursor, 4);
+    u32::from_ne_bytes([v[0], v[1], v[2], v[3]])
+}
+
+fn extract_u64(data: &[u8], cursor: &mut usize) -> u64 {
+    let v = extract(&data, cursor, 8);
+    u64::from_ne_bytes([v[0], v[1], v[2], v[3], v[4], v[5], v[6], v[7]])
+}
+
+fn extract_i8(data: &[u8], cursor: &mut usize) -> i8 {
+    extract(&data, cursor, 1).pop().unwrap() as i8
+}
+
+fn extract_i16(data: &[u8], cursor: &mut usize) -> i16 {
+    let v = extract(&data, cursor, 2);
+    i16::from_ne_bytes([v[0], v[1]])
+}
+
+fn extract_i32(data: &[u8], cursor: &mut usize) -> i32 {
+    let v = extract(&data, cursor, 4);
+    i32::from_ne_bytes([v[0], v[1], v[2], v[3]])
+}
+
+fn extract_i64(data: &[u8], cursor: &mut usize) -> i64 {
+    let v = extract(&data, cursor, 8);
+    i64::from_ne_bytes([v[0], v[1], v[2], v[3], v[4], v[5], v[6], v[7]])
+}
+
+fn extract_bool(data: &[u8], cursor: &mut usize) -> bool {
+    extract(&data, cursor, 1).pop().unwrap() != 0
+}
+
+fn extract_remainder_as_string(data: &[u8], cursor: &mut usize) -> String {
+    let (_, right) = data.split_at(*cursor);
+    String::from_utf8_lossy(right).into()
+}
+
+fuzz_target!(|data: &[u8]| {
+    if data.len() == 0 {
+        return;
+    }
+    let mut cursor: usize = 0;
+
+    let foo = Foo {
+        some_u8: extract_u8(&data, &mut cursor),
+        some_u16: extract_u16(&data, &mut cursor),
+        some_u32: extract_u32(&data, &mut cursor),
+        some_u64: extract_u64(&data, &mut cursor),
+        some_i8: extract_i8(&data, &mut cursor),
+        some_i16: extract_i16(&data, &mut cursor),
+        some_i32: extract_i32(&data, &mut cursor),
+        some_i64: extract_i64(&data, &mut cursor),
+        some_bool: extract_bool(&data, &mut cursor),
+        some_str: extract_remainder_as_string(&data, &mut cursor),
+    };
+
+    let bytes = serialize(&foo);
+    let foo_serde = deserialize(&bytes);
+    assert_eq!(foo, foo_serde);
+});