Skip to content

Commit

Permalink
Implement fuzzing for the GLSL parser (gfx-rs#1301)
Browse files Browse the repository at this point in the history
* Implement fuzzing for the GLSL parser

* Remove arbitrary dependency from naga

Derive `Arbitrary` for proxy objects in `fuzz/fuzz_targets/glsl_parser.rs`
instead.
  • Loading branch information
Hans Christian Schmitz authored Aug 31, 2021
1 parent bd411c2 commit 2069ea6
Show file tree
Hide file tree
Showing 2 changed files with 54 additions and 1 deletion.
9 changes: 8 additions & 1 deletion fuzz/Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -9,11 +9,12 @@ edition = "2018"
cargo-fuzz = true

[dependencies]
arbitrary = { version = "1.0.2", features = ["derive"] }
libfuzzer-sys = "0.4"

[dependencies.naga]
path = ".."
features = ["spv-in", "wgsl-in"]
features = ["spv-in", "wgsl-in", "glsl-in"]

# Prevent this from interfering with workspaces
[workspace]
Expand All @@ -30,3 +31,9 @@ name = "wgsl_parser"
path = "fuzz_targets/wgsl_parser.rs"
test = false
doc = false

[[bin]]
name = "glsl_parser"
path = "fuzz_targets/glsl_parser.rs"
test = false
doc = false
46 changes: 46 additions & 0 deletions fuzz/fuzz_targets/glsl_parser.rs
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
#![no_main]
use arbitrary::Arbitrary;
use libfuzzer_sys::fuzz_target;
use naga::{
front::glsl::{Options, Parser},
FastHashMap, ShaderStage,
};

#[derive(Debug, Arbitrary)]
enum ShaderStageProxy {
Vertex,
Fragment,
Compute,
}

impl From<ShaderStageProxy> for ShaderStage {
fn from(proxy: ShaderStageProxy) -> Self {
match proxy {
ShaderStageProxy::Vertex => ShaderStage::Vertex,
ShaderStageProxy::Fragment => ShaderStage::Fragment,
ShaderStageProxy::Compute => ShaderStage::Compute,
}
}
}

#[derive(Debug, Arbitrary)]
struct OptionsProxy {
pub stage: ShaderStageProxy,
pub defines: FastHashMap<String, String>,
}

impl From<OptionsProxy> for Options {
fn from(proxy: OptionsProxy) -> Self {
Options {
stage: proxy.stage.into(),
defines: proxy.defines,
}
}
}

fuzz_target!(|data: (OptionsProxy, String)| {
let (options, source) = data;
// Ensure the parser can handle potentially malformed strings without crashing.
let mut parser = Parser::default();
let _result = parser.parse(&options.into(), &source);
});

0 comments on commit 2069ea6

Please sign in to comment.