Move fuzz-emul.c function prototypes into a header. Also share the
definition of the input size (rather than hard-coding it in
fuzz-emul.c).
Signed-off-by: George Dunlap
---
RFC: Worth trying to BUILD_BUG_ON(INPUT_SIZE < DATA_SIZE_FULL)?
v4:
- Move earlier in the queue.
- Rebase over previous patch (getting rid of fuzz_corpus struct)
- Add build-time assert
v3:
- New in this version
CC: Ian Jackson
CC: Wei Liu
CC: Andrew Cooper
CC: Jan Beulich
---
tools/fuzz/x86_instruction_emulator/afl-harness.c | 6 +-
tools/fuzz/x86_instruction_emulator/fuzz-emul.c | 7 +--
tools/fuzz/x86_instruction_emulator/fuzz-emul.h | 10 ++
3 files changed, 16 insertions(+), 7 deletions(-)
create mode 100644 tools/fuzz/x86_instruction_emulator/fuzz-emul.h
diff --git a/tools/fuzz/x86_instruction_emulator/afl-harness.c
b/tools/fuzz/x86_instruction_emulator/afl-harness.c
index e0c56aadf7..d514468dd2 100644
--- a/tools/fuzz/x86_instruction_emulator/afl-harness.c
+++ b/tools/fuzz/x86_instruction_emulator/afl-harness.c
@@ -4,12 +4,8 @@
#include
#include
#include
+#include "fuzz-emul.h"
-extern int LLVMFuzzerInitialize(int *argc, char ***argv);
-extern int LLVMFuzzerTestOneInput(const uint8_t *data_p, size_t size);
-extern unsigned int fuzz_minimal_input_size(void);
-
-#define INPUT_SIZE 4096
static uint8_t input[INPUT_SIZE];
int main(int argc, char **argv)
diff --git a/tools/fuzz/x86_instruction_emulator/fuzz-emul.c
b/tools/fuzz/x86_instruction_emulator/fuzz-emul.c
index 8998f21fe1..964682aa1a 100644
--- a/tools/fuzz/x86_instruction_emulator/fuzz-emul.c
+++ b/tools/fuzz/x86_instruction_emulator/fuzz-emul.c
@@ -16,6 +16,7 @@
#include
#include "x86-emulate.h"
+#include "fuzz-emul.h"
#define MSR_INDEX_MAX 16
@@ -29,7 +30,7 @@ struct fuzz_corpus
struct cpu_user_regs regs;
struct segment_register segments[SEG_NUM];
unsigned long options;
-unsigned char data[4096];
+unsigned char data[INPUT_SIZE];
} input;
#define DATA_OFFSET offsetof(struct fuzz_corpus, data)
@@ -827,7 +828,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data_p, size_t
size)
return 1;
}
-if ( size > sizeof(input) )
+if ( size > INPUT_SIZE )
{
printf("Input too large\n");
return 1;
@@ -858,6 +859,8 @@ int LLVMFuzzerTestOneInput(const uint8_t *data_p, size_t
size)
unsigned int fuzz_minimal_input_size(void)
{
+BUILD_BUG_ON(DATA_OFFSET > INPUT_SIZE);
+
return DATA_OFFSET + 1;
}
diff --git a/tools/fuzz/x86_instruction_emulator/fuzz-emul.h
b/tools/fuzz/x86_instruction_emulator/fuzz-emul.h
new file mode 100644
index 00..30dd8de21e
--- /dev/null
+++ b/tools/fuzz/x86_instruction_emulator/fuzz-emul.h
@@ -0,0 +1,10 @@
+#ifndef FUZZ_EMUL_H
+# define FUZZ_EMUL_H
+
+extern int LLVMFuzzerInitialize(int *argc, char ***argv);
+extern int LLVMFuzzerTestOneInput(const uint8_t *data_p, size_t size);
+extern unsigned int fuzz_minimal_input_size(void);
+
+#define INPUT_SIZE 4096
+
+#endif /* ifdef FUZZ_EMUL_H */
--
2.14.2
___
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel