blob: 90d1d5636b7b4c51033ecb91fcf9f22e6d512120 [file] [log] [blame]
// Copyright 2016 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include <string>
#include "base/base_export.h"
#include "base/macros.h"
#include "base/strings/string_piece.h"
#include "starboard/types.h"
namespace base {
// Utility class to break up fuzzer input for multiple consumers. Whenever run
// on the same input, provides the same output, as long as its methods are
// called in the same order, with the same arguments.
class FuzzedDataProvider {
// |data| is an array of length |size| that the FuzzedDataProvider wraps to
// provide more granular access. |data| must outlive the FuzzedDataProvider.
FuzzedDataProvider(const uint8_t* data, size_t size);
// Returns a std::string containing |num_bytes| of input data. If fewer than
// |num_bytes| of data remain, returns a shorter std::string containing all
// of the data that's left.
std::string ConsumeBytes(size_t num_bytes);
// Returns a std::string containing all remaining bytes of the input data.
std::string ConsumeRemainingBytes();
// Returns a std::string of length from 0 to |max_length|. When it runs out of
// input data, returns what remains of the input. Designed to be more stable
// with respect to a fuzzer inserting characters than just picking a random
// length and then consuming that many bytes with ConsumeBytes().
std::string ConsumeRandomLengthString(size_t max_length);
// Returns a number in the range [min, max] by consuming bytes from the input
// data. The value might not be uniformly distributed in the given range. If
// there's no input data left, always returns |min|. |min| must be less than
// or equal to |max|.
uint32_t ConsumeUint32InRange(uint32_t min, uint32_t max);
int ConsumeInt32InRange(int min, int max);
// Returns a bool, or false when no data remains.
bool ConsumeBool();
// Returns a uint8_t from the input or 0 if nothing remains. This is
// equivalent to ConsumeUint32InRange(0, 0xFF).
uint8_t ConsumeUint8();
// Returns a uint16_t from the input. If fewer than 2 bytes of data remain
// will fill the most significant bytes with 0. This is equivalent to
// ConsumeUint32InRange(0, 0xFFFF).
uint16_t ConsumeUint16();
// Returns a value from |array|, consuming as many bytes as needed to do so.
// |array| must be a fixed-size array. Equivalent to
// array[ConsumeUint32InRange(sizeof(array)-1)];
template <typename Type, size_t size>
Type PickValueInArray(Type (&array)[size]) {
return array[ConsumeUint32InRange(0, size - 1)];
// Reports the remaining bytes available for fuzzed input.
size_t remaining_bytes() { return remaining_data_.length(); }
StringPiece remaining_data_;
} // namespace base