1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
|
#!/usr/bin/env python3
"""Deterministic malformed-source differential fuzzing for compiler hosts.
Usage: python3 tests/drivers/fuzz_malformed.py [native] [microcore]
"""
import random
import subprocess
import sys
bins = sys.argv[1:] or ["bin/zy", "bin/zym"]
if len(bins) == 1:
bins.append(bins[0])
rng = random.Random(0xC0DE)
tokens = [
b"fn", b"let", b"int", b"char*", b"word", b"return", b"if", b"else",
b"while", b"for", b"include", b"std", b";", b"{", b"}", b"(", b")",
b"[", b"]", b"=", b",", b".", b":", b"?", b"+", b"-", b"*", b"&",
b"|", b"!", b"~", b'"text"', b"'x'", b"0", b"1", b"_", b"NIF",
b"asm", b"unchecked", b"\x00", b"\xff", "λ".encode(),
]
cases = []
for i in range(256):
words = [rng.choice(tokens) for _ in range(rng.randrange(1, 100))]
cases.append(b" ".join(words) + b"\n")
# Mutate a small valid program around parser and analyzer boundaries. Keeping
# each mutation bounded makes a failing seed easy to reproduce and minimize.
base = b"include std;\nfn main() { let x = 1; return x; }\n"
for _ in range(64):
data = bytearray(base)
for __ in range(rng.randrange(1, 5)):
at = rng.randrange(len(data))
if rng.randrange(2):
data[at:at + 1] = rng.choice(tokens)
else:
del data[at:at + 1]
cases.append(bytes(data))
def run(binary, source):
return subprocess.run(
[binary], input=b"typecheck on;\n" + source, capture_output=True, timeout=3
)
for i, source in enumerate(cases):
results = []
for binary in bins:
try:
result = run(binary, source)
except subprocess.TimeoutExpired:
raise SystemExit(f"{binary} timed out on malformed seed 0xC0DE case {i}: {source!r}")
if result.returncode < 0:
raise SystemExit(
f"{binary} crashed on malformed seed 0xC0DE case {i}: "
f"signal {-result.returncode}, source={source!r}, stderr={result.stderr!r}"
)
results.append((result.returncode, result.stdout, result.stderr))
if any(result != results[0] for result in results[1:]):
raise SystemExit(f"compiler hosts disagreed on malformed seed 0xC0DE case {i}: {source!r}")
print(f"ok malformed-source fuzz: {len(cases)} bounded token and byte mutations agree on {len(bins)} compiler hosts")
|
