From 1399abc58371978814e62b5eadc281ccbeb8dc96 Mon Sep 17 00:00:00 2001
From: Niels Lohmann <niels.lohmann@gmail.com>
Date: Sun, 25 Dec 2016 16:18:56 +0100
Subject: [PATCH] :construction: added MessagePack fuzz target

---
 Makefile                          |  8 ++++
 test/Makefile                     |  3 ++
 test/src/fuzzer-parse_msgpack.cpp | 68 +++++++++++++++++++++++++++++++
 3 files changed, 79 insertions(+)
 create mode 100644 test/src/fuzzer-parse_msgpack.cpp

diff --git a/Makefile b/Makefile
index 76e601709..8f1969506 100644
--- a/Makefile
+++ b/Makefile
@@ -62,6 +62,14 @@ fuzz_testing_cbor:
 	find test/data -size -5k -name *.cbor | xargs -I{} cp "{}" fuzz-testing/testcases
 	@echo "Execute: afl-fuzz -i fuzz-testing/testcases -o fuzz-testing/out fuzz-testing/fuzzer"
 
+fuzz_testing_msgpack:
+	rm -fr fuzz-testing
+	mkdir -p fuzz-testing fuzz-testing/testcases fuzz-testing/out
+	$(MAKE) parse_msgpack_fuzzer -C test CXX=afl-clang++
+	mv test/parse_msgpack_fuzzer fuzz-testing/fuzzer
+	find test/data -size -5k -name *.msgpack | xargs -I{} cp "{}" fuzz-testing/testcases
+	@echo "Execute: afl-fuzz -i fuzz-testing/testcases -o fuzz-testing/out fuzz-testing/fuzzer"
+
 
 ##########################################################################
 # static analyzer
diff --git a/test/Makefile b/test/Makefile
index a063221a7..556ab0d7c 100644
--- a/test/Makefile
+++ b/test/Makefile
@@ -89,3 +89,6 @@ parse_afl_fuzzer:
 
 parse_cbor_fuzzer:
 	$(CXX) $(CXXFLAGS) $(CPPFLAGS) src/fuzzer-driver_afl.cpp src/fuzzer-parse_cbor.cpp -o $@
+
+parse_msgpack_fuzzer:
+	$(CXX) $(CXXFLAGS) $(CPPFLAGS) src/fuzzer-driver_afl.cpp src/fuzzer-parse_msgpack.cpp -o $@
diff --git a/test/src/fuzzer-parse_msgpack.cpp b/test/src/fuzzer-parse_msgpack.cpp
new file mode 100644
index 000000000..992697c26
--- /dev/null
+++ b/test/src/fuzzer-parse_msgpack.cpp
@@ -0,0 +1,68 @@
+/*
+    __ _____ _____ _____
+ __|  |   __|     |   | |  JSON for Modern C++ (fuzz test support)
+|  |  |__   |  |  | | | |  version 2.0.9
+|_____|_____|_____|_|___|  https://github.com/nlohmann/json
+
+This file implements a parser test suitable for fuzz testing. Given a byte
+array data, it performs the following steps:
+
+- j1 = from_msgpack(data)
+- vec = to_msgpack(j1)
+- j2 = from_msgpack(vec)
+- assert(j1 == j2)
+
+The provided function `LLVMFuzzerTestOneInput` can be used in different fuzzer
+drivers.
+
+Licensed under the MIT License <http://opensource.org/licenses/MIT>.
+*/
+
+#include <iostream>
+#include <sstream>
+#include <json.hpp>
+
+using json = nlohmann::json;
+
+// see http://llvm.org/docs/LibFuzzer.html
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    try
+    {
+        // step 1: parse input
+        std::vector<uint8_t> vec1(data, data + size);
+        json j1 = json::from_msgpack(vec1);
+
+        try
+        {
+            // step 2: round trip
+            std::vector<uint8_t> vec2 = json::to_msgpack(j1);
+
+            // parse serialization
+            json j2 = json::from_msgpack(vec2);
+
+            // deserializations must match
+            assert(j1 == j2);
+        }
+        catch (const std::invalid_argument&)
+        {
+            // parsing a MessagePack serialization must not fail
+            assert(false);
+        }
+    }
+    catch (const std::invalid_argument&)
+    {
+        // parse errors are ok, because input may be random bytes
+    }
+    catch (const std::out_of_range&)
+    {
+        // parse errors are ok, because input may be random bytes
+    }
+    catch (const std::domain_error&)
+    {
+        // parse errors are ok, because input may be random bytes
+    }
+
+    // return 0 - non-zero return values are reserved for future use
+    return 0;
+}