Skip to content

Commit aa73d17

Browse files
authored
add fixes to buffer fuzz test (envoyproxy#14999)
Add test-only fixes to buffer fuzz test with false positives from StringBuffer limits. Signed-off-by: Asra Ali <[email protected]>
1 parent e0b2b29 commit aa73d17

4 files changed

+30
-5
lines changed

test/common/buffer/buffer_corpus/clusterfuzz-testcase-minimized-4923810761539584

+14
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

test/common/buffer/buffer_corpus/clusterfuzz-testcase-minimized-6365038174666752

+1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

test/common/buffer/buffer_corpus/clusterfuzz-testcase-minimized-6672326676578304

+7
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

test/common/buffer/buffer_fuzz.cc

+8-5
Original file line numberDiff line numberDiff line change
@@ -457,23 +457,26 @@ void executeActions(const test::common::buffer::BufferFuzzTestCase& input, Buffe
457457
// return the pointer to its std::string array, we can avoid the
458458
// toString() copy here.
459459
const uint64_t linear_buffer_length = linear_buffers[j]->length();
460-
if (buffers[j]->toString() !=
461-
absl::string_view(
460+
// We may have spilled over TotalMaxAllocation at this point. Only compare up to
461+
// TotalMaxAllocation.
462+
if (absl::string_view(
462463
static_cast<const char*>(linear_buffers[j]->linearize(linear_buffer_length)),
463-
linear_buffer_length)) {
464+
linear_buffer_length)
465+
.compare(buffers[j]->toString().substr(0, TotalMaxAllocation)) != 0) {
464466
ENVOY_LOG_MISC(debug, "Mismatched buffers at index {}", j);
465467
ENVOY_LOG_MISC(debug, "B: {}", buffers[j]->toString());
466468
ENVOY_LOG_MISC(debug, "L: {}", linear_buffers[j]->toString());
467469
FUZZ_ASSERT(false);
468470
}
469-
FUZZ_ASSERT(buffers[j]->length() == linear_buffer_length);
471+
FUZZ_ASSERT(std::min(TotalMaxAllocation, static_cast<uint32_t>(buffers[j]->length())) ==
472+
linear_buffer_length);
470473
current_allocated_bytes += linear_buffer_length;
471474
}
472475
ENVOY_LOG_MISC(debug, "[{} MB allocated total]", current_allocated_bytes / (1024.0 * 1024));
473476
// We bail out if buffers get too big, otherwise we will OOM the sanitizer.
474477
// We can't use Memory::Stats::totalCurrentlyAllocated() here as we don't
475478
// have tcmalloc in ASAN builds, so just do a simple count.
476-
if (current_allocated_bytes > TotalMaxAllocation) {
479+
if (current_allocated_bytes >= TotalMaxAllocation) {
477480
ENVOY_LOG_MISC(debug, "Terminating early with total buffer length {} to avoid OOM",
478481
current_allocated_bytes);
479482
break;

0 commit comments

Comments
 (0)