1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
|
//! A library to generate __fuzzed__ C headers for use with `quickcheck`
//!
//! ## Example
//!
//! ```rust
//! extern crate quickcheck;
//! extern crate quickchecking;
//! use quickcheck::{Arbitrary, Gen};
//! use quickchecking::fuzzers;
//!
//! fn main() {
//! let generate_range: usize = 10; // Determines things like the length of
//! // arbitrary vectors generated.
//! let header = fuzzers::HeaderC::arbitrary(
//! &mut Gen::new(generate_range));
//! println!("{}", header);
//! }
//! ```
//!
#![deny(missing_docs)]
#[macro_use]
extern crate lazy_static;
extern crate quickcheck;
extern crate tempdir;
use quickcheck::{Gen, QuickCheck, TestResult};
use std::error::Error;
use std::fs::File;
use std::io::Write;
use std::path::PathBuf;
use std::process::{Command, Output};
use std::sync::Mutex;
use tempdir::TempDir;
/// Contains definitions of and impls for types used to fuzz C declarations.
pub mod fuzzers;
// Global singleton, manages context across tests. For now that context is
// only the output_path for inspecting fuzzed headers (if specified).
struct Context {
output_path: Option<String>,
}
// Initialize global context.
lazy_static! {
static ref CONTEXT: Mutex<Context> =
Mutex::new(Context { output_path: None });
}
// Passes fuzzed header to the `csmith-fuzzing/predicate.py` script, returns
// output of the associated command.
fn run_predicate_script(
header: fuzzers::HeaderC,
) -> Result<Output, Box<dyn Error>> {
let dir = TempDir::new("bindgen_prop")?;
let header_path = dir.path().join("prop_test.h");
let mut header_file = File::create(&header_path)?;
header_file.write_all(header.to_string().as_bytes())?;
header_file.sync_all()?;
let header_path_string = header_path
.into_os_string()
.into_string()
.map_err(|_| "error converting path into String")?;
let mut predicate_script_path = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
predicate_script_path.push("../../csmith-fuzzing/predicate.py");
let predicate_script_path_string = predicate_script_path
.into_os_string()
.into_string()
.map_err(|_| "error converting path into String")?;
// Copy generated temp files to output_path directory for inspection.
// If `None`, output path not specified, don't copy.
if let Some(ref path) = CONTEXT.lock().unwrap().output_path {
Command::new("cp")
.arg("-a")
.arg(dir.path().to_str().unwrap())
.arg(path)
.output()?;
}
Ok(Command::new(&predicate_script_path_string)
.arg(&header_path_string)
.output()?)
}
// Generatable property. Pass generated headers off to run through the
// `csmith-fuzzing/predicate.py` script. Success is measured by the success
// status of that command.
fn bindgen_prop(header: fuzzers::HeaderC) -> TestResult {
match run_predicate_script(header) {
Ok(o) => TestResult::from_bool(o.status.success()),
Err(e) => {
println!("{:?}", e);
TestResult::from_bool(false)
}
}
}
/// Instantiate a Quickcheck object and use it to run property tests using
/// fuzzed C headers generated with types defined in the `fuzzers` module.
/// Success/Failure is dictated by the result of passing the fuzzed headers
/// to the `csmith-fuzzing/predicate.py` script.
pub fn test_bindgen(
generate_range: usize,
tests: u64,
output_path: Option<&str>,
) {
if let Some(path) = output_path {
CONTEXT.lock().unwrap().output_path =
Some(String::from(PathBuf::from(path).to_str().unwrap()));
}
QuickCheck::new()
.tests(tests)
.gen(Gen::new(generate_range))
.quickcheck(bindgen_prop as fn(fuzzers::HeaderC) -> TestResult)
}
|
