[fuzzer] Don't crash if LLVMFuzzerMutate was called by CustomCrossOver

Reviewers: kcc

Subscribers: llvm-commits, mgorny

Differential Revision: https://reviews.llvm.org/D30682

llvm-svn: 297202

1 files changed, 33 insertions, 0 deletions

diff --git a/llvm/lib/Fuzzer/test/CustomCrossOverAndMutateTest.cpp b/llvm/lib/Fuzzer/test/CustomCrossOverAndMutateTest.cpp
new file mode 100644
index 00000000000..8aa8fdd050e
--- /dev/null
+++ b/llvm/lib/Fuzzer/test/CustomCrossOverAndMutateTest.cpp
@@ -0,0 +1,33 @@
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+
+// Test that libFuzzer does not crash when LLVMFuzzerMutate called from
+// LLVMFuzzerCustomCrossOver.
+#include <cstddef>
+#include <cstdint>
+#include <cstdlib>
+#include <string>
+#include <string.h>
+#include <vector>
+
+#include "FuzzerInterface.h"
+
+static volatile int sink;
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+  std::string Str(reinterpret_cast<const char *>(Data), Size);
+  if (Size && Data[0] == '0')
+    sink++;
+  return 0;
+}
+
+extern "C" size_t LLVMFuzzerCustomCrossOver(const uint8_t *Data1, size_t Size1,
+                                            const uint8_t *Data2, size_t Size2,
+                                            uint8_t *Out, size_t MaxOutSize,
+                                            unsigned int Seed) {
+  std::vector<uint8_t> Buffer(MaxOutSize * 10);
+  LLVMFuzzerMutate(Buffer.data(), Buffer.size(), Buffer.size());
+  size_t Size = std::min<size_t>(Size1, MaxOutSize);
+  memcpy(Out, Data1, Size);
+  return Size;
+}