mirror of
https://github.com/nlohmann/json.git
synced 2026-10-06 16:01:29 +07:00
Niels Lohmann
36c079149a
The fuzzer drivers check their round trips with assert(), which NDEBUG compiles away. The OSS-Fuzz build keeps assertions on today, but nothing pins that: a build change that adds NDEBUG would silently turn every round-trip check into a mere "does not crash" check. Each driver now stops the build with an #error instead, and includes <cassert> itself rather than relying on json.hpp. Signed-off-by: Niels Lohmann <mail@nlohmann.me>
122 lines
4.8 KiB
C++
122 lines
4.8 KiB
C++
// __ _____ _____ _____
|
|
// __| | __| | | | JSON for Modern C++ (supporting code)
|
|
// | | |__ | | | | | | version 3.12.0
|
|
// |_____|_____|_____|_|___| https://github.com/nlohmann/json
|
|
//
|
|
// SPDX-FileCopyrightText: 2013-2026 Niels Lohmann <https://nlohmann.me>
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
/*
|
|
This file implements a parser test suitable for fuzz testing. Given a byte
|
|
array data, it performs the following steps:
|
|
|
|
- j1 = from_bjdata(data)
|
|
- vec = to_bjdata(j1)
|
|
- j2 = from_bjdata(vec)
|
|
- assert(j1 == j2)
|
|
- vec2 = to_bjdata(j1, use_size = true, use_type = false)
|
|
- j3 = from_bjdata(vec2)
|
|
- assert(j1 == j3)
|
|
- vec3 = to_bjdata(j1, use_size = true, use_type = true)
|
|
- j4 = from_bjdata(vec3)
|
|
- assert(j1 == j4)
|
|
|
|
Re-serializing j2/j3/j4 with the same use_size/use_type settings is checked
|
|
for value-stability rather than byte-exact stability: from_bjdata(to_bjdata(j2))
|
|
must equal j2 (and likewise for j3, j4). Byte-exact stability does not hold in
|
|
general, because a BJData value can lose type fidelity across a round trip
|
|
(e.g. a binary_t value serialized without the optimized "$U#" array header is
|
|
parsed back as a plain array of numbers, see #5398 and the discussion on
|
|
PR #5494) - the numeric value is preserved, but the writer's smallest-type
|
|
selection for the now-plain numbers may legitimately pick a different, but
|
|
equally valid, single-byte type marker than the dedicated binary-data writer
|
|
would have. Both encodings are valid BJData and both decode to the same
|
|
value, so this is not treated as a round-trip failure here.
|
|
|
|
"Value-stable" is checked by comparing dump()s rather than with operator==
|
|
directly: a BJData/UBJSON payload can decode to a non-finite double (NaN or
|
|
+-Infinity), and IEEE 754 NaN is never equal to itself, so operator== would
|
|
report two structurally-identical trees as different whenever a NaN is
|
|
involved -- not a round-trip bug, just NaN's ordinary (non-)reflexivity.
|
|
dump() serializes any non-finite double the same deterministic way (as JSON
|
|
`null`, since JSON itself cannot represent NaN/Infinity), so comparing
|
|
dumps is stable under exactly the same values that break operator==.
|
|
|
|
The provided function `LLVMFuzzerTestOneInput` can be used in different fuzzer
|
|
drivers.
|
|
*/
|
|
|
|
#include <cassert>
|
|
#include <iostream>
|
|
#include <sstream>
|
|
#include <nlohmann/json.hpp>
|
|
|
|
// the round-trip checks below are assertions; NDEBUG would compile them away
|
|
#ifdef NDEBUG
|
|
#error "the fuzzer drivers must be built without NDEBUG"
|
|
#endif
|
|
|
|
using json = nlohmann::json;
|
|
|
|
// value-stable comparison for the round-trip checks below; see the note
|
|
// above on why this compares dump()s rather than the json values directly
|
|
static bool is_value_stable(const json& lhs, const json& rhs)
|
|
{
|
|
return lhs.dump() == rhs.dump();
|
|
}
|
|
|
|
// see http://llvm.org/docs/LibFuzzer.html
|
|
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
|
|
{
|
|
try
|
|
{
|
|
// step 1: parse input
|
|
std::vector<uint8_t> const vec1(data, data + size);
|
|
json const j1 = json::from_bjdata(vec1);
|
|
|
|
try
|
|
{
|
|
// step 2.1: round trip without adding size annotations to container types
|
|
std::vector<uint8_t> const vec2 = json::to_bjdata(j1, false, false);
|
|
|
|
// step 2.2: round trip with adding size annotations but without adding type annotations to container types
|
|
std::vector<uint8_t> const vec3 = json::to_bjdata(j1, true, false);
|
|
|
|
// step 2.3: round trip with adding size as well as type annotations to container types
|
|
std::vector<uint8_t> const vec4 = json::to_bjdata(j1, true, true);
|
|
|
|
// parse serialization
|
|
json const j2 = json::from_bjdata(vec2);
|
|
json const j3 = json::from_bjdata(vec3);
|
|
json const j4 = json::from_bjdata(vec4);
|
|
|
|
// re-serializing must be value-stable (see the notes above on
|
|
// why byte-exact stability is not guaranteed in general, and
|
|
// why this compares dump()s rather than the values directly)
|
|
assert(is_value_stable(json::from_bjdata(json::to_bjdata(j2, false, false)), j2));
|
|
assert(is_value_stable(json::from_bjdata(json::to_bjdata(j3, true, false)), j3));
|
|
assert(is_value_stable(json::from_bjdata(json::to_bjdata(j4, true, true)), j4));
|
|
}
|
|
catch (const json::parse_error&)
|
|
{
|
|
// parsing a BJData serialization must not fail
|
|
assert(false);
|
|
}
|
|
}
|
|
catch (const json::parse_error&)
|
|
{
|
|
// parse errors are ok, because input may be random bytes
|
|
}
|
|
catch (const json::type_error&)
|
|
{
|
|
// type errors can occur during parsing, too
|
|
}
|
|
catch (const json::out_of_range&)
|
|
{
|
|
// out of range errors may happen if provided sizes are excessive
|
|
}
|
|
|
|
// return 0 - non-zero return values are reserved for future use
|
|
return 0;
|
|
}
|