test: Add some support functions to make writing fuzzers easier.

testing/fuzzing/BUILD.bazel

@@ -8,6 +8,13 @@ cc_library(
     visibility = ["//c-toxcore:__subpackages__"],
 )
 
+cc_library(
+    name = "fuzz_support",
+    srcs = ["fuzz_support.cc"],
+    hdrs = ["fuzz_support.h"],
+    visibility = ["//c-toxcore:__subpackages__"],
+)
+
 cc_fuzz_test(
     name = "bootstrap_fuzzer",
     srcs = ["bootstrap_harness.cc"],

testing/fuzzing/fuzz_support.cc

@@ -0,0 +1 @@
+#include "fuzz_support.h"

testing/fuzzing/fuzz_support.h

@@ -0,0 +1,66 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright © 2021 The TokTok team.
+ */
+
+#ifndef C_TOXCORE_TESTING_FUZZING_FUZZ_SUPPORT_H
+#define C_TOXCORE_TESTING_FUZZING_FUZZ_SUPPORT_H
+
+#include <cstdint>
+#include <cstdlib>
+
+struct Fuzz_Data {
+    const uint8_t *data;
+    std::size_t size;
+
+    uint8_t consume1() {
+        const uint8_t val = data[0];
+        ++data;
+        --size;
+        return val;
+    }
+
+    const uint8_t *consume(std::size_t count) {
+        const uint8_t *val = data;
+        data += count;
+        size -= count;
+        return val;
+    }
+};
+
+#define CONSUME1(DECL, INPUT) \
+    if (INPUT.size < 1) {     \
+        return;               \
+    }                         \
+    DECL = INPUT.consume1()
+
+#define CONSUME(DECL, INPUT, SIZE) \
+    if (INPUT.size < SIZE) {       \
+        return;                    \
+    }                              \
+    DECL = INPUT.consume(SIZE)
+
+inline void fuzz_select_target(uint8_t selector, Fuzz_Data input)
+{
+    // The selector selected no function, so we do nothing and rely on the
+    // fuzzer to come up with a better selector.
+}
+
+template<typename Arg, typename ...Args>
+void fuzz_select_target(uint8_t selector, Fuzz_Data input, Arg fn, Args ...args)
+{
+    if (selector == sizeof...(Args)) {
+        return fn(input);
+    }
+    return fuzz_select_target(selector - 1, input, args...);
+}
+
+template<typename ...Args>
+void fuzz_select_target(const uint8_t *data, std::size_t size, Args ...args)
+{
+    Fuzz_Data input{data, size};
+
+    CONSUME1(uint8_t selector, input);
+    return fuzz_select_target(selector, input, args...);
+}
+
+#endif // C_TOXCORE_TESTING_FUZZING_FUZZ_SUPPORT_H

toxcore/BUILD.bazel

@@ -299,7 +299,10 @@ cc_fuzz_test(
     name = "DHT_fuzz_test",
     srcs = ["DHT_fuzz_test.cc"],
     corpus = ["//tools/toktok-fuzzer/corpus:DHT_fuzz_test"],
-    deps = [":DHT"],
+    deps = [
+        ":DHT",
+        "//c-toxcore/testing/fuzzing:fuzz_support",
+    ],
 )
 
 cc_library(

toxcore/DHT_fuzz_test.cc

@@ -3,43 +3,31 @@
 #include <cstdlib>
 #include <vector>
 
+#include "../testing/fuzzing/fuzz_support.h"
+
 namespace {
 
-void TestHandleRequest(const uint8_t *input_data, size_t input_size)
+void TestHandleRequest(Fuzz_Data input)
 {
-    const uint8_t *data = input_data;
-    size_t size = input_size;
-
-    const uint8_t *self_public_key = data;
-    data += CRYPTO_PUBLIC_KEY_SIZE;
-    size -= CRYPTO_PUBLIC_KEY_SIZE;
-
-    const uint8_t *self_secret_key = data;
-    data += CRYPTO_SECRET_KEY_SIZE;
-    size -= CRYPTO_SECRET_KEY_SIZE;
+    CONSUME(const uint8_t *self_public_key, input, CRYPTO_PUBLIC_KEY_SIZE);
+    CONSUME(const uint8_t *self_secret_key, input, CRYPTO_SECRET_KEY_SIZE);
 
     uint8_t public_key[CRYPTO_PUBLIC_KEY_SIZE];
     uint8_t request[MAX_CRYPTO_REQUEST_SIZE];
     uint8_t request_id;
-    handle_request(self_public_key, self_secret_key, public_key, request, &request_id, data, size);
+    handle_request(
+        self_public_key, self_secret_key, public_key, request, &request_id, input.data, input.size);
 }
 
-void TestUnpackNodes(const uint8_t *input_data, size_t input_size)
+void TestUnpackNodes(Fuzz_Data input)
 {
-    const uint8_t *data = input_data;
-    size_t size = input_size;
-
-    if (size < 1) {
-        return;
-    }
-
-    const bool tcp_enabled = data[0];
-    ++data;
-    --size;
+    CONSUME1(const bool tcp_enabled, input);
 
-    Node_format nodes[5];
+    const uint16_t node_count = 5;
+    Node_format nodes[node_count];
     uint16_t processed_data_len;
-    const int packed_count = unpack_nodes(nodes, 5, &processed_data_len, data, size, tcp_enabled);
+    const int packed_count
+        = unpack_nodes(nodes, node_count, &processed_data_len, input.data, input.size, tcp_enabled);
     if (packed_count > 0) {
         Logger *logger = logger_new();
         std::vector<uint8_t> packed(packed_count * PACKED_NODE_SIZE_IP6);
@@ -53,28 +41,9 @@ void TestUnpackNodes(const uint8_t *input_data, size_t input_size)
 
 }  // namespace
 
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t *input_data, size_t input_size);
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t *input_data, size_t input_size)
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 {
-    const uint8_t *data = input_data;
-    size_t size = input_size;
-
-    if (size < 1) {
-        return 0;
-    }
-
-    const uint8_t func = data[0];
-    ++data;
-    --size;
-
-    switch (func) {
-    case 0:
-        TestHandleRequest(data, size);
-        return 0;
-    case 1:
-        TestUnpackNodes(data, size);
-        return 0;
-    default:
-        return 0;
-    }
+    fuzz_select_target(data, size, TestHandleRequest, TestUnpackNodes);
+    return 0;
 }