protobuf

2954 Commits

204 Branches

369 Tags

184 MiB

Tag: Branch: Tree: 7bde72661c

Commit Graph

Author	SHA1	Message	Date
Joshua Haberman	6e1cbdfe09	Added fuzzer for descriptor parsing/serialization, and fixed several bugs. The initial motivation for this change was to fix a bug found by fuzzing. The old fuzz test (built on `cc_fuzz_target()`) detected an infinite loop if a bytes field default has an unterminated `\x` escape. To fix this bug while expanding fuzz coverage, I created a fuzz test that verifies that we can do a lossless round trip from descriptor -> DefPool -> descriptor. We use C++ as the source of truth for whether a descriptor is valid or not, and what the canonical serialization back to protobuf form should be. I wrote the new fuzz test using go/FuzzTest, which makes it easier and more readable to use an arbitrary `FileDescriptorSet` as input, while adding test cases for regressions. The fuzz test highlighted a handful of errors that I subsequently fixed and added regression tests for: 1. The aforementioned unterminated `\x` bug. 2. We were not propagating the `edition` field. 3. We were missing the CheckIdent() check in a few places. 4. We were rejecting files with empty name, whereas C++ allows this. 5. There were a few bugs with escaping string defaults. Since FuzzTest is Clang-only, I split the `FUZZ_TEST()` invocation from the regression tests, since the latter are portable and should be run on all platforms. Only `FUZZ_TEST()` itself is in a google3/Clang-only file. PiperOrigin-RevId: 506997362	2 years ago

Author

SHA1

Message

Date

Joshua Haberman

6e1cbdfe09

Added fuzzer for descriptor parsing/serialization, and fixed several bugs.

The initial motivation for this change was to fix a bug found by fuzzing.  The old fuzz test (built on `cc_fuzz_target()`) detected an infinite loop if a bytes field default has an unterminated `\x` escape.

To fix this bug while expanding fuzz coverage, I created a fuzz test that verifies that we can do a lossless round trip from descriptor -> DefPool -> descriptor.  We use C++ as the source of truth for whether a descriptor is valid or not, and what the canonical serialization back to protobuf form should be.

I wrote the new fuzz test using go/FuzzTest, which makes it easier and more readable to use an arbitrary `FileDescriptorSet` as input, while adding test cases for regressions.

The fuzz test highlighted a handful of errors that I subsequently fixed and added regression tests for:

1. The aforementioned unterminated `\x` bug.
2. We were not propagating the `edition` field.
3. We were missing the CheckIdent() check in a few places.
4. We were rejecting files with empty name, whereas C++ allows this.
5. There were a few bugs with escaping string defaults.

Since FuzzTest is Clang-only, I split the `FUZZ_TEST()` invocation from the regression tests, since the latter are portable and should be run on all platforms.  Only `FUZZ_TEST()` itself is in a google3/Clang-only file.

PiperOrigin-RevId: 506997362

2 years ago

1 Commits (7bde72661cb0cf950d2d7dc48f2bf95eab969e77)