Skip to content

Commit 06bf4e5

Browse files
fixes for fuzzers, some assumptions about pinning were not held (#1174)
1 parent 6bc94a2 commit 06bf4e5

5 files changed

Lines changed: 45 additions & 5 deletions

File tree

test/Garnet.fuzz/Program.cs

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,19 @@ private static void WriteLine(FuzzOptions opts, string line)
7272
Console.WriteLine(line);
7373
}
7474

75+
/// <summary>
76+
/// Log, if options allow it, a character to standard out.
77+
/// </summary>
78+
private static void Write(FuzzOptions opts, char c)
79+
{
80+
if (opts.Quiet)
81+
{
82+
return;
83+
}
84+
85+
Console.Write(c);
86+
}
87+
7588
/// <summary>
7689
/// Log a message to standard error and exit the process.
7790
/// </summary>
@@ -95,16 +108,26 @@ private static void RunFuzzExample(FuzzOptions opts)
95108

96109
foreach (var input in inputs)
97110
{
98-
var inputCopy = input;
99111
for (var i = 0; i < repeatCount; i++)
100112
{
101-
target(inputCopy);
113+
target(input);
102114
if (i != repeatCount - 1)
103115
{
104-
// Force a new copy to wiggle things around in memory a bit
105-
inputCopy = [.. input];
116+
// Do some random allocations to shift things around for the next invocation
117+
GC.KeepAlive(GC.AllocateUninitializedArray<byte>(Random.Shared.Next(512), pinned: false));
118+
GC.KeepAlive(GC.AllocateUninitializedArray<byte>(Random.Shared.Next(512), pinned: true));
119+
}
120+
121+
if (repeatCount != 1)
122+
{
123+
Write(opts, '#');
106124
}
107125
}
126+
127+
if (repeatCount != 1)
128+
{
129+
WriteLine(opts, "");
130+
}
108131
}
109132

110133
// Obtain a callback to run a fuzz target.

test/Garnet.fuzz/Targets/GarnetEndToEnd.cs

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@
1010
using Embedded.server;
1111
using Garnet.server;
1212
using Garnet.server.Auth.Settings;
13-
1413
using Tsavorite.core;
1514

1615
namespace Garnet.fuzz.Targets
@@ -26,6 +25,8 @@ public sealed class GarnetEndToEnd : IFuzzerTarget
2625
/// <inheritdoc/>
2726
public static void Fuzz(ReadOnlySpan<byte> input)
2827
{
28+
IFuzzerTarget.PrepareInput(ref input);
29+
2930
try
3031
{
3132
using var server = CreateServer();

test/Garnet.fuzz/Targets/IFuzzerTarget.cs

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,18 @@ internal interface IFuzzerTarget
1919
/// </summary>
2020
static abstract void Fuzz(ReadOnlySpan<byte> input);
2121

22+
/// <summary>
23+
/// Move input onto the POH, and do any other work necessary for
24+
/// consistent fuzzing in Garnet.
25+
/// </summary>
26+
static void PrepareInput(ref ReadOnlySpan<byte> input)
27+
{
28+
var ret = GC.AllocateUninitializedArray<byte>(input.Length, pinned: true);
29+
input.CopyTo(ret.AsSpan());
30+
31+
input = ret;
32+
}
33+
2234
/// <summary>
2335
/// Helper for throwing an exception when some post-run validation failed.
2436
/// </summary>

test/Garnet.fuzz/Targets/LuaScriptCompilation.cs

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ public sealed class LuaScriptCompilation : IFuzzerTarget
3131
/// <inheritdoc/>
3232
public static void Fuzz(ReadOnlySpan<byte> input)
3333
{
34+
IFuzzerTarget.PrepareInput(ref input);
35+
3436
foreach (var op in Options)
3537
{
3638
try

test/Garnet.fuzz/Targets/RespCommandParsing.cs

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ public sealed class RespCommandParsing : IFuzzerTarget
1616
/// <inheritdoc/>
1717
public static void Fuzz(ReadOnlySpan<byte> input)
1818
{
19+
IFuzzerTarget.PrepareInput(ref input);
20+
1921
var session = new RespServerSession();
2022

2123
try

0 commit comments

Comments
 (0)