How does fuzz test be used in jsoncpp?

[fredgan]

Recently, I find that fuzz test is used in this project. How do we use fuzzy test in this project? Is there any documents about it? Any body can give me some tips?

[dota17]

I have run fuzz test in my own PC, and here are some tips that I follow:

• Make a static library: libFuzzer.a libfuzzer-workshop

• Create a directory that contains: fuzz.cpp fuzz.h libFuzzer.a

fuzz.cpp and fuzz.h are from \jsoncpp\src\test_lib_json\

• build fuzz.cpp: clang++ -g -std=c++11 -fsanitize=address -fsanitize-coverage=trace-pc-guard fuzz.cpp libFuzzer.a -ljsoncpp -o out

suppose you have built shared jsoncpp lib and install it

And here are some links:
libFuzzer Tutorial
libFuzzer – a library for coverage-guided fuzz testing
hope it helps you.

[dota17]

Hi @Google-Autofuzz
A crash file occured when I run fuzz test in you PR #943:

SUMMARY: AddressSanitizer: heap-buffer-overflow (/opt/opensource_work/jsoncppFuzzer/my_fuzzer+0x43cb4d)
Shadow bytes around the buggy address:
  0x0c0480433780: fa fa fa fa fa fa fd fd fa fa 00 07 fa fa fd fd
  0x0c0480433790: fa fa 00 03 fa fa fd fd fa fa fd fd fa fa fa fa
  0x0c04804337a0: fa fa fa fa fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c04804337b0: fa fa fa fa fa fa fd fd fa fa fd fd fa fa 00 04
  0x0c04804337c0: fa fa fa fa fa fa fd fd fa fa fa fa fa fa fa fa
=>0x0c04804337d0: fa fa 00 03 fa fa fd fd fa fa 00[01]fa fa fd fd
  0x0c04804337e0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa 00 00
  0x0c04804337f0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480433800: fa fa 00 06 fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480433810: fa fa 00 04 fa fa fd fd fa fa 00 05 fa fa fd fd
  0x0c0480433820: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==5679==ABORTING
MS: 4 ChangeByte-ChangeByte-InsertRepeatedBytes-InsertByte-; base unit: adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
0xaf,0x2a,0x39,0x39,0x39,0x39,0x39,0x39,0x39,
\xaf*9999999
artifact_prefix='./'; Test unit written to ./crash-46803ff5a83458e1763d451e32533cd28b2ec602
Base64: ryo5OTk5OTk5

What does these information mean? Do we have to deal with these things?

[Google-Autofuzz]

What does these information mean? Do we have to deal with these things?

This is a bug report saying that there is a buffer overflow. You can reproduce this crash with ./crash-46803ff5a83458e1763d451e32533cd28b2ec602 and fix the bug. We modified this fuzz.cpp file in #994 for better coverage and will pass OSS-Fuzz's travis. It will be great if #994 can be merged so that it can be integrated to OSS-Fuzz soon :)

As for details on how to interpret an AddressSanitizer crash, you can check its documentation.

[fredgan]

OK, Thanks a lot!