File size: 1,745 Bytes
0ef171e | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 | // libFuzzer harness for executorch::extension::FlatTensorDataMap::load()
// Targets the .ptd flatbuffer parsing path (extension/flat_tensor/flat_tensor_data_map.cpp).
// Authorized local testing only - huntr MFV scope: ExecuTorch .pte/.ptd parser.
#include <cstddef>
#include <cstdint>
#include <executorch/extension/data_loader/buffer_data_loader.h>
#include <executorch/extension/flat_tensor/flat_tensor_data_map.h>
#include <executorch/runtime/platform/runtime.h>
using executorch::extension::BufferDataLoader;
using executorch::extension::FlatTensorDataMap;
static bool g_initialized = false;
extern "C" int LLVMFuzzerTestOneInput(const std::uint8_t* data, std::size_t size) {
if (!g_initialized) {
executorch::runtime::runtime_init();
g_initialized = true;
}
constexpr std::size_t kMaxInput = 32U * 1024U * 1024U;
if (data == nullptr || size == 0 || size > kMaxInput) {
return 0;
}
BufferDataLoader loader(data, size);
auto map = FlatTensorDataMap::load(&loader);
if (!map.ok()) {
return 0;
}
auto& m = map.get();
auto num_keys_res = m.get_num_keys();
if (num_keys_res.ok()) {
uint32_t n = num_keys_res.get();
// Bound the loop - malicious n could be huge but get_key() range-checks it.
uint32_t iter = n > 4096 ? 4096 : n;
for (uint32_t i = 0; i < iter; ++i) {
auto key_res = m.get_key(i);
if (key_res.ok()) {
auto layout = m.get_tensor_layout(executorch::aten::string_view(key_res.get()));
if (layout.ok()) {
(void)layout.get().nbytes();
}
auto data_res = m.get_data(executorch::aten::string_view(key_res.get()));
if (data_res.ok()) {
data_res.get().Free();
}
}
}
}
return 0;
}
|