Skip to content

Fix: stop consuming fuzzer bytes for single-choice .values / .pointers on arrays #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
N3ur0sis wants to merge 1 commit into from
Closed

Fix: stop consuming fuzzer bytes for single-choice .values / .pointers on arrays #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 34 additions & 24 deletions src/cgen/emit.zig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -332,37 +332,47 @@ fn emitSampler(allocator: std.mem.Allocator, globals: []const Parser.Global, fil
const label = try std.fmt.bufPrint(&label_buf, "FM_VAL_{d}", .{value_idx});
value_idx += 1;

try writeIndent(file, current_depth);
try file.writeAll("size_t idx_");
try file.writeAll(label);
try file.writeAll(" = data[off] % ");
const count_str = try std.fmt.bufPrint(&num_buf, "{d}", .{vals.len});
try file.writeAll(count_str);
try file.writeAll(";\n");

var src_buf: [256]u8 = undefined;
const src = try std.fmt.bufPrint(&src_buf, "&{s}[idx_{s} * {s}]", .{ label, label, bytes_str });
try emitMemcpy(file, current_depth, dst_expr, src, bytes_str);
try incrementOffset(file, current_depth, "1");
if (vals.len == 1) {
try emitMemcpy(file, current_depth, dst_expr, label, bytes_str);
} else {
try writeIndent(file, current_depth);
try file.writeAll("size_t idx_");
try file.writeAll(label);
try file.writeAll(" = data[off] % ");
const count_str = try std.fmt.bufPrint(&num_buf, "{d}", .{vals.len});
try file.writeAll(count_str);
try file.writeAll(";\n");

var src_buf: [256]u8 = undefined;
const src = try std.fmt.bufPrint(&src_buf, "&{s}[idx_{s} * {s}]", .{ label, label, bytes_str });
try emitMemcpy(file, current_depth, dst_expr, src, bytes_str);
try incrementOffset(file, current_depth, "1");
}
},
.pointers => |ptrs| {
if (ptrs.len == 0) continue;
var ptr_label_buf: [64]u8 = undefined;
const ptr_label = try std.fmt.bufPrint(&ptr_label_buf, "FM_PTR_{d}", .{ptr_idx});
ptr_idx += 1;

try writeIndent(file, current_depth);
try file.writeAll("size_t idx_");
try file.writeAll(ptr_label);
try file.writeAll(" = data[off] % ");
const count_str = try std.fmt.bufPrint(&num_buf, "{d}", .{ptrs.len});
try file.writeAll(count_str);
try file.writeAll(";\n");

var src_buf: [128]u8 = undefined;
const src = try std.fmt.bufPrint(&src_buf, "&{s}[idx_{s}]", .{ ptr_label, ptr_label });
try emitMemcpy(file, current_depth, dst_expr, src, bytes_str);
try incrementOffset(file, current_depth, "1");
if (ptrs.len == 1) {
var src_buf: [128]u8 = undefined;
const src = try std.fmt.bufPrint(&src_buf, "&{s}[0]", .{ptr_label});
try emitMemcpy(file, current_depth, dst_expr, src, bytes_str);
} else {
try writeIndent(file, current_depth);
try file.writeAll("size_t idx_");
try file.writeAll(ptr_label);
try file.writeAll(" = data[off] % ");
const count_str = try std.fmt.bufPrint(&num_buf, "{d}", .{ptrs.len});
try file.writeAll(count_str);
try file.writeAll(";\n");

var src_buf: [128]u8 = undefined;
const src = try std.fmt.bufPrint(&src_buf, "&{s}[idx_{s}]", .{ ptr_label, ptr_label });
try emitMemcpy(file, current_depth, dst_expr, src, bytes_str);
try incrementOffset(file, current_depth, "1");
}
},
}

Expand Down
3 changes: 2 additions & 1 deletion src/seed.zig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,8 @@ pub fn neededBytesFromGlobals(globals: []const ir.Global) usize {
const field_mult = dimsProduct(f.dims);
const bytes: usize = switch (f.domain) {
.top => (f.bit_width + 7) / 8,
.values, .pointers => 1,
.values => |vals| if (vals.len <= 1) 0 else 1,
.pointers => |ptrs| if (ptrs.len <= 1) 0 else 1,
};
total += bytes * global_mult * field_mult;
}
Expand Down
3 changes: 3 additions & 0 deletions tests/big_pool/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
Fix for a large `uint8_t` array with a one-value `.values` domain (`target.c` + `target.c.in`). There is also `counter` so the expected global prefix stays small once the bug is fixed.

Used to catch the case where the sampler still bumped `off` on every array element even though the domain had nothing to choose from.
5 changes: 5 additions & 0 deletions tests/big_pool/target.c
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
#include <stdint.h>

uint8_t big_pool[16000];
int counter;

15 changes: 15 additions & 0 deletions tests/big_pool/target.c.in
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
.{ .{
.name = "big_pool",
.source_file = "tests/big_pool/target.c",
.size_bytes = 16000,
.is_static = false,
.dims = .{.{ .len = 16000, .stride_bytes = 1 }},
.fields = .{.{
.name = ".",
.offset_bits = 0,
.bit_width = 8,
.dims = .{},
.is_padding = false,
.domain = .{ .values = .{"\x00"} },
}},
}}
29 changes: 29 additions & 0 deletions tests/big_pool/target.c.zon
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
.{ .{
.name = "big_pool",
.source_file = "tests/big_pool/target.c",
.size_bytes = 16000,
.is_static = false,
.dims = .{.{ .len = 16000, .stride_bytes = 1 }},
.fields = .{.{
.name = ".",
.offset_bits = 0,
.bit_width = 8,
.dims = .{},
.is_padding = false,
.domain = .{ .values = .{"\x00"} },
}},
}, .{
.name = "counter",
.source_file = "tests/big_pool/target.c",
.size_bytes = 4,
.is_static = false,
.dims = .{},
.fields = .{.{
.name = ".",
.offset_bits = 0,
.bit_width = 32,
.dims = .{},
.is_padding = false,
.domain = .top,
}},
} }
Loading