diff --git a/test/fuzzers/BUILD.gn b/test/fuzzers/BUILD.gn index 65694f39..c565e113 100644 --- a/test/fuzzers/BUILD.gn +++ b/test/fuzzers/BUILD.gn @@ -40,6 +40,7 @@ if (!build_with_chromium || use_fuzzing_engine) { ":spvtools_opt_webgputovulkan_fuzzer", ":spvtools_opt_vulkantowebgpu_fuzzer", ":spvtools_val_fuzzer", + ":spvtools_val_webgpu_fuzzer", ] } } @@ -108,6 +109,12 @@ spvtools_fuzzer("spvtools_val_fuzzer_src") { ] } +spvtools_fuzzer("spvtools_val_webgpu_fuzzer_src") { + sources = [ + "spvtools_val_webgpu_fuzzer.cpp", + ] +} + if (!build_with_chromium || use_fuzzing_engine) { fuzzer_test("spvtools_binary_parser_fuzzer") { sources = [] @@ -165,4 +172,12 @@ if (!build_with_chromium || use_fuzzing_engine) { ] seed_corpus = "corpora/spv" } + + fuzzer_test("spvtools_val_webgpu_fuzzer") { + sources = [] + deps = [ + ":spvtools_val_webgpu_fuzzer_src", + ] + seed_corpus = "corpora/spv" + } } diff --git a/test/fuzzers/spvtools_val_webgpu_fuzzer.cpp b/test/fuzzers/spvtools_val_webgpu_fuzzer.cpp new file mode 100644 index 00000000..bed6e1a2 --- /dev/null +++ b/test/fuzzers/spvtools_val_webgpu_fuzzer.cpp @@ -0,0 +1,36 @@ +// Copyright (c) 2019 Google Inc. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#include +#include + +#include "spirv-tools/libspirv.hpp" + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { + spvtools::SpirvTools tools(SPV_ENV_WEBGPU_0); + tools.SetMessageConsumer([](spv_message_level_t, const char*, + const spv_position_t&, const char*) {}); + + std::vector input; + input.resize(size >> 2); + + size_t count = 0; + for (size_t i = 0; (i + 3) < size; i += 4) { + input[count++] = data[i] | (data[i + 1] << 8) | (data[i + 2] << 16) | + (data[i + 3]) << 24; + } + + tools.Validate(input); + return 0; +}