aboutsummaryrefslogtreecommitdiff
path: root/fuzz/fuzz_targets
diff options
context:
space:
mode:
Diffstat (limited to 'fuzz/fuzz_targets')
-rw-r--r--fuzz/fuzz_targets/does_not_decode_invalid_registers.rs30
-rw-r--r--fuzz/fuzz_targets/small_reg_is_always_old_bank_if_possible.rs56
2 files changed, 86 insertions, 0 deletions
diff --git a/fuzz/fuzz_targets/does_not_decode_invalid_registers.rs b/fuzz/fuzz_targets/does_not_decode_invalid_registers.rs
new file mode 100644
index 0000000..0f32f73
--- /dev/null
+++ b/fuzz/fuzz_targets/does_not_decode_invalid_registers.rs
@@ -0,0 +1,30 @@
+//! instruction text should never include the word BUG - this is a symptom of selecting an invalid
+//! RegSpec while disassembling.
+
+#![no_main]
+#[macro_use] extern crate libfuzzer_sys;
+extern crate yaxpeax_x86;
+
+fuzz_target!(|data: &[u8]| {
+ let x86_64_decoder = yaxpeax_x86::long_mode::InstDecoder::default();
+ let x86_32_decoder = yaxpeax_x86::protected_mode::InstDecoder::default();
+ let x86_16_decoder = yaxpeax_x86::real_mode::InstDecoder::default();
+
+ if let Ok(inst) = x86_64_decoder.decode_slice(data) {
+ let mut res = String::new();
+ inst.write_to(&mut res).expect("format does not panic");
+ assert!(!res.contains("BUG"));
+ };
+
+ if let Ok(inst) = x86_32_decoder.decode_slice(data) {
+ let mut res = String::new();
+ inst.write_to(&mut res).expect("format does not panic");
+ assert!(!res.contains("BUG"));
+ };
+
+ if let Ok(inst) = x86_16_decoder.decode_slice(data) {
+ let mut res = String::new();
+ inst.write_to(&mut res).expect("format does not panic");
+ assert!(!res.contains("BUG"));
+ };
+});
diff --git a/fuzz/fuzz_targets/small_reg_is_always_old_bank_if_possible.rs b/fuzz/fuzz_targets/small_reg_is_always_old_bank_if_possible.rs
new file mode 100644
index 0000000..a143205
--- /dev/null
+++ b/fuzz/fuzz_targets/small_reg_is_always_old_bank_if_possible.rs
@@ -0,0 +1,56 @@
+//! if a register has a single-byte register operand, and it's one of `al`, `bl`, `cl`, or `dl`, it
+//! should compare equal to the `RegSpec` produced by `RegSpec::al()` and so on.
+//!
+//! at one point this was a bug; `RegSpec::al()` would use `RegisterBank::B`, but an instruction
+//! with `rex.w` set could get an `al` backed by a `RegSpec` in `RegisterBank::rB`.
+
+#![no_main]
+#[macro_use] extern crate libfuzzer_sys;
+extern crate yaxpeax_x86;
+
+// this test is not meaningful for 32-bit or 16-bit modes, there are no register synonyms in those
+// cases. leaving them in for fuzz targets to match other cases, and In Case Of Future Change.
+fuzz_target!(|data: &[u8]| {
+ let x86_64_decoder = yaxpeax_x86::long_mode::InstDecoder::default();
+ let x86_32_decoder = yaxpeax_x86::protected_mode::InstDecoder::default();
+ let x86_16_decoder = yaxpeax_x86::real_mode::InstDecoder::default();
+
+ if let Ok(inst) = x86_64_decoder.decode_slice(data) {
+ for i in 0..inst.operand_count() {
+ match inst.operand(i) {
+ yaxpeax_x86::long_mode::Operand::Register(reg) => {
+ if reg.num() < 4 && reg.class() == yaxpeax_x86::long_mode::register_class::RB {
+ assert!(false, "instruction has rex.w register that aliases old byte registers");
+ } else {
+ /* not a potentially-unwanted register */
+ }
+ },
+ _ => { /* not a relevant operand kind. immediate or memory of some kind. */ }
+ }
+ }
+ };
+
+ /*
+ if let Ok(inst) = x86_32_decoder.decode_slice(data) {
+ for i in 0..inst.operand_count() {
+ match inst.operand(i) {
+ Operand::Register(_reg) => {
+ /* not a potentially-unwanted register */
+ },
+ _ => { /* not a relevant operand kind. immediate or memory of some kind. */ }
+ }
+ }
+ };
+
+ if let Ok(inst) = x86_16_decoder.decode_slice(data) {
+ for i in 0..inst.operand_count() {
+ match inst.operand(i) {
+ Operand::Register(_reg) => {
+ /* not a potentially-unwanted register */
+ },
+ _ => { /* not a relevant operand kind. immediate or memory of some kind. */ }
+ }
+ }
+ };
+ */
+});