open-source-parsers / jsoncpp / 40342106111

90%

master: 90%

Pull #1730

github

fix(fuzz): use the real reader settings keys in the fuzzer

The fuzzer set most CharReaderBuilder settings under names with a
trailing underscore ("allowComments_", "strictRoot_", ...), which
newCharReader() does not read, and set failIfExtra twice. As a result
only failIfExtra and collectComments ever varied; every other reader
mode was stuck at its default.

Use the real key names, give the duplicate failIfExtra bit to skipBom,
and add an optional small stackLimit (bit 11, value from the upper 16
bits) so the depth-limit error paths are reachable. Abort if
CharReaderBuilder::validate() rejects the settings, so a misspelled key
fails loudly instead of silently disabling a mode.

The FuzzTest unit test only passed "{}", which is shorter than the
4-byte settings header and returned before touching any settings.
Exercise no settings, all settings, and a tiny stack limit.

In a local 2-minute libFuzzer run from test/data seeds, json_reader.cpp
edge coverage goes from 465 to 570 of 1996.

2223 of 2640 branches covered (84.2%)

Branch coverage included in aggregate %.

2615 of 2740 relevant lines covered (95.44%)

23835.16 hits per line