Inside Bitcoin

251    abort();
252
253  T range = .0;
254  T result = min;
255  constexpr T zero(.0);
256  if (max > zero && min < zero && max > min + std::numeric_limits<T>::max()) {
257    // The diff |max - min| would overflow the given floating point type. Use
258    // the half of the diff as the range and consume a bool to decide whether
259    // the result is in the first of the second part of the diff.
260    range = (max / 2.0) - (min / 2.0);
261    if (ConsumeBool()) {
262      result += range;
263    }
264  } else {
265    range = max - min;
266  }
267
268  return result + range * ConsumeProbability<T>();
269}
270
271// Returns a floating point number in the range [0.0, 1.0]. If there's no
272// input data left, always returns 0.
273template <typename T> T FuzzedDataProvider::ConsumeProbability() {
274  static_assert(std::is_floating_point_v<T>,
275                "A floating point type is required.");
276
277  // Use different integral types for different floating point types in order
278  // to provide better density of the resulting values.
279  using IntegralType =
280      typename std::conditional_t<(sizeof(T) <= sizeof(uint32_t)), uint32_t,
281                                  uint64_t>;
282
283  T result = static_cast<T>(ConsumeIntegral<IntegralType>());
284  result /= static_cast<T>(std::numeric_limits<IntegralType>::max());
285  return result;
286}
287
288// Reads one byte and returns a bool, or false when no data remains.
289inline bool FuzzedDataProvider::ConsumeBool() {
290  return 1 & ConsumeIntegral<uint8_t>();
291}
292
293// Returns an enum value. The enum must start at 0 and be contiguous. It must
294// also contain |kMaxValue| aliased to its largest (inclusive) value. Such as:
295// enum class Foo { SomeValue, OtherValue, kMaxValue = OtherValue };
296template <typename T> T FuzzedDataProvider::ConsumeEnum() {
297  static_assert(std::is_enum_v<T>, "|T| must be an enum type.");
298  return static_cast<T>(
299      ConsumeIntegralInRange<uint32_t>(0, static_cast<uint32_t>(T::kMaxValue)));
300}
301
302// Returns a copy of the value selected from the given fixed-size |array|.
303template <typename T, size_t size>
304T FuzzedDataProvider::PickValueInArray(const T (&array)[size]) {
305  static_assert(size > 0, "The array must be non empty.");
306  return array[ConsumeIntegralInRange<size_t>(0, size - 1)];
307}
308
309template <typename T, size_t size>
310T FuzzedDataProvider::PickValueInArray(const std::array<T, size> &array) {
311  static_assert(size > 0, "The array must be non empty.");
312  return array[ConsumeIntegralInRange<size_t>(0, size - 1)];
313}
314
315template <typename T>
316T FuzzedDataProvider::PickValueInArray(std::initializer_list<const T> list) {
317  if (!list.size())
318    abort();
319
320  return *(list.begin() + ConsumeIntegralInRange<size_t>(0, list.size() - 1));
321}
322
323// Writes |num_bytes| of input data to the given destination pointer. If there
324// is not enough data left, writes all remaining bytes. Return value is the
325// number of bytes written.
326// In general, it's better to avoid using this function, but it may be useful
327// in cases when it's necessary to fill a certain buffer or object with
328// fuzzing data.
329inline size_t FuzzedDataProvider::ConsumeData(void *destination,
330                                              size_t num_bytes) {
331  num_bytes = std::min(num_bytes, remaining_bytes_);
332  CopyAndAdvance(destination, num_bytes);
333  return num_bytes;
334}
335
336// Private methods.
337inline void FuzzedDataProvider::CopyAndAdvance(void *destination,
338                                               size_t num_bytes) {
339  std::memcpy(destination, data_ptr_, num_bytes);
340  Advance(num_bytes);
341}
342
343inline void FuzzedDataProvider::Advance(size_t num_bytes) {
344  if (num_bytes > remaining_bytes_)
345    abort();
346
347  data_ptr_ += num_bytes;
348  remaining_bytes_ -= num_bytes;
349}
350
351template <typename T>
352std::vector<T> FuzzedDataProvider::ConsumeBytes(size_t size, size_t num_bytes) {
353  static_assert(sizeof(T) == sizeof(uint8_t), "Incompatible data type.");
354
355  // The point of using the size-based constructor below is to increase the
356  // odds of having a vector object with capacity being equal to the length.
357  // That part is always implementation specific, but at least both libc++ and
358  // libstdc++ allocate the requested number of bytes in that constructor,
359  // which seems to be a natural choice for other implementations as well.
360  // To increase the odds even more, we also call |shrink_to_fit| below.
361  std::vector<T> result(size);
362  if (size == 0) {
363    if (num_bytes != 0)
364      abort();
365    return result;
366  }
367
368  CopyAndAdvance(result.data(), num_bytes);
369
370  // Even though |shrink_to_fit| is also implementation specific, we expect it
371  // to provide an additional assurance in case vector's constructor allocated
372  // a buffer which is larger than the actual amount of data we put inside it.
373  result.shrink_to_fit();
374  return result;
375}
376
377template <typename TS, typename TU>
378TS FuzzedDataProvider::ConvertUnsignedToSigned(TU value) {
379  static_assert(sizeof(TS) == sizeof(TU), "Incompatible data types.");
380  static_assert(!std::numeric_limits<TU>::is_signed,
381                "Source type must be unsigned.");
382
383  if constexpr (std::numeric_limits<TS>::is_modulo)
384    return static_cast<TS>(value);
385
386  // Avoid using implementation-defined unsigned to signed conversions.
387  // To learn more, see https://stackoverflow.com/questions/13150449.
388  constexpr auto TS_max = static_cast<TU>(std::numeric_limits<TS>::max());
389  if (value <= TS_max) {
390    return static_cast<TS>(value);
391  } else {
392    constexpr auto TS_min = std::numeric_limits<TS>::min();
393    return TS_min + static_cast<TS>(value - TS_min);
394  }
395}
396
397#endif // LLVM_FUZZER_FUZZED_DATA_PROVIDER_H_
398