Commit 48d41d72 authored by Daniel McArdle's avatar Daniel McArdle Committed by Commit Bot

query_parser_fuzzer: Abort early on large inputs

In the attached bug, the query_parser::ParseQueryImpl function is
timing out after 25 seconds while parsing a large input (109K). The
problem appears to be that the ICU function |ubrk_next| is a little
slow. There isn't anything obvious we can do to improve performance,
so we will now reject inputs that are larger than ~1/2 of the "bad"
input's size.

Bug: 1015888
Change-Id: Icd3b1bcf30714fd39ef6700e0f44fbf09efa3c82
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1869771Reviewed-by: default avatarScott Violet <sky@chromium.org>
Commit-Queue: Dan McArdle <dmcardle@chromium.org>
Cr-Commit-Position: refs/heads/master@{#707678}
parent 95eee757
......@@ -16,8 +16,12 @@ struct Environment {
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
static Environment env;
FuzzedDataProvider data_provider(data, size);
constexpr size_t kMaxSize = 1 << 16;
if (size > kMaxSize)
return 0;
FuzzedDataProvider data_provider(data, size);
const query_parser::MatchingAlgorithm matching_alg =
data_provider.ConsumeEnum<query_parser::MatchingAlgorithm>();
const base::string16 query16 = base::UTF8ToUTF16(
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment