├── .python-version ├── database ├── cre2 │ ├── in │ ├── .gitignore │ ├── install_deps.sh │ ├── disable_abseil_debug.patch │ ├── fetch.sh │ └── build.sh ├── liblouis │ ├── in │ │ └── A │ ├── .gitignore │ ├── install_deps.sh │ ├── build.sh │ ├── fetch.sh │ └── lib.toml ├── libming │ ├── in │ │ └── A │ ├── .gitignore │ ├── install_deps.sh │ ├── fetch.sh │ ├── lib.toml │ └── build.sh ├── loguru │ ├── in │ │ └── A │ ├── .gitignore │ ├── build.sh │ ├── lib.toml │ └── fetch.sh ├── c-ares │ ├── .gitignore │ ├── in │ │ └── multi-indir │ ├── build.sh │ └── fetch.sh ├── cjson │ ├── .gitignore │ ├── build.sh │ ├── lib.toml │ ├── fetch.sh │ └── in │ │ └── test1 ├── lcms │ ├── .gitignore │ ├── in │ │ └── alltags.icc │ ├── install_deps.sh │ ├── build.sh │ ├── lib.toml │ └── fetch.sh ├── libaom │ ├── .gitignore │ ├── in │ │ └── soccer_cif_20f_q48.ivf │ ├── install_deps.sh │ ├── build.sh │ └── fetch.sh ├── libpng │ ├── .gitignore │ ├── in │ │ ├── not_kitty.png │ │ ├── not_kitty_alpha.png │ │ ├── not_kitty_gamma.png │ │ └── not_kitty_icc.png │ ├── install_deps.sh │ ├── build.sh │ ├── fetch.sh │ └── lib.toml ├── libvpx │ ├── .gitignore │ ├── in │ │ ├── out8.webm │ │ └── out9.webm │ ├── install_deps.sh │ ├── build.sh │ └── fetch.sh ├── zlib │ ├── .gitignore │ ├── in │ │ ├── Duino.gz │ │ └── Duino.zip │ ├── build.sh │ ├── fetch.sh │ └── lib.toml ├── libjpeg-turbo │ ├── .gitignore │ ├── in │ │ └── not_kitty.jpg │ ├── build.sh │ ├── fetch.sh │ └── lib.toml ├── libpcap │ ├── .gitignore │ ├── install_deps.sh │ ├── build.sh │ ├── lib.toml │ └── fetch.sh ├── pugixml │ ├── .gitignore │ ├── in │ │ ├── Stationary & Computer Mart - Despatch Note Import.xml │ │ ├── Stationary & Computer Mart - Goods Recieved Notes Import.xml │ │ ├── Transactions - Bank Receipt.xml │ │ ├── Transaction with Bank Receipt.xml │ │ ├── Import Stock Quantities using Stock Transactions.xml │ │ ├── Sage 200 Transaction.xml │ │ └── Project Import.xml │ ├── build.sh │ ├── lib.toml │ └── fetch.sh ├── svgpp │ ├── .gitignore │ ├── install_deps.sh │ ├── build.sh │ ├── lib.toml │ └── fetch.sh ├── curl │ ├── .gitignore │ ├── install_deps.sh │ ├── build.sh │ ├── lib.toml │ ├── fetch.sh │ └── in │ │ └── test1 ├── rapidcsv │ ├── .gitignore │ ├── hints.json │ ├── build.sh │ ├── lib.toml │ └── fetch.sh ├── re2 │ ├── in │ │ ├── email.txt │ │ ├── ip.txt │ │ ├── ip.re │ │ ├── youtube.re │ │ ├── cron.re │ │ ├── email.re │ │ └── cron.txt │ ├── .gitignore │ ├── api_ban_list.json │ ├── install_deps.sh │ ├── build.sh │ ├── disable_abseil_debug.patch │ └── fetch.sh ├── sqlite3 │ ├── .gitignore │ ├── in │ │ └── simple_queries.sql │ ├── Makefile │ ├── fetch.sh │ ├── build.sh │ └── lib.toml ├── tinygltf │ ├── .gitignore │ ├── build.sh │ ├── fetch.sh │ ├── lib.toml │ └── separate_del_and_impl.py ├── exiv2 │ ├── .gitignore │ ├── in │ │ ├── not_kitty.bmp │ │ ├── not_kitty.gif │ │ ├── not_kitty.ico │ │ ├── not_kitty.jp2 │ │ ├── not_kitty.jpg │ │ ├── not_kitty.jxr │ │ ├── not_kitty.png │ │ ├── not_kitty.tiff │ │ ├── not_kitty.webp │ │ ├── not_kitty_icc.png │ │ ├── not_kitty_alpha.png │ │ └── not_kitty_gamma.png │ ├── install_deps.sh │ ├── build.sh │ └── fetch.sh ├── libmagic │ ├── .gitignore │ ├── install_deps.sh │ ├── api_hints.json │ ├── build.sh │ ├── fetch.sh │ └── lib.toml ├── ffjpeg │ ├── .gitignore │ ├── in │ │ └── not_kitty.jpg │ ├── CMakeLists.txt │ ├── latest.diff │ ├── build.sh │ ├── lib.toml │ └── fetch.sh ├── libtiff │ ├── .gitignore │ ├── in │ │ └── file_example_TIFF_1MB.tiff │ ├── install_deps.sh │ ├── build.sh │ ├── fetch.sh │ └── lib.toml ├── .gitignore ├── ngiflib │ ├── .gitignore │ ├── in │ │ └── not_kitty.gif │ ├── install_deps.sh │ ├── lib.toml │ ├── build.sh │ └── fetch.sh ├── utils │ ├── extract_gcov.py │ ├── run_asan.py │ └── run_gcov.py └── srclink.py ├── processor └── cxx │ ├── .gitignore │ ├── .clang-format │ ├── example │ ├── example.cpp │ └── example.h │ ├── CMakeLists.txt │ └── cgprocessor.hh ├── src ├── tests │ ├── .gitignore │ ├── test_Query.py │ ├── test_LibPurpose.py │ ├── test_LittleChat.py │ ├── test_RAG.py │ ├── test_Summarize.py │ └── test_Deduce.py ├── prompt │ ├── learn_crash_constraint_fix.usr │ ├── generate_c_driver.sub │ ├── choose_relevant_functions.sub │ ├── deduce_library_purpose.usr │ ├── generate_cpp_driver.sub │ ├── learn_crash_constraint_explain.usr │ ├── deduce_library_purpose.sys │ ├── fix_build_error.usr │ ├── choose_valuable_excerpts.usr │ ├── deduce_func_usage_from_src.usr │ ├── fix_asan_error.usr │ ├── deduce_func_usage_from_doc.usr │ ├── analyze_crash.usr │ ├── learn_crash_constraint.sys │ ├── deduce_func_usage_from_src.sys │ ├── choose_relevant_functions.usr │ ├── generate_c_driver.usr │ ├── choose_valuable_excerpts.sys │ ├── learn_crash_constraint_learn.usr │ ├── analyze_crash.sys │ ├── README.md │ ├── generate_cpp_driver.usr │ ├── deduce_func_usage_from_doc.sys │ ├── choose_relevant_functions.sys │ ├── learn_crash_constraint_reasoning_model.usr │ ├── generate_c_driver.sys │ └── generate_cpp_driver.sys ├── configurer │ ├── __init__.py │ └── template.py └── vars.py ├── img ├── logo.png ├── table2.png ├── table5.png └── table6.png ├── paper └── ccs25-full.pdf ├── setup.sh ├── examples ├── rapidcsv │ ├── build_synthesized_driver.sh │ └── build_additional_synthesized_driver.sh ├── cjson │ ├── build_synthesized_driver.sh │ ├── synthesized │ │ ├── 25.cpp │ │ ├── 34.cpp │ │ ├── 24.cpp │ │ ├── 17.cpp │ │ ├── 21.cpp │ │ ├── 36.cpp │ │ ├── 16.cpp │ │ └── 39.cpp │ └── build_additional_synthesized_driver.sh ├── ffjpeg │ ├── build_synthesized_driver.sh │ ├── synthesized │ │ └── 43.c │ └── build_additional_synthesized_driver.sh ├── lcms │ ├── build_synthesized_driver.sh │ ├── synthesized │ │ └── 5.cpp │ └── build_additional_synthesized_driver.sh ├── loguru │ ├── build_synthesized_driver.sh │ └── build_additional_synthesized_driver.sh ├── tinygltf │ └── build_synthesized_driver.sh ├── liblouis │ └── build_synthesized_driver.sh ├── libvpx │ └── build_synthesized_driver.sh ├── libmagic │ └── build_synthesized_driver.sh ├── ngiflib │ └── build_synthesized_driver.sh ├── pugixml │ ├── build_synthesized_driver.sh │ └── synthesized │ │ └── 2.cpp ├── c-ares │ ├── build_synthesized_driver.sh │ └── synthesized │ │ ├── 40.c │ │ ├── 38.c │ │ ├── 24.c │ │ ├── 42.c │ │ └── 27.c ├── libpcap │ ├── build_synthesized_driver.sh │ └── synthesized │ │ ├── 21.c │ │ └── 72.c ├── libpng │ ├── build_synthesized_driver.sh │ └── synthesized │ │ └── 9.cpp ├── zlib │ ├── build_synthesized_driver.sh │ └── synthesized │ │ ├── 6.c │ │ ├── 42.c │ │ ├── 45.c │ │ └── 28.c ├── libaom │ ├── build_synthesized_driver.sh │ └── synthesized │ │ └── 36.cpp ├── curl │ └── build_synthesized_driver.sh ├── libjpeg-turbo │ └── build_synthesized_driver.sh ├── exiv2 │ ├── build_synthesized_driver.sh │ └── synthesized │ │ ├── 44.cpp │ │ ├── 16.cpp │ │ ├── 25.cpp │ │ ├── 476.cpp │ │ ├── 667.cpp │ │ ├── 229.cpp │ │ ├── 687.cpp │ │ ├── 41.cpp │ │ ├── 362.cpp │ │ ├── 22.cpp │ │ ├── 602.cpp │ │ ├── 21.cpp │ │ ├── 24.cpp │ │ ├── 512.cpp │ │ ├── 222.cpp │ │ └── 734.cpp ├── libtiff │ ├── build_synthesized_driver.sh │ └── synthesized │ │ ├── 4.c │ │ └── 97.c ├── sqlite3 │ ├── build_synthesized_driver.sh │ └── synthesized │ │ ├── 138.cpp │ │ ├── 91.cpp │ │ ├── 40.cpp │ │ ├── 45.cpp │ │ ├── 24.cpp │ │ └── 111.cpp └── re2 │ └── synthesized │ ├── 9.cpp │ ├── 4.cpp │ ├── 48.cpp │ ├── 49.cpp │ ├── 39.cpp │ ├── 43.cpp │ ├── 12.cpp │ ├── 38.cpp │ ├── 31.cpp │ ├── 34.cpp │ ├── 17.cpp │ ├── 47.cpp │ ├── 27.cpp │ ├── 32.cpp │ ├── 16.cpp │ └── 11.cpp ├── .gitignore ├── requirements.txt ├── pyproject.toml └── LICENSE /.python-version: -------------------------------------------------------------------------------- 1 | 3.12 2 | -------------------------------------------------------------------------------- /database/cre2/in: -------------------------------------------------------------------------------- 1 | ../re2/in -------------------------------------------------------------------------------- /database/liblouis/in/A: -------------------------------------------------------------------------------- 1 | A 2 | -------------------------------------------------------------------------------- /database/libming/in/A: -------------------------------------------------------------------------------- 1 | A 2 | -------------------------------------------------------------------------------- /database/loguru/in/A: -------------------------------------------------------------------------------- 1 | A 2 | -------------------------------------------------------------------------------- /database/c-ares/.gitignore: -------------------------------------------------------------------------------- 1 | latest -------------------------------------------------------------------------------- /database/cjson/.gitignore: -------------------------------------------------------------------------------- 1 | latest/ -------------------------------------------------------------------------------- /database/lcms/.gitignore: -------------------------------------------------------------------------------- 1 | latest/ -------------------------------------------------------------------------------- /database/libaom/.gitignore: -------------------------------------------------------------------------------- 1 | latest/ -------------------------------------------------------------------------------- /database/libpng/.gitignore: -------------------------------------------------------------------------------- 1 | latest/ -------------------------------------------------------------------------------- /database/libvpx/.gitignore: -------------------------------------------------------------------------------- 1 | /latest -------------------------------------------------------------------------------- /database/zlib/.gitignore: -------------------------------------------------------------------------------- 1 | /latest -------------------------------------------------------------------------------- /processor/cxx/.gitignore: -------------------------------------------------------------------------------- 1 | example/*.json -------------------------------------------------------------------------------- /database/libjpeg-turbo/.gitignore: -------------------------------------------------------------------------------- 1 | latest/ -------------------------------------------------------------------------------- /database/libpcap/.gitignore: -------------------------------------------------------------------------------- 1 | /latest 2 | /in -------------------------------------------------------------------------------- /database/loguru/.gitignore: -------------------------------------------------------------------------------- 1 | latest 2 | code -------------------------------------------------------------------------------- /database/pugixml/.gitignore: -------------------------------------------------------------------------------- 1 | latest 2 | code -------------------------------------------------------------------------------- /database/svgpp/.gitignore: -------------------------------------------------------------------------------- 1 | /code 2 | /latest -------------------------------------------------------------------------------- /database/curl/.gitignore: -------------------------------------------------------------------------------- 1 | latest/ 2 | code/ 3 | -------------------------------------------------------------------------------- /database/rapidcsv/.gitignore: -------------------------------------------------------------------------------- 1 | /code 2 | /latest -------------------------------------------------------------------------------- /database/re2/in/email.txt: -------------------------------------------------------------------------------- 1 | mailname@domain.com -------------------------------------------------------------------------------- /database/sqlite3/.gitignore: -------------------------------------------------------------------------------- 1 | latest/ 2 | code/ -------------------------------------------------------------------------------- /database/tinygltf/.gitignore: -------------------------------------------------------------------------------- 1 | /code 2 | /latest -------------------------------------------------------------------------------- /database/exiv2/.gitignore: -------------------------------------------------------------------------------- 1 | /0.26 2 | /latest 3 | /code -------------------------------------------------------------------------------- /database/libmagic/.gitignore: -------------------------------------------------------------------------------- 1 | latest/ 2 | code/ 3 | in/ -------------------------------------------------------------------------------- /database/cre2/.gitignore: -------------------------------------------------------------------------------- 1 | /code 2 | /latest 3 | /abseil-cpp -------------------------------------------------------------------------------- /database/ffjpeg/.gitignore: -------------------------------------------------------------------------------- 1 | /627c8a9 2 | /latest 3 | /code -------------------------------------------------------------------------------- /database/liblouis/.gitignore: -------------------------------------------------------------------------------- 1 | /code 2 | /latest 3 | /v3.2.0 -------------------------------------------------------------------------------- /database/libtiff/.gitignore: -------------------------------------------------------------------------------- 1 | /code 2 | /v4.0.9 3 | /latest -------------------------------------------------------------------------------- /database/re2/.gitignore: -------------------------------------------------------------------------------- 1 | /code 2 | /latest 3 | /abseil-cpp -------------------------------------------------------------------------------- /src/tests/.gitignore: -------------------------------------------------------------------------------- 1 | pugixml_* 2 | *.swp 3 | batch_test.txt -------------------------------------------------------------------------------- /database/libming/.gitignore: -------------------------------------------------------------------------------- 1 | /code 2 | /ming-0_4_8 3 | /latest -------------------------------------------------------------------------------- /database/.gitignore: -------------------------------------------------------------------------------- 1 | fuzz.toml 2 | dummy_file 3 | 4 | asan/ 5 | gcov/ -------------------------------------------------------------------------------- /database/ngiflib/.gitignore: -------------------------------------------------------------------------------- 1 | /code 2 | /75b9920 3 | /latest 4 | /db19270 -------------------------------------------------------------------------------- /img/logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/img/logo.png -------------------------------------------------------------------------------- /img/table2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/img/table2.png -------------------------------------------------------------------------------- /img/table5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/img/table5.png -------------------------------------------------------------------------------- /img/table6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/img/table6.png -------------------------------------------------------------------------------- /database/re2/in/ip.txt: -------------------------------------------------------------------------------- 1 | Matches all valid IP addresses from 0.0.0.0 to 255.255.255.255 2 | -------------------------------------------------------------------------------- /paper/ccs25-full.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/paper/ccs25-full.pdf -------------------------------------------------------------------------------- /database/re2/in/ip.re: -------------------------------------------------------------------------------- 1 | ^((1?[\d]?[\d]|2([0-4][\d]|5[0-5]))[.]){3}(1?[\d]?[\d]|2([0-4][\d]|5[0-5]))$ -------------------------------------------------------------------------------- /processor/cxx/.clang-format: -------------------------------------------------------------------------------- 1 | BasedOnStyle: LLVM 2 | IndentWidth: 4 3 | TabWidth: 4 4 | UseTab: Never -------------------------------------------------------------------------------- /database/zlib/in/Duino.gz: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/zlib/in/Duino.gz -------------------------------------------------------------------------------- /database/lcms/in/alltags.icc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/lcms/in/alltags.icc -------------------------------------------------------------------------------- /database/libvpx/in/out8.webm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/libvpx/in/out8.webm -------------------------------------------------------------------------------- /database/libvpx/in/out9.webm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/libvpx/in/out9.webm -------------------------------------------------------------------------------- /database/zlib/in/Duino.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/zlib/in/Duino.zip -------------------------------------------------------------------------------- /database/c-ares/in/multi-indir: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/c-ares/in/multi-indir -------------------------------------------------------------------------------- /database/exiv2/in/not_kitty.bmp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/exiv2/in/not_kitty.bmp -------------------------------------------------------------------------------- /database/exiv2/in/not_kitty.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/exiv2/in/not_kitty.gif -------------------------------------------------------------------------------- /database/exiv2/in/not_kitty.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/exiv2/in/not_kitty.ico -------------------------------------------------------------------------------- /database/exiv2/in/not_kitty.jp2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/exiv2/in/not_kitty.jp2 -------------------------------------------------------------------------------- /database/exiv2/in/not_kitty.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/exiv2/in/not_kitty.jpg -------------------------------------------------------------------------------- /database/exiv2/in/not_kitty.jxr: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/exiv2/in/not_kitty.jxr -------------------------------------------------------------------------------- /database/exiv2/in/not_kitty.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/exiv2/in/not_kitty.png -------------------------------------------------------------------------------- /database/exiv2/in/not_kitty.tiff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/exiv2/in/not_kitty.tiff -------------------------------------------------------------------------------- /database/exiv2/in/not_kitty.webp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/exiv2/in/not_kitty.webp -------------------------------------------------------------------------------- /database/ffjpeg/in/not_kitty.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/ffjpeg/in/not_kitty.jpg -------------------------------------------------------------------------------- /database/libpng/in/not_kitty.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/libpng/in/not_kitty.png -------------------------------------------------------------------------------- /database/ngiflib/in/not_kitty.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/ngiflib/in/not_kitty.gif -------------------------------------------------------------------------------- /database/exiv2/in/not_kitty_icc.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/exiv2/in/not_kitty_icc.png -------------------------------------------------------------------------------- /database/exiv2/in/not_kitty_alpha.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/exiv2/in/not_kitty_alpha.png -------------------------------------------------------------------------------- /database/exiv2/in/not_kitty_gamma.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/exiv2/in/not_kitty_gamma.png -------------------------------------------------------------------------------- /database/libpng/in/not_kitty_alpha.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/libpng/in/not_kitty_alpha.png -------------------------------------------------------------------------------- /database/libpng/in/not_kitty_gamma.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/libpng/in/not_kitty_gamma.png -------------------------------------------------------------------------------- /database/libpng/in/not_kitty_icc.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/libpng/in/not_kitty_icc.png -------------------------------------------------------------------------------- /database/sqlite3/in/simple_queries.sql: -------------------------------------------------------------------------------- 1 | create table t1(one smallint); 2 | insert into t1 values(1); 3 | select * from t1; 4 | -------------------------------------------------------------------------------- /database/libjpeg-turbo/in/not_kitty.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/libjpeg-turbo/in/not_kitty.jpg -------------------------------------------------------------------------------- /database/libaom/in/soccer_cif_20f_q48.ivf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/libaom/in/soccer_cif_20f_q48.ivf -------------------------------------------------------------------------------- /database/libtiff/in/file_example_TIFF_1MB.tiff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/pvz122/PromeFuzz/HEAD/database/libtiff/in/file_example_TIFF_1MB.tiff -------------------------------------------------------------------------------- /src/prompt/learn_crash_constraint_fix.usr: -------------------------------------------------------------------------------- 1 | Please fix the crash and reply ONLY the fixed source code of the fuzz driver enclosed in triple backticks (```). -------------------------------------------------------------------------------- /database/libaom/install_deps.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | DEPS="yasm" 4 | if [ "$EUID" -eq 0 ]; then 5 | apt install $DEPS 6 | else 7 | sudo apt install $DEPS 8 | fi -------------------------------------------------------------------------------- /database/libpng/install_deps.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | DEPS="yasm" 4 | if [ "$EUID" -eq 0 ]; then 5 | apt install $DEPS 6 | else 7 | sudo apt install $DEPS 8 | fi -------------------------------------------------------------------------------- /database/libvpx/install_deps.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | DEPS="yasm" 4 | if [ "$EUID" -eq 0 ]; then 5 | apt install $DEPS 6 | else 7 | sudo apt install $DEPS 8 | fi -------------------------------------------------------------------------------- /src/prompt/generate_c_driver.sub: -------------------------------------------------------------------------------- 1 | {INDEX}. `{FUNCTION_NAME}` 2 | ​ {FUNCTION_USAGE} 3 | ​ Its signature is: 4 | ​ ```c 5 | {FUNCTION_SIGNATURE} 6 | ​ ``` 7 | -------------------------------------------------------------------------------- /database/lcms/install_deps.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | DEPS="libpsl-dev" 4 | if [ "$EUID" -eq 0 ]; then 5 | apt install $DEPS 6 | else 7 | sudo apt install $DEPS 8 | fi -------------------------------------------------------------------------------- /database/libming/install_deps.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | DEPS="bison flex" 4 | if [ "$EUID" -eq 0 ]; then 5 | apt install $DEPS 6 | else 7 | sudo apt install $DEPS 8 | fi -------------------------------------------------------------------------------- /database/ngiflib/install_deps.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | DEPS="libsdl1.2-dev" 4 | if [ "$EUID" -eq 0 ]; then 5 | apt install $DEPS 6 | else 7 | sudo apt install $DEPS 8 | fi -------------------------------------------------------------------------------- /database/rapidcsv/hints.json: -------------------------------------------------------------------------------- 1 | { 2 | "ALL": "This library will throw exceptions in case of errors, make sure to use `catch (...)` to catch them when invoking API functions." 3 | } -------------------------------------------------------------------------------- /src/prompt/choose_relevant_functions.sub: -------------------------------------------------------------------------------- 1 | {INDEX}. `{FUNCTION_NAME}` 2 | {FUNCTION_PURPOSE} Its signature is: 3 | ```{LANGUAGE_TAG} 4 | {FUNCTION_SIGNATURE} 5 | ``` 6 | -------------------------------------------------------------------------------- /database/liblouis/install_deps.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | DEPS="autoconf libtool libyaml-dev" 4 | if [ "$EUID" -eq 0 ]; then 5 | apt install $DEPS 6 | else 7 | sudo apt install $DEPS 8 | fi -------------------------------------------------------------------------------- /database/re2/in/youtube.re: -------------------------------------------------------------------------------- 1 | (?:https?:)?(?:\/\/)?(?:[0-9A-Z-]+\.)?(?:youtu\.be\/|youtube(?:-nocookie)?\.com\S*?[^\w\s-])([\w-]{11})(?=[^\w-]|$)(?![?=&+%\w.-]*(?:['"][^<>]*>|<\/a>))[?=&+%\w.-]* -------------------------------------------------------------------------------- /database/curl/install_deps.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | DEPS="libpsl-dev libssl-dev libzstd-dev" 4 | if [ "$EUID" -eq 0 ]; then 5 | apt install $DEPS 6 | else 7 | sudo apt install $DEPS 8 | fi -------------------------------------------------------------------------------- /src/prompt/deduce_library_purpose.usr: -------------------------------------------------------------------------------- 1 | Below are excerpts from documents. Please provide a summary of the library's purpose, starting your response with "{LIBRARY_NAME} is …". 2 | 3 | {DOC_EXCERPTS} -------------------------------------------------------------------------------- /database/exiv2/install_deps.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | DEPS="libinih-dev doxygen graphviz libfmt-dev" 4 | if [ "$EUID" -eq 0 ]; then 5 | apt install $DEPS 6 | else 7 | sudo apt install $DEPS 8 | fi -------------------------------------------------------------------------------- /database/libmagic/install_deps.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | DEPS="groff liblzma-dev libzstd-dev zlib1g-dev" 4 | if [ "$EUID" -eq 0 ]; then 5 | apt install $DEPS 6 | else 7 | sudo apt install $DEPS 8 | fi -------------------------------------------------------------------------------- /database/libpcap/install_deps.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | DEPS="groff flex bison libdbus-1-dev bsdextrautils" 4 | if [ "$EUID" -eq 0 ]; then 5 | apt install $DEPS 6 | else 7 | sudo apt install $DEPS 8 | fi -------------------------------------------------------------------------------- /src/prompt/generate_cpp_driver.sub: -------------------------------------------------------------------------------- 1 | {INDEX}. `{FUNCTION_NAME}` 2 | ​ {FUNCTION_USAGE} 3 | ​ {HELDBY_CLASS}Its signature is: 4 | ​ ```cpp 5 | {FUNCTION_SIGNATURE} 6 | ​ ``` 7 | {EXPLANATION} 8 | -------------------------------------------------------------------------------- /src/prompt/learn_crash_constraint_explain.usr: -------------------------------------------------------------------------------- 1 | Below are the fuzz driver you write and its crash report, please offer a concise explanation of the root cause of the crash, in 200 words. 2 | 3 | {CRASH_REPORT} -------------------------------------------------------------------------------- /database/libtiff/install_deps.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | DEPS="libjpeg-turbo8-dev libjbig-dev libzstd-dev liblzma-dev" 4 | if [ "$EUID" -eq 0 ]; then 5 | apt install $DEPS 6 | else 7 | sudo apt install $DEPS 8 | fi -------------------------------------------------------------------------------- /src/prompt/deduce_library_purpose.sys: -------------------------------------------------------------------------------- 1 | You are an expert in summarizing documents. Your task is to provide a clear and concise summary of the primary functions and purposes of the {LIBRARY_NAME} library, keeping the overview under 100 characters. -------------------------------------------------------------------------------- /database/svgpp/install_deps.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | DEPS="libboost-dev sphinx" 4 | if [ "$EUID" -eq 0 ]; then 5 | apt install $DEPS 6 | else 7 | sudo apt install $DEPS 8 | fi 9 | 10 | pip3 install sphinx_rtd_theme --break-system-packages -------------------------------------------------------------------------------- /setup.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | 3 | rm -r build 4 | mkdir -p build 5 | pushd build 6 | cmake ../ 7 | make || exit 1 8 | popd 9 | ./build/bin/preprocessor processor/cxx/example/example.cpp -o processor/cxx/example/example.json &> /dev/null || (echo "Test failed" && exit 1) -------------------------------------------------------------------------------- /src/prompt/fix_build_error.usr: -------------------------------------------------------------------------------- 1 | The fuzz driver you wrote can not compile, below is the error message given by the compiler: 2 | ``` 3 | {ERROR_MESSAGE} 4 | ``` 5 | Please fix the error and reply ONLY the content of the source code enclosed in triple backticks (```). -------------------------------------------------------------------------------- /src/prompt/choose_valuable_excerpts.usr: -------------------------------------------------------------------------------- 1 | Below are some excerpts from the library documents. Please respond with the numbers of the valuable excerpts, each on a new line, without additional information. If there are no valuable excerpts, reply with '0'. 2 | 3 | {DOC_EXCERPTS} -------------------------------------------------------------------------------- /src/prompt/deduce_func_usage_from_src.usr: -------------------------------------------------------------------------------- 1 | # Information about `{FUNCTION_NAME}` 2 | 3 | ## Function Signature 4 | 5 | ```{LANGUAGE_TAG} 6 | {FUNCTION_SIGNATURES} 7 | ``` 8 | 9 | ## Source Code 10 | 11 | ```{LANGUAGE_TAG} 12 | {FUNCTION_SOURCE_CODE} 13 | ``` 14 | -------------------------------------------------------------------------------- /src/prompt/fix_asan_error.usr: -------------------------------------------------------------------------------- 1 | The fuzz driver you wrote triggered an AddressSanitizer error, below is the error message given by the sanitizer: 2 | ``` 3 | {ERROR_MESSAGE} 4 | ``` 5 | Please fix the error and reply ONLY the content of the source code enclosed in triple backticks (```). -------------------------------------------------------------------------------- /database/re2/api_ban_list.json: -------------------------------------------------------------------------------- 1 | [ 2 | "database/re2/latest/code/re2/re2.h:850:6", 3 | "database/re2/latest/code/re2/re2.h:866:6", 4 | "database/re2/latest/code/re2/re2.h:762:14", 5 | "database/re2/latest/code/re2/re2.h:764:14", 6 | "database/re2/latest/code/re2/re2.h:766:14" 7 | ] -------------------------------------------------------------------------------- /processor/cxx/example/example.cpp: -------------------------------------------------------------------------------- 1 | #include "example.h" 2 | 3 | namespace my_namespace { 4 | class my_override : public my_abc { 5 | public: 6 | void my_virtual_func(int param) override { return; } 7 | }; 8 | bool my_func(my_typedef a, my_enum b) { return true; } 9 | } // namespace my_namespace -------------------------------------------------------------------------------- /examples/rapidcsv/build_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | 3 | cd /promefuzz 4 | clang++ /promefuzz/database/rapidcsv/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/rapidcsv/latest/out/fuzz_driver/synthesized_driver -fsanitize=fuzzer,address,undefined -g -I/promefuzz/database/rapidcsv/latest/code/src 5 | -------------------------------------------------------------------------------- /database/ffjpeg/CMakeLists.txt: -------------------------------------------------------------------------------- 1 | cmake_minimum_required(VERSION 3.0) 2 | 3 | PROJECT(ffjpeg) 4 | 5 | INCLUDE_DIRECTORIES( 6 | . 7 | ) 8 | 9 | ADD_LIBRARY(libffjpeg bitstr.c bmp.c color.c dct.c huffman.c jfif.c quant.c zigzag.c) 10 | ADD_EXECUTABLE(ffjpeg ffjpeg.c) 11 | TARGET_LINK_LIBRARIES(ffjpeg libffjpeg) 12 | 13 | -------------------------------------------------------------------------------- /src/prompt/deduce_func_usage_from_doc.usr: -------------------------------------------------------------------------------- 1 | # Information about `{FUNCTION_NAME}` 2 | 3 | ## Function Signature 4 | 5 | ```{LANGUAGE_TAG} 6 | {FUNCTION_SIGNATURES} 7 | ``` 8 | 9 | ## Source Code 10 | 11 | ```{LANGUAGE_TAG} 12 | {FUNCTION_SOURCE_CODE} 13 | ``` 14 | 15 | ## Documentation Excerpts 16 | 17 | {DOC_EXCERPTS} -------------------------------------------------------------------------------- /src/tests/test_Query.py: -------------------------------------------------------------------------------- 1 | from src.utils import setup_llm 2 | from src.llm.llm import LLMChat 3 | from pathlib import Path 4 | 5 | def run(arg): 6 | content = Path(arg).read_text() 7 | 8 | llm_client = setup_llm("gpt_4o_mini") 9 | chat = LLMChat(llm_client) 10 | response = chat.query(content) 11 | print(response) 12 | -------------------------------------------------------------------------------- /examples/cjson/build_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | 3 | cd /promefuzz 4 | clang++ /promefuzz/database/cjson/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/cjson/latest/out/fuzz_driver/synthesized_driver -fsanitize=fuzzer,address,undefined -g -I/promefuzz/database/cjson/latest/code database/cjson/latest/bin_asan/lib/libcjson.a 5 | -------------------------------------------------------------------------------- /src/prompt/analyze_crash.usr: -------------------------------------------------------------------------------- 1 | Below are the fuzz driver that triggers the crash and its crash report, please meticulously analyze them and offer a concise explanation of the crash. Start your response with "The crash is a Misuse in fuzz driver, below is the explanation." or "The crash is a Bug in library, below is the explanation." 2 | 3 | {CRASH_REPORT} -------------------------------------------------------------------------------- /examples/ffjpeg/build_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | 3 | cd /promefuzz 4 | clang /promefuzz/database/ffjpeg/latest/out/fuzz_driver/synthesized/*.c -o /promefuzz/database/ffjpeg/latest/out/fuzz_driver/synthesized_driver -fsanitize=fuzzer,address,undefined -g -I/promefuzz/database/ffjpeg/latest/code/src database/ffjpeg/latest/bin_asan/lib/libffjpeg.a 5 | -------------------------------------------------------------------------------- /examples/lcms/build_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | 3 | cd /promefuzz 4 | clang++ /promefuzz/database/lcms/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/lcms/latest/out/fuzz_driver/synthesized_driver -fsanitize=fuzzer,address,undefined -g -I/promefuzz/database/lcms/latest/code/include database/lcms/latest/bin_asan/lib/liblcms2.a 5 | -------------------------------------------------------------------------------- /examples/loguru/build_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | 3 | cd /promefuzz 4 | clang++ /promefuzz/database/loguru/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/loguru/latest/out/fuzz_driver/synthesized_driver -fsanitize=fuzzer,address,undefined -g -I/promefuzz/database/loguru/latest/code database/loguru/latest/bin_asan/lib/libloguru.a 5 | -------------------------------------------------------------------------------- /examples/tinygltf/build_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | 3 | cd /promefuzz 4 | clang++ /promefuzz/database/tinygltf/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/tinygltf/latest/out/fuzz_driver/synthesized_driver -fsanitize=fuzzer,address,undefined -g -I/promefuzz/database/tinygltf/latest/code database/tinygltf/latest/build_asan/libtinygltf.a 5 | -------------------------------------------------------------------------------- /database/pugixml/in/Stationary & Computer Mart - Despatch Note Import.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 1 6 | 31 7 | 8 | 9 | 10 | -------------------------------------------------------------------------------- /database/svgpp/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | mkdir build_$MODE 8 | pushd build_$MODE 9 | 10 | bear -- $CXX -g -c ../code/svgpp.cpp -I ../code/include -o svgpp.o || exit 1 11 | cp -r ../code/include ./ || exit 1 12 | 13 | popd 14 | 15 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /examples/liblouis/build_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | 3 | cd /promefuzz 4 | clang /promefuzz/database/liblouis/latest/out/fuzz_driver/synthesized/*.c -o /promefuzz/database/liblouis/latest/out/fuzz_driver/synthesized_driver -fsanitize=fuzzer,address,undefined -g -I/promefuzz/database/liblouis/latest/build_asan/liblouis database/liblouis/latest/bin_asan/lib/liblouis.a -lyaml 5 | -------------------------------------------------------------------------------- /examples/libvpx/build_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | 3 | cd /promefuzz 4 | clang /promefuzz/database/libvpx/latest/out/fuzz_driver/synthesized/*.c -o /promefuzz/database/libvpx/latest/out/fuzz_driver/synthesized_driver -fsanitize=fuzzer,address,undefined -g -I/promefuzz/database/libvpx/latest/code/vpx database/libvpx/latest/bin_asan/lib/libvpx.a -Idatabase/libvpx/latest/code 5 | -------------------------------------------------------------------------------- /examples/libmagic/build_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | 3 | cd /promefuzz 4 | clang /promefuzz/database/libmagic/latest/out/fuzz_driver/synthesized/*.c -o /promefuzz/database/libmagic/latest/out/fuzz_driver/synthesized_driver -fsanitize=fuzzer,address,undefined -g -I/promefuzz/database/libmagic/latest/build_asan/src database/libmagic/latest/bin_asan/lib/libmagic.a -llzma -lzstd -lz 5 | -------------------------------------------------------------------------------- /examples/ngiflib/build_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | 3 | cd /promefuzz 4 | clang /promefuzz/database/ngiflib/latest/out/fuzz_driver/synthesized/*.c -o /promefuzz/database/ngiflib/latest/out/fuzz_driver/synthesized_driver -fsanitize=fuzzer,address,undefined -I/promefuzz/database/ngiflib/latest/build_asan ./database/ngiflib/latest/bin_asan/lib/libngiflib.a -lSDL -I/usr/include/SDL 5 | -------------------------------------------------------------------------------- /examples/pugixml/build_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | 3 | cd /promefuzz 4 | clang++ /promefuzz/database/pugixml/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/pugixml/latest/out/fuzz_driver/synthesized_driver -fsanitize=fuzzer,address,undefined -g -I/promefuzz/database/pugixml/latest/code/src database/pugixml/latest/bin_asan/lib/libpugixml.a -DPUGIXML_NO_XCEPTIONS 5 | -------------------------------------------------------------------------------- /database/re2/in/cron.re: -------------------------------------------------------------------------------- 1 | ^\s*\#?\s*(?:(?:(?'mins'[0-5]?\d)(?:[-,](?&mins))*)|\*)(?:/\d{1,2})?\s+(?:(?:(?'hours'(?:2[0-3]|[01]?\d))(?:[-,](?&hours))*)|\*)(?:/\d{1,2})?\s+(?:(?:(?'dmon'(?:3[01]|[12]?\d))(?:[-,](?&dmon))*)|\*)(?:/\d{1,2})?\s+(?:(?:(?'mon'(?:1[0-2]|[1-9]))(?:[-,](?&mon))*)|\*)(?:/\d{1,2})?\s+(?:(?:(?'dow'(?:[0-6]|\b(?:mon|tue|wed|thu|fri|sat|sun)\b))(?:[-,](?&dow))*)|\*)(?:/\d{1,2})?\s+.+$ -------------------------------------------------------------------------------- /examples/c-ares/build_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | 3 | cd /promefuzz 4 | clang /promefuzz/database/c-ares/latest/out/fuzz_driver/synthesized/*.c -o /promefuzz/database/c-ares/latest/out/fuzz_driver/synthesized_driver -fsanitize=fuzzer,address,undefined -g -I/promefuzz/database/c-ares/latest/code/include database/c-ares/latest/bin_asan/lib/libcares.a -Idatabase/c-ares/latest/build_asan 5 | -------------------------------------------------------------------------------- /examples/libpcap/build_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | 3 | cd /promefuzz 4 | clang /promefuzz/database/libpcap/latest/out/fuzz_driver/synthesized/*.c -o /promefuzz/database/libpcap/latest/out/fuzz_driver/synthesized_driver -fsanitize=fuzzer,address,undefined -g -I/promefuzz/database/libpcap/latest/code/pcap database/libpcap/latest/build_asan/libpcap.a -Idatabase/libpcap/latest/code -ldbus-1 5 | -------------------------------------------------------------------------------- /examples/libpng/build_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | 3 | cd /promefuzz 4 | clang++ /promefuzz/database/libpng/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/libpng/latest/out/fuzz_driver/synthesized_driver -fsanitize=fuzzer,address,undefined -g -I/promefuzz/database/libpng/latest/code database/libpng/latest/bin_asan/lib/libpng16.a -Idatabase/libpng/latest/bin_asan/include -lz 5 | -------------------------------------------------------------------------------- /examples/zlib/build_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | 3 | cd /promefuzz 4 | clang /promefuzz/database/zlib/latest/out/fuzz_driver/synthesized/*.c -o /promefuzz/database/zlib/latest/out/fuzz_driver/synthesized_driver -fsanitize=fuzzer,address,undefined -g -I/promefuzz/database/zlib/latest/code database/zlib/latest/build_asan/libz.a -DHAVE_HIDDEN -DNO_FSEEKO -DZLIB_BUILD -DZLIB_DLL -D_LARGEFILE64_SOURCE=1 5 | -------------------------------------------------------------------------------- /examples/libaom/build_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | 3 | cd /promefuzz 4 | clang++ /promefuzz/database/libaom/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/libaom/latest/out/fuzz_driver/synthesized_driver -fsanitize=fuzzer,address,undefined -g -I/promefuzz/database/libaom/latest/code/aom database/libaom/latest/bin_asan/lib/libaom.a -Idatabase/libaom/latest/code -Idatabase/libaom/latest/code/aom 5 | -------------------------------------------------------------------------------- /database/ffjpeg/latest.diff: -------------------------------------------------------------------------------- 1 | diff --git a/src/Makefile b/src/Makefile 2 | index 0fb5d51..9e54481 100644 3 | --- a/src/Makefile 4 | +++ b/src/Makefile 5 | @@ -1,9 +1,9 @@ 6 | # makefile for ffjpeg project 7 | # written by rockcarry 8 | 9 | -CC = gcc 10 | -AR = ar 11 | -CCFLAGS = -Wall 12 | +CC ?= gcc 13 | +AR ?= ar 14 | +CFLAGS ?= -Wall 15 | 16 | OBJS = \ 17 | color.o \ 18 | -------------------------------------------------------------------------------- /examples/curl/build_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | 3 | cd /promefuzz 4 | clang++ /promefuzz/database/curl/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/curl/latest/out/fuzz_driver/synthesized_driver -fsanitize=fuzzer,address,undefined -g -I/promefuzz/database/curl/latest/code/include/curl database/curl/latest/bin_asan/lib/libcurl.a -Idatabase/curl/latest/code/include -lpsl -lzstd -lz -lcrypto -lssl 5 | -------------------------------------------------------------------------------- /src/prompt/learn_crash_constraint.sys: -------------------------------------------------------------------------------- 1 | {LIBRARY_PURPOSE} As an expert developer familiar with the {LIBRARY_NAME} library, you have developed a C/C++ fuzz driver that fuzzes this library, but the program crashes when running. Your task is to investigate the crash by answering the following questions: 2 | 3 | - What kind of crash is it? 4 | - Which part of the library is causing the crash? 5 | - What is the root cause of the crash? -------------------------------------------------------------------------------- /examples/libjpeg-turbo/build_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | 3 | cd /promefuzz 4 | clang++ /promefuzz/database/libjpeg-turbo/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/libjpeg-turbo/latest/out/fuzz_driver/synthesized_driver -fsanitize=fuzzer,address,undefined -g -I/promefuzz/database/libjpeg-turbo/latest/code/src database/libjpeg-turbo/latest/bin_asan/lib/libturbojpeg.a -Idatabase/libjpeg-turbo/latest/build_asan 5 | -------------------------------------------------------------------------------- /database/re2/in/email.re: -------------------------------------------------------------------------------- 1 | (?:[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*|"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])*")@(?:(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?|\[(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?|[a-z0-9-]*[a-z0-9]:(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21-\x5a\x53-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])+)\]) -------------------------------------------------------------------------------- /database/re2/install_deps.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | # sudo apt install libabsl-dev 4 | git clone https://github.com/abseil/abseil-cpp.git 5 | cd abseil-cpp 6 | # This version of abseil is compatible with re2 c84a140 7 | git checkout 735c86164a69141f33ccfcb20ecf1b9254be32a7 8 | cp ../disable_abseil_debug.patch . 9 | git apply disable_abseil_debug.patch 10 | mkdir build && cd build 11 | cmake ../ -DCMAKE_INSTALL_PREFIX=../bin 12 | make -j12 && make install -------------------------------------------------------------------------------- /examples/exiv2/build_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | 3 | cd /promefuzz 4 | clang++ /promefuzz/database/exiv2/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/exiv2/latest/out/fuzz_driver/synthesized_driver -fsanitize=fuzzer,address,undefined -g -I/promefuzz/database/exiv2/latest/code/include/exiv2 database/exiv2/latest/bin_asan/lib/libexiv2.a -Idatabase/exiv2/latest/code/include -Idatabase/exiv2/latest/build_asan -lfmt -lexpat -lz -lINIReader 5 | -------------------------------------------------------------------------------- /processor/cxx/CMakeLists.txt: -------------------------------------------------------------------------------- 1 | set(LLVM_LINK_COMPONENTS support) 2 | 3 | add_executable(preprocessor 4 | preprocessor.cc 5 | ) 6 | 7 | add_executable(cgprocessor 8 | cgprocessor.cc 9 | ) 10 | 11 | target_link_libraries(preprocessor 12 | PRIVATE 13 | clangTooling 14 | clangBasic 15 | clangASTMatchers 16 | ) 17 | 18 | target_link_libraries(cgprocessor 19 | PRIVATE 20 | clangTooling 21 | clangBasic 22 | clangASTMatchers 23 | ) -------------------------------------------------------------------------------- /database/libvpx/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | mkdir build_$MODE 8 | pushd build_$MODE 9 | 10 | ../code/configure --prefix=$PWD/../bin_$MODE 11 | if [[ $MODE == "asan" ]]; then 12 | bear -- make -j$JOBS || exit 1 13 | else 14 | make -j$JOBS || exit 1 15 | fi 16 | 17 | make install || exit 1 18 | 19 | popd 20 | 21 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /src/prompt/deduce_func_usage_from_src.sys: -------------------------------------------------------------------------------- 1 | As an experienced programmer familiar with the {LIBRARY_NAME} library, you are required to analyze a particular API function's purpose and usage according to the given source code. Reflect on: 2 | 3 | - What is the API function's design aim? 4 | - How should the function be used? 5 | - How does it behave in various scenarios? 6 | 7 | Incorporate pertinent details in your reply. Don't add uncertain information. Be concise (under 300 characters). -------------------------------------------------------------------------------- /examples/libtiff/build_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | 3 | cd /promefuzz 4 | clang /promefuzz/database/libtiff/latest/out/fuzz_driver/synthesized/*.c -o /promefuzz/database/libtiff/latest/out/fuzz_driver/synthesized_driver -fsanitize=fuzzer,address,undefined -g -I/promefuzz/database/libtiff/latest/code/libtiff -Idatabase/libtiff/latest/bin_asan/include database/libtiff/latest/bin_asan/lib/libtiff.a database/libtiff/latest/bin_asan/lib/libtiffxx.a -lz -ljpeg -ljbig -llzma -lzstd 5 | -------------------------------------------------------------------------------- /database/libaom/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | mkdir build_$MODE 8 | pushd build_$MODE 9 | 10 | cmake ../code -DCMAKE_INSTALL_PREFIX=$PWD/../bin_$MODE 11 | 12 | if [[ $MODE == "asan" ]]; then 13 | bear -- make -j$JOBS || exit 1 14 | else 15 | make -j$JOBS || exit 1 16 | fi 17 | 18 | 19 | make install || exit 1 20 | 21 | popd 22 | 23 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /database/loguru/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | mkdir build_$MODE 8 | pushd build_$MODE 9 | 10 | cmake ../code -DCMAKE_INSTALL_PREFIX=$PWD/../bin_$MODE 11 | 12 | if [[ $MODE == "asan" ]]; then 13 | bear -- make -j$JOBS || exit 1 14 | else 15 | make -j$JOBS || exit 1 16 | fi 17 | 18 | 19 | make install || exit 1 20 | 21 | popd 22 | 23 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /src/prompt/choose_relevant_functions.usr: -------------------------------------------------------------------------------- 1 | The target function is `{TARGET_FUNCTION_NAME}`. {TARGET_FUNCTION_PURPOSE} Its signature is as follows: 2 | 3 | ```{LANGUAGE_TAG} 4 | {TARGET_FUNCTION_SIGNATURE} 5 | ``` 6 | 7 | The list of candidate functions from the library is: 8 | 9 | {CANDIDATE_FUNCTIONS} 10 | 11 | Please list the index number of any relevant functions from the candidate list, each on a new line, without any explanation. If there are no relevant functions, please enter '0'. -------------------------------------------------------------------------------- /database/libpng/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | mkdir build_$MODE 8 | pushd build_$MODE 9 | 10 | ../code/configure --prefix=$PWD/../bin_$MODE --enable-static 11 | 12 | if [[ $MODE == "asan" ]]; then 13 | bear -- make -j$JOBS || exit 1 14 | else 15 | make -j$JOBS || exit 1 16 | fi 17 | 18 | 19 | make install || exit 1 20 | 21 | popd 22 | 23 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /database/cre2/install_deps.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | DEPS="texinfo autoconf libtool" 4 | if [ "$EUID" -eq 0 ]; then 5 | apt install $DEPS 6 | else 7 | sudo apt install $DEPS 8 | fi 9 | 10 | # libabsl must be installed muanually 11 | git clone https://github.com/abseil/abseil-cpp.git 12 | cd abseil-cpp 13 | cp ../disable_abseil_debug.patch . 14 | git apply disable_abseil_debug.patch 15 | mkdir build && cd build 16 | cmake ../ -DCMAKE_INSTALL_PREFIX=../bin 17 | make -j12 && make install 18 | -------------------------------------------------------------------------------- /database/lcms/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | mkdir build_$MODE 8 | pushd build_$MODE 9 | 10 | ../code/configure --prefix=$PWD/../bin_$MODE --enable-static --disable-shared 11 | if [[ $MODE == "asan" ]]; then 12 | bear -- make -j$JOBS || exit 1 13 | else 14 | make -j$JOBS || exit 1 15 | fi 16 | 17 | make install || exit 1 18 | 19 | popd 20 | 21 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /database/liblouis/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | mkdir build_$MODE 8 | pushd build_$MODE 9 | 10 | ../code/configure --prefix=$PWD/../bin_$MODE --enable-static --disable-shared 11 | if [[ $MODE == "asan" ]]; then 12 | bear -- make -j$JOBS || exit 1 13 | else 14 | make -j$JOBS || exit 1 15 | fi 16 | 17 | make install || exit 1 18 | 19 | popd 20 | 21 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /src/prompt/generate_c_driver.usr: -------------------------------------------------------------------------------- 1 | Task: Write a C fuzz driver program to fuzz the library {LIBRARY_NAME} using the information provided below. Reply with only the content of the C source file enclosed in triple backticks (```), without any additional explanation. 2 | 3 | ## Target API Functions 4 | 5 | {TARGET_FUNCTIONS} 6 | 7 | ## Related Data Types 8 | 9 | ```c 10 | {DATA_DEFINITIONS} 11 | ``` 12 | 13 | ## Required Header Files 14 | 15 | You need to include {HEADERS} to invoke functions above. -------------------------------------------------------------------------------- /database/zlib/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | mkdir build_$MODE 8 | pushd build_$MODE 9 | 10 | cmake ../code -DCMAKE_BUILD_TYPE=Debug -DCMAKE_INSTALL_PREFIX=$PWD/../bin_$MODE 11 | 12 | if [[ $MODE == "asan" ]]; then 13 | bear -- make -j$JOBS || exit 1 14 | else 15 | make -j$JOBS || exit 1 16 | fi 17 | 18 | make install || exit 1 19 | 20 | popd 21 | 22 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /src/prompt/choose_valuable_excerpts.sys: -------------------------------------------------------------------------------- 1 | You are an expert in the {LIBRARY_NAME} library. You will receive excerpts from the library's documentation. Your task is to identify which excerpts describe the API function {FUNCTION_NAME}. Consider the following questions: 2 | 3 | - Does the excerpt explain the function's purpose? 4 | - Does it detail how the function is utilized? 5 | - Does it include any code examples that call the function? 6 | 7 | If any of these criteria are met, the excerpt is deemed valuable. -------------------------------------------------------------------------------- /database/c-ares/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | mkdir build_$MODE 8 | pushd build_$MODE 9 | 10 | cmake ../code -DCMAKE_INSTALL_PREFIX=$PWD/../bin_$MODE -DCARES_STATIC=ON 11 | 12 | if [[ $MODE == "asan" ]]; then 13 | bear -- make -j$JOBS || exit 1 14 | else 15 | make -j$JOBS || exit 1 16 | fi 17 | 18 | 19 | make install || exit 1 20 | 21 | popd 22 | 23 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /database/curl/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | mkdir build_$MODE 8 | pushd build_$MODE 9 | 10 | ../code/configure --with-openssl --prefix=$PWD/../bin_$MODE --enable-static --disable-shared 11 | if [[ $MODE == "asan" ]]; then 12 | bear -- make -j$JOBS || exit 1 13 | else 14 | make -j$JOBS || exit 1 15 | fi 16 | 17 | make install || exit 1 18 | 19 | popd 20 | 21 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /database/libjpeg-turbo/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | mkdir build_$MODE 8 | pushd build_$MODE 9 | 10 | cmake ../code -DCMAKE_INSTALL_PREFIX=$PWD/../bin_$MODE -DENABLE_STATIC=1 11 | 12 | if [[ $MODE == "asan" ]]; then 13 | bear -- make -j$JOBS || exit 1 14 | else 15 | make -j$JOBS || exit 1 16 | fi 17 | 18 | 19 | make install || exit 1 20 | 21 | popd 22 | 23 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /database/pugixml/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | mkdir build_$MODE 8 | pushd build_$MODE 9 | 10 | cmake ../code -DCMAKE_BUILD_TYPE=Debug -DCMAKE_INSTALL_PREFIX=$PWD/../bin_$MODE 11 | 12 | if [[ $MODE == "asan" ]]; then 13 | bear -- make -j$JOBS || exit 1 14 | else 15 | make -j$JOBS || exit 1 16 | fi 17 | 18 | 19 | make install || exit 1 20 | 21 | popd 22 | 23 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /database/cjson/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | mkdir build_$MODE 8 | pushd build_$MODE 9 | 10 | cmake ../code -DCMAKE_INSTALL_PREFIX=$PWD/../bin_$MODE -DBUILD_SHARED_AND_STATIC_LIBS=ON 11 | 12 | if [[ $MODE == "asan" ]]; then 13 | bear -- make -j$JOBS || exit 1 14 | else 15 | make -j$JOBS || exit 1 16 | fi 17 | 18 | 19 | make install || exit 1 20 | 21 | popd 22 | 23 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /src/prompt/learn_crash_constraint_learn.usr: -------------------------------------------------------------------------------- 1 | The crash involves the API function(s) {RELATED_API_FUNCTIONS} within the {LIBRARY_NAME} library. Please assess whether the crash resulted from the misuse of the mentioned API function(s). If it is a misuse, provide suggestions for invoking the API(s) to prevent future crashes. Otherwise, simply respond with "null". If suggestions are provided, format them in JSON as follows: `{{"api_function_a": "suggestion_to_invoke_function_a", "api_function_b": "suggestion_to_invoke_function_b"}}`. -------------------------------------------------------------------------------- /src/prompt/analyze_crash.sys: -------------------------------------------------------------------------------- 1 | {LIBRARY_PURPOSE} As an expert developer familiar with the {LIBRARY_NAME} library, you encounter a crash when running fuzz test for the library. Your task is to investigate the crash by answering the following questions: 2 | 3 | - What kind of crash is it? 4 | - Which part of the library is causing the crash? 5 | - What is the root cause of the crash? 6 | - Is the crash due to a bug in the library or misusing? 7 | 8 | If you have any ambiguity about the crash, please point it out and do not make any assumptions. -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | .vscode 2 | .cache 3 | .DS_Store 4 | /data 5 | /logs 6 | /out 7 | 8 | # Byte-compiled / optimized / DLL files 9 | __pycache__/ 10 | *.py[cod] 11 | *$py.class 12 | 13 | # Distribution / packaging 14 | .Python 15 | build/ 16 | dist/ 17 | 18 | # Environments 19 | .env 20 | .venv 21 | env/ 22 | venv/ 23 | ENV/ 24 | env.bak/ 25 | venv.bak/ 26 | Pipfile.lock 27 | uv.lock 28 | *.egg-info/ 29 | 30 | # Configurations 31 | config.toml 32 | libraries.toml 33 | 34 | # Debug & Log 35 | library/ 36 | /*.json 37 | /test* 38 | report-*.md -------------------------------------------------------------------------------- /database/cjson/lib.toml: -------------------------------------------------------------------------------- 1 | [cjson] 2 | language = "c" 3 | compile_commands_path = "database/cjson/latest/build_asan/compile_commands.json" 4 | document_paths = ["database/cjson/latest/code/README.md"] 5 | document_has_api_usage = false 6 | output_path = "database/cjson/latest/out" 7 | header_paths = ["database/cjson/latest/code/cJSON.h"] 8 | driver_build_args = ["database/cjson/latest/bin_asan/lib/libcjson.a"] 9 | consumer_case_paths = [ 10 | "database/cjson/latest/code/tests", 11 | "database/cjson/latest/code/fuzzing" 12 | ] 13 | -------------------------------------------------------------------------------- /src/prompt/README.md: -------------------------------------------------------------------------------- 1 | All prompt templates are stored in this directory. Each prompt template is a markdown file that contains the format string for the prompt. The format string is a string that contains placeholders for the various components of the prompt. The placeholders are replaced with the actual values when the prompt is rendered. 2 | 3 | They are categorized into three types by their suffixes: 4 | 5 | - `.sys`: System prompt templates 6 | - `.usr`: User prompt templates 7 | - `.sub`: Sub templates inside the user prompt templates 8 | -------------------------------------------------------------------------------- /database/libtiff/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | pushd code 7 | ./autogen.sh 8 | popd 9 | 10 | rm -rf build_$MODE bin_$MODE 11 | mkdir build_$MODE 12 | pushd build_$MODE 13 | 14 | ../code/configure --prefix=$PWD/../bin_$MODE --enable-static --disable-shared 15 | if [[ $MODE == "asan" ]]; then 16 | bear -- make -j$JOBS || exit 1 17 | else 18 | make -j$JOBS || exit 1 19 | fi 20 | make install || exit 1 21 | 22 | popd 23 | 24 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /database/tinygltf/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | mkdir build_$MODE 8 | pushd build_$MODE 9 | 10 | cmake ../code -DCMAKE_BUILD_TYPE=Debug -DCMAKE_INSTALL_PREFIX=$PWD/../bin_$MODE -DTINYGLTF_BUILD_LOADER_EXAMPLE=OFF 11 | 12 | if [[ $MODE == "asan" ]]; then 13 | make -j$JOBS || exit 1 14 | else 15 | make -j$JOBS || exit 1 16 | fi 17 | 18 | 19 | make install || exit 1 20 | 21 | popd 22 | 23 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /database/pugixml/in/Stationary & Computer Mart - Goods Recieved Notes Import.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 123456 6 | MCN001 7 | GoodsReceivedNote 8 | 38 9 | PROJ006 10 | 2012-10-03T10:00:00 11 | PC005 12 | 1.00 13 | 780.41 14 | 15 | 16 | 17 | -------------------------------------------------------------------------------- /database/loguru/lib.toml: -------------------------------------------------------------------------------- 1 | [loguru] 2 | language = "c++" 3 | compile_commands_path = "database/loguru/latest/build_asan/compile_commands.json" 4 | document_paths = ["database/loguru/latest/code/README.md"] 5 | document_has_api_usage = true 6 | output_path = "database/loguru/latest/out" 7 | header_paths = ["database/loguru/latest/code/loguru.hpp"] 8 | driver_build_args = ["database/loguru/latest/bin_asan/lib/libloguru.a"] 9 | consumer_case_paths = [ 10 | "database/loguru/latest/code/test", 11 | "database/loguru/latest/code/loguru_example" 12 | ] 13 | -------------------------------------------------------------------------------- /database/rapidcsv/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | ../../srclink.py code build_$MODE 8 | pushd build_$MODE 9 | 10 | if [[ $MODE == "asan" ]]; then 11 | bear -- $CXX $CXXFLAGS -c src/rapidcsv.cpp -o rapidcsv.o || exit 1 12 | else 13 | $CXX $CXXFLAGS -c src/rapidcsv.cpp -o rapidcsv.o || exit 1 14 | fi 15 | 16 | popd 17 | mkdir -p bin_$MODE/include 18 | cp build_$MODE/src/rapidcsv.h bin_$MODE/include 19 | 20 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /database/re2/in/cron.txt: -------------------------------------------------------------------------------- 1 | 00 11, 16 * * * /home/maverick/bin/incremental-backup 2 | 00 – 0th Minute (Top of the hour) 11, 16 – 11 AM and 4 PM * – Every day * – Every month * – Every day of the week 3 | 6. To Schedule a Job for a Within Certain Range of Time (e.g. Only on Weekdays): 4 | 00 09-18 * * * /home/maverick/bin/check-db-status 5 | 00 09-18 * * 1-5 /home/maverick/bin/check-db-status 6 | 00 – 0th Minute (Top of the hour) 09-18 – 9 am, 10 am, 11 am, 12 am, 1 pm, 2 pm, 3 pm, 4 pm, 5 pm, 6 pm * – Every day * – Every month 1-5 -Mon, Tue, Wed, Thu and Fri (Every Weekday) -------------------------------------------------------------------------------- /database/pugixml/lib.toml: -------------------------------------------------------------------------------- 1 | [pugixml] 2 | language = "c++" 3 | compile_commands_path = "database/pugixml/latest/build_asan/compile_commands.json" 4 | document_paths = ["https://pugixml.org/docs/manual.html"] 5 | document_has_api_usage = true 6 | output_path = "database/pugixml/latest/out" 7 | header_paths = ["database/pugixml/latest/code/src/pugixml.hpp"] 8 | driver_build_args = ["database/pugixml/latest/bin_asan/lib/libpugixml.a", "-DPUGIXML_NO_EXCEPTIONS"] 9 | consumer_case_paths = ["database/pugixml/latest/code/tests"] 10 | api_hints_path = "database/pugixml/api_hints.json" -------------------------------------------------------------------------------- /database/libaom/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | COMMIT_ID="$1" 4 | REPO_URL="https://aomedia.googlesource.com/aom" 5 | 6 | git clone "$REPO_URL" code 7 | if [ $? -ne 0 ]; then 8 | echo "Failed to clone repository. Exiting." 9 | exit 1 10 | fi 11 | 12 | if [ -n "$COMMIT_ID" ]; then 13 | cd code 14 | git checkout "$COMMIT_ID" 15 | if [ $? -ne 0 ]; then 16 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 17 | exit 1 18 | fi 19 | cd .. 20 | fi 21 | 22 | mkdir latest 23 | mv code latest 24 | 25 | cp ./build.sh ./lib.toml latest 26 | -------------------------------------------------------------------------------- /database/loguru/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | COMMIT_ID="$1" 4 | REPO_URL="https://github.com/emilk/loguru.git" 5 | 6 | git clone "$REPO_URL" code 7 | if [ $? -ne 0 ]; then 8 | echo "Failed to clone repository. Exiting." 9 | exit 1 10 | fi 11 | 12 | if [ -n "$COMMIT_ID" ]; then 13 | cd code 14 | git checkout "$COMMIT_ID" 15 | if [ $? -ne 0 ]; then 16 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 17 | exit 1 18 | fi 19 | cd .. 20 | fi 21 | 22 | mkdir latest 23 | mv code latest 24 | 25 | cp ./build.sh ./lib.toml latest 26 | -------------------------------------------------------------------------------- /database/rapidcsv/lib.toml: -------------------------------------------------------------------------------- 1 | [rapidcsv] 2 | language = "c++" 3 | header_paths = ["database/rapidcsv/latest/code/src/rapidcsv.h"] 4 | compile_commands_path = "database/rapidcsv/latest/build_asan/compile_commands.json" 5 | document_paths = ["database/rapidcsv/latest/code/README.md"] 6 | document_has_api_usage = true 7 | output_path = "database/rapidcsv/latest/out" 8 | driver_build_args = [] 9 | source_paths = [] 10 | exclude_paths = [] 11 | driver_headers = [] 12 | api_hints_path = "database/rapidcsv/hints.json" 13 | consumer_case_paths = ["database/rapidcsv/latest/code/tests"] 14 | -------------------------------------------------------------------------------- /database/zlib/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | COMMIT_ID="$1" 4 | REPO_URL="https://github.com/madler/zlib.git" 5 | 6 | git clone "$REPO_URL" code 7 | if [ $? -ne 0 ]; then 8 | echo "Failed to clone repository. Exiting." 9 | exit 1 10 | fi 11 | 12 | if [ -n "$COMMIT_ID" ]; then 13 | cd code 14 | git checkout "$COMMIT_ID" 15 | if [ $? -ne 0 ]; then 16 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 17 | exit 1 18 | fi 19 | cd .. 20 | fi 21 | 22 | mkdir latest 23 | mv code latest 24 | 25 | cp ./build.sh ./lib.toml latest 26 | -------------------------------------------------------------------------------- /database/libpng/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | COMMIT_ID="$1" 4 | REPO_URL="https://github.com/pnggroup/libpng.git" 5 | 6 | git clone "$REPO_URL" code 7 | if [ $? -ne 0 ]; then 8 | echo "Failed to clone repository. Exiting." 9 | exit 1 10 | fi 11 | 12 | if [ -n "$COMMIT_ID" ]; then 13 | cd code 14 | git checkout "$COMMIT_ID" 15 | if [ $? -ne 0 ]; then 16 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 17 | exit 1 18 | fi 19 | cd .. 20 | fi 21 | 22 | mkdir latest 23 | mv code latest 24 | 25 | cp ./build.sh ./lib.toml latest 26 | -------------------------------------------------------------------------------- /database/libvpx/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | COMMIT_ID="$1" 4 | REPO_URL="https://github.com/webmproject/libvpx.git" 5 | 6 | git clone "$REPO_URL" code 7 | if [ $? -ne 0 ]; then 8 | echo "Failed to clone repository. Exiting." 9 | exit 1 10 | fi 11 | 12 | if [ -n "$COMMIT_ID" ]; then 13 | cd code 14 | git checkout "$COMMIT_ID" 15 | if [ $? -ne 0 ]; then 16 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 17 | exit 1 18 | fi 19 | cd .. 20 | fi 21 | 22 | mkdir latest 23 | mv code latest 24 | 25 | cp ./build.sh ./lib.toml latest 26 | -------------------------------------------------------------------------------- /database/sqlite3/Makefile: -------------------------------------------------------------------------------- 1 | CC ?= gcc 2 | AR ?= ar 3 | CFLAGS ?= -O2 -fPIC 4 | INSTALL_PREFIX ?= /usr/local 5 | 6 | all: libsqlite3.a 7 | 8 | libsqlite3.a: sqlite3.o 9 | $(AR) rcs $@ $^ 10 | 11 | sqlite3.o: sqlite3.c 12 | $(CC) $(CFLAGS) -c $< -o $@ 13 | 14 | install: libsqlite3.a sqlite3.h 15 | install -d $(INSTALL_PREFIX)/lib $(INSTALL_PREFIX)/include 16 | install -m 644 libsqlite3.a $(INSTALL_PREFIX)/lib/ 17 | install -m 644 sqlite3.h $(INSTALL_PREFIX)/include/ 18 | install -m 644 sqlite3ext.h $(INSTALL_PREFIX)/include/ 19 | 20 | clean: 21 | rm -f sqlite3.o libsqlite3.a 22 | -------------------------------------------------------------------------------- /database/lcms/lib.toml: -------------------------------------------------------------------------------- 1 | [lcms] 2 | language = "c" 3 | compile_commands_path = "database/lcms/latest/build_asan/compile_commands.json" 4 | document_paths = [ 5 | "database/lcms/latest/code/README.md", 6 | # "database/lcms/latest/code/doc", 7 | ] 8 | document_has_api_usage = false 9 | output_path = "database/lcms/latest/out" 10 | header_paths = ["database/lcms/latest/code/include"] 11 | driver_build_args = ["database/lcms/latest/bin_asan/lib/liblcms2.a"] 12 | consumer_case_paths = [ 13 | "database/lcms/latest/code/fuzzers", 14 | "database/lcms/latest/code/testbed", 15 | ] 16 | -------------------------------------------------------------------------------- /database/re2/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | mkdir build_$MODE 8 | pushd build_$MODE 9 | 10 | cmake ../code -DCMAKE_INSTALL_PREFIX=$PWD/../bin_$MODE -DCMAKE_PREFIX_PATH=$PWD/../../abseil-cpp/bin 11 | # ../code/configure --disable-shared --prefix=$PWD/../bin_$MODE 12 | if [[ $MODE == "asan" ]]; then 13 | bear -- make -j$JOBS || exit 1 14 | else 15 | make -j$JOBS || exit 1 16 | fi 17 | 18 | 19 | make install || exit 1 20 | 21 | popd 22 | 23 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /src/prompt/generate_cpp_driver.usr: -------------------------------------------------------------------------------- 1 | Task: Write a C++ fuzz driver program to fuzz the library {LIBRARY_NAME} using the information provided below. Reply with only the content of the C++ source file enclosed in triple backticks (```), without any additional explanation. 2 | 3 | ## Target API Functions 4 | 5 | {TARGET_FUNCTIONS} 6 | 7 | ## Related Data Types 8 | 9 | ```cpp 10 | {DATA_DEFINITIONS} 11 | ``` 12 | 13 | ## Related Constructor Methods 14 | 15 | ```cpp 16 | {CONSTRUCTORS} 17 | ``` 18 | 19 | ## Required Header Files 20 | 21 | You need to include {HEADERS} to invoke functions above. -------------------------------------------------------------------------------- /database/libjpeg-turbo/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | COMMIT_ID="$1" 4 | REPO_URL="https://github.com/libjpeg-turbo/libjpeg-turbo.git" 5 | 6 | git clone "$REPO_URL" code 7 | if [ $? -ne 0 ]; then 8 | echo "Failed to clone repository. Exiting." 9 | exit 1 10 | fi 11 | 12 | if [ -n "$COMMIT_ID" ]; then 13 | cd code 14 | git checkout "$COMMIT_ID" 15 | if [ $? -ne 0 ]; then 16 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 17 | exit 1 18 | fi 19 | cd .. 20 | fi 21 | 22 | mkdir latest 23 | mv code latest 24 | 25 | cp ./build.sh ./lib.toml latest 26 | -------------------------------------------------------------------------------- /src/prompt/deduce_func_usage_from_doc.sys: -------------------------------------------------------------------------------- 1 | As an experienced programmer familiar with the {LIBRARY_NAME} library, you are required to analyze a particular API function's purpose and usage according to the given source code and documentation. Reflect on: 2 | 3 | - What is the API function's design aim? 4 | - How should the function be used? 5 | - How does it behave in various scenarios? 6 | - Are there usage examples in the documentation? 7 | - Are there any concerns noted in the documentation? 8 | 9 | Incorporate pertinent details in your reply. Don't add uncertain information. Be concise (under 300 characters). -------------------------------------------------------------------------------- /database/cjson/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | # COMMIT_ID="12c4bf1" 4 | REPO_URL="https://github.com/DaveGamble/cJSON.git" 5 | COMMIT_ID="$1" 6 | 7 | git clone "$REPO_URL" code 8 | if [ $? -ne 0 ]; then 9 | echo "Failed to clone repository. Exiting." 10 | exit 1 11 | fi 12 | 13 | if [ -n "$COMMIT_ID" ]; then 14 | cd code 15 | git checkout "$COMMIT_ID" 16 | if [ $? -ne 0 ]; then 17 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 18 | exit 1 19 | fi 20 | cd .. 21 | fi 22 | 23 | mkdir latest 24 | mv code latest 25 | 26 | cp ./build.sh ./lib.toml latest 27 | -------------------------------------------------------------------------------- /database/ffjpeg/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | ../../srclink.py code build_$MODE 8 | pushd build_$MODE 9 | 10 | if [[ $MODE == "asan" ]]; then 11 | bear -- make -j$JOBS || exit 1 12 | else 13 | make -j$JOBS || exit 1 14 | fi 15 | 16 | popd 17 | mkdir -p bin_$MODE/bin 18 | mkdir -p bin_$MODE/lib 19 | mkdir -p bin_$MODE/include 20 | cp build_$MODE/src/ffjpeg bin_$MODE/bin 21 | cp build_$MODE/src/libffjpeg.a bin_$MODE/lib 22 | cp build_$MODE/src/*.h bin_$MODE/include 23 | 24 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /database/tinygltf/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | COMMIT_ID="$1" 4 | REPO_URL="https://github.com/syoyo/tinygltf.git" 5 | 6 | git clone "$REPO_URL" code 7 | if [ $? -ne 0 ]; then 8 | echo "Failed to clone repository. Exiting." 9 | exit 1 10 | fi 11 | 12 | if [ -n "$COMMIT_ID" ]; then 13 | cd code 14 | git checkout "$COMMIT_ID" 15 | if [ $? -ne 0 ]; then 16 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 17 | exit 1 18 | fi 19 | cd .. 20 | fi 21 | 22 | ./separate_del_and_impl.py code 23 | 24 | mkdir latest 25 | mv code latest 26 | 27 | cp ./build.sh ./lib.toml latest 28 | -------------------------------------------------------------------------------- /database/libmagic/api_hints.json: -------------------------------------------------------------------------------- 1 | { 2 | "magic_check": "This function requires a NEW `magic_set` structure as its parameter which can not be shared with other functions. To use it, first create a SEPARATE magic_set by calling `struct magic_set *magic_open(int flags)`, and clean up afterward by calling `void magic_close(struct magic_set *)`.", 3 | "magic_list": "This function requires a NEW `magic_set` structure as its parameter which can not be shared with other functions. To use it, first create a SEPARATE magic_set by calling `struct magic_set *magic_open(int flags)`, and clean up afterward by calling `void magic_close(struct magic_set *)`." 4 | } -------------------------------------------------------------------------------- /database/curl/lib.toml: -------------------------------------------------------------------------------- 1 | [curl] 2 | language = "c" 3 | compile_commands_path = "database/curl/latest/build_asan/compile_commands.json" 4 | document_paths = [ 5 | "database/curl/latest/code/README.md", 6 | "database/curl/latest/code/docs/libcurl", 7 | ] 8 | document_has_api_usage = true 9 | output_path = "database/curl/latest/out" 10 | header_paths = ["database/curl/latest/code/include/curl"] 11 | driver_build_args = [ 12 | "database/curl/latest/bin_asan/lib/libcurl.a", 13 | "-Idatabase/curl/latest/code/include", 14 | "-lpsl -lzstd -lz -lcrypto -lssl", 15 | ] 16 | consumer_case_paths = ["database/curl/latest/code/tests/unit"] 17 | -------------------------------------------------------------------------------- /database/exiv2/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | mkdir build_$MODE 8 | pushd build_$MODE 9 | 10 | cmake ../code -DCMAKE_INSTALL_PREFIX=$PWD/../bin_$MODE -DBUILD_SHARED_LIBS=OFF -DEXIV2_ENABLE_SHARED=OFF -DEXIV2_ENABLE_BROTLI=OFF -DEXIV2_BUILD_DOC=ON 11 | # ../code/configure --disable-shared --prefix=$PWD/../bin_$MODE 12 | if [[ $MODE == "asan" ]]; then 13 | bear -- make -j$JOBS || exit 1 14 | else 15 | make -j$JOBS || exit 1 16 | fi 17 | 18 | make doc 19 | make install || exit 1 20 | 21 | popd 22 | 23 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /src/prompt/choose_relevant_functions.sys: -------------------------------------------------------------------------------- 1 | {LIBRARY_PURPOSE} As an expert testing engineer, you need to evaluate the relevance of certain API functions in the {LIBRARY_NAME} library to a target function. Given the target function's signature and a list of other function signatures from the library, consider the following questions for each function: 2 | 3 | - Is the function designed to be used alongside the target function in certain scenarios? 4 | - Do the function and the target function influence each other in a way that could modify their behavior? 5 | 6 | If a function meets one or both of these criteria, it is considered relevant to the target function. -------------------------------------------------------------------------------- /database/exiv2/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | COMMIT_ID="$1" 4 | REPO_URL="https://github.com/Exiv2/exiv2.git" 5 | 6 | git clone "$REPO_URL" code 7 | if [ $? -ne 0 ]; then 8 | echo "Failed to clone repository. Exiting." 9 | exit 1 10 | fi 11 | 12 | if [ -n "$COMMIT_ID" ]; then 13 | cd code 14 | git checkout "$COMMIT_ID" 15 | if [ $? -ne 0 ]; then 16 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 17 | exit 1 18 | fi 19 | cd .. 20 | fi 21 | 22 | mkdir latest 23 | mv code latest 24 | 25 | cp ./build.sh ./lib.toml latest 26 | 27 | echo "Repository successfully cloned and copied to '$TARGET_DIR' and latest." -------------------------------------------------------------------------------- /database/libmagic/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | mkdir build_$MODE 8 | pushd build_$MODE 9 | 10 | ../code/configure --prefix=$PWD/../bin_$MODE --enable-static --disable-shared 11 | if [[ $MODE == "asan" ]]; then 12 | bear -- make -j$JOBS || exit 1 13 | else 14 | make -j$JOBS || exit 1 15 | fi 16 | 17 | make install || exit 1 18 | 19 | # Generate the manual documentation 20 | groff -mandoc -Tascii -rLL=9999n -P-c ../code/doc/libmagic.man | col -b | sed -E '/^[-=]+\t*$/d; s/\t+//g' > mandoc.txt 21 | 22 | popd 23 | 24 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /database/libtiff/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | COMMIT_ID="$1" 4 | REPO_URL="https://gitlab.com/libtiff/libtiff.git" 5 | 6 | git clone "$REPO_URL" code 7 | if [ $? -ne 0 ]; then 8 | echo "Failed to clone repository. Exiting." 9 | exit 1 10 | fi 11 | 12 | if [ -n "$COMMIT_ID" ]; then 13 | cd code 14 | git checkout "$COMMIT_ID" 15 | if [ $? -ne 0 ]; then 16 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 17 | exit 1 18 | fi 19 | cd .. 20 | fi 21 | 22 | mkdir latest 23 | mv code latest 24 | 25 | cp ./build.sh ./lib.toml latest 26 | 27 | echo "Repository successfully cloned and copied to '$TARGET_DIR' and latest." 28 | -------------------------------------------------------------------------------- /database/lcms/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | COMMIT_ID="$1" 4 | REPO_URL="https://github.com/mm2/Little-CMS.git" 5 | 6 | echo "Cloning repository..." 7 | git clone "$REPO_URL" code 8 | if [ $? -ne 0 ]; then 9 | echo "Failed to clone repository. Exiting." 10 | exit 1 11 | fi 12 | 13 | if [ -n "$COMMIT_ID" ]; then 14 | cd code 15 | git checkout "$COMMIT_ID" 16 | if [ $? -ne 0 ]; then 17 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 18 | exit 1 19 | fi 20 | cd .. 21 | fi 22 | 23 | mkdir latest 24 | mv code latest 25 | 26 | cp ./build.sh ./lib.toml latest 27 | 28 | echo "Repository successfully cloned and copied to latest." 29 | -------------------------------------------------------------------------------- /database/libpcap/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | mkdir build_$MODE 8 | pushd build_$MODE 9 | 10 | cmake ../code -DCMAKE_BUILD_TYPE=Debug -DCMAKE_INSTALL_PREFIX=$PWD/../bin_$MODE 11 | 12 | if [[ $MODE == "asan" ]]; then 13 | bear -- make -j$JOBS || exit 1 14 | else 15 | make -j$JOBS || exit 1 16 | fi 17 | 18 | 19 | make install || exit 1 20 | 21 | # make documents 22 | find $PWD/../bin_$MODE/share/man -type f | xargs groff -mandoc -Tascii -rLL=9999n -P-c | col -b | sed -E '/^[-=]+\t*$/d; s/\t+//g' > $PWD/mandoc.txt 23 | 24 | popd 25 | 26 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /database/ngiflib/lib.toml: -------------------------------------------------------------------------------- 1 | [ngiflib] 2 | language = "c" 3 | header_paths = ["./database/ngiflib/latest/build_asan"] 4 | compile_commands_path = "./database/ngiflib/latest/build_asan/compile_commands.json" 5 | document_paths = [ 6 | # "./database/ngiflib/latest/build_asan/readme.txt", 7 | "https://github.com/miniupnp/ngiflib", 8 | ] 9 | output_path = "./database/ngiflib/latest/out" 10 | driver_build_args = [ 11 | "./database/ngiflib/latest/bin_asan/lib/libngiflib.a", 12 | "-lSDL", 13 | "-I/usr/include/SDL", 14 | ] 15 | exclude_paths = [] 16 | driver_headers = [] 17 | consumer_case_paths = ["database/ngiflib/latest/code/gif2tga.c", "database/ngiflib/latest/code/gif2tga.c"] 18 | -------------------------------------------------------------------------------- /processor/cxx/example/example.h: -------------------------------------------------------------------------------- 1 | namespace my_namespace { 2 | 3 | template class my_template_class { 4 | public: 5 | T a; 6 | U b; 7 | T my_template_func(U u) { return a; } 8 | }; 9 | 10 | class my_abc { 11 | public: 12 | virtual void my_virtual_func(int param) = 0; 13 | }; 14 | 15 | struct my_struct { 16 | int x; 17 | int y; 18 | my_struct(int x, int y) : x(x), y(y) {} 19 | }; 20 | 21 | union my_union { 22 | my_struct s; 23 | int i; 24 | }; 25 | 26 | enum my_enum { A, B, C }; 27 | 28 | typedef my_template_class my_typedef; 29 | 30 | bool my_func(my_typedef a, my_enum b); 31 | 32 | } // namespace my_namespace -------------------------------------------------------------------------------- /database/cre2/disable_abseil_debug.patch: -------------------------------------------------------------------------------- 1 | diff --git a/absl/container/internal/raw_hash_set.h b/absl/container/internal/raw_hash_set.h 2 | index d8429d65..056b76b0 100644 3 | --- a/absl/container/internal/raw_hash_set.h 4 | +++ b/absl/container/internal/raw_hash_set.h 5 | @@ -234,7 +234,7 @@ namespace container_internal { 6 | // the control bytes and the slots. When iterators are dereferenced, we assert 7 | // that the container has not been mutated in a way that could cause iterator 8 | // invalidation since the iterator was initialized. 9 | -#define ABSL_SWISSTABLE_ENABLE_GENERATIONS 10 | +// #define ABSL_SWISSTABLE_ENABLE_GENERATIONS 11 | #endif 12 | 13 | #ifdef ABSL_SWISSTABLE_ASSERT 14 | -------------------------------------------------------------------------------- /database/libpng/lib.toml: -------------------------------------------------------------------------------- 1 | [libpng] 2 | language = "c++" 3 | compile_commands_path = "database/libpng/latest/build_asan/compile_commands.json" 4 | document_paths = ["database/libpng/latest/code/README"] 5 | document_has_api_usage = false 6 | output_path = "database/libpng/latest/out" 7 | header_paths = [ 8 | "database/libpng/latest/code/png.h", 9 | "database/libpng/latest/code/pngconf.h", 10 | "database/libpng/latest/build_asan/pnglibconf.h", 11 | ] 12 | driver_build_args = [ 13 | "database/libpng/latest/bin_asan/lib/libpng16.a", 14 | "-Idatabase/libpng/latest/bin_asan/include", 15 | "-lz", 16 | ] 17 | consumer_case_paths = ["database/libpng/latest/code/contrib/oss-fuzz"] 18 | -------------------------------------------------------------------------------- /database/re2/disable_abseil_debug.patch: -------------------------------------------------------------------------------- 1 | diff --git a/absl/container/internal/raw_hash_set.h b/absl/container/internal/raw_hash_set.h 2 | index d8429d65..056b76b0 100644 3 | --- a/absl/container/internal/raw_hash_set.h 4 | +++ b/absl/container/internal/raw_hash_set.h 5 | @@ -234,7 +234,7 @@ namespace container_internal { 6 | // the control bytes and the slots. When iterators are dereferenced, we assert 7 | // that the container has not been mutated in a way that could cause iterator 8 | // invalidation since the iterator was initialized. 9 | -#define ABSL_SWISSTABLE_ENABLE_GENERATIONS 10 | +// #define ABSL_SWISSTABLE_ENABLE_GENERATIONS 11 | #endif 12 | 13 | #ifdef ABSL_SWISSTABLE_ASSERT 14 | -------------------------------------------------------------------------------- /database/cjson/in/test1: -------------------------------------------------------------------------------- 1 | bf{ 2 | "glossary": { 3 | "title": "example glossary", 4 | "GlossDiv": { 5 | "title": "S", 6 | "GlossList": { 7 | "GlossEntry": { 8 | "ID": "SGML", 9 | "SortAs": "SGML", 10 | "GlossTerm": "Standard Generalized Markup Language", 11 | "Acronym": "SGML", 12 | "Abbrev": "ISO 8879:1986", 13 | "GlossDef": { 14 | "para": "A meta-markup language, used to create markup languages such as DocBook.", 15 | "GlossSeeAlso": ["GML", "XML"] 16 | }, 17 | "GlossSee": "markup" 18 | } 19 | } 20 | } 21 | } 22 | } 23 | -------------------------------------------------------------------------------- /requirements.txt: -------------------------------------------------------------------------------- 1 | # This file was autogenerated by uv via the following command: 2 | # uv pip compile pyproject.toml --output-file requirements.txt --no-deps --no-annotate 3 | bs4==0.0.2 4 | chardet==5.2.0 5 | chromadb==0.6.3 6 | click==8.1.7 7 | langchain-chroma==0.2.2 8 | langchain-community==0.3.17 9 | langchain-openai==0.3.6 10 | langchain-unstructured==0.1.6 11 | libtmux==0.44.2 12 | loguru==0.7.2 13 | markdown==3.7 14 | matplotlib==3.10.1 15 | ollama==0.4.7 16 | openai==1.63.2 17 | openpyxl==3.1.5 18 | parse==1.20.2 19 | tiktoken==0.9.0 20 | tomlkit==0.13.3 21 | tree-sitter==0.24.0 22 | tree-sitter-c==0.23.0 23 | tree-sitter-cpp==0.23.4 24 | tree-sitter-rust==0.23.2 25 | unstructured==0.16.21 26 | -------------------------------------------------------------------------------- /src/tests/test_LibPurpose.py: -------------------------------------------------------------------------------- 1 | from src.comprehender.knowledge import Knowledge 2 | from src.comprehender.comprehender import LibPurposeComprehender 3 | from src.utils import setup_rag, setup_llm 4 | from src import vars as global_vars 5 | from loguru import logger 6 | from pathlib import Path 7 | 8 | def run(): 9 | global_vars.library_name = "pugixml" 10 | 11 | llm = setup_llm("qwen_2_5_72b_remote") 12 | rag = setup_rag("embed_large", Path("out/test")) 13 | 14 | docs = Knowledge( 15 | document_paths=["https://pugixml.org/docs/manual.html"], 16 | rag=rag, 17 | ) 18 | 19 | comp = LibPurposeComprehender(llm, docs) 20 | 21 | logger.success(comp.comprehension()) -------------------------------------------------------------------------------- /src/prompt/learn_crash_constraint_reasoning_model.usr: -------------------------------------------------------------------------------- 1 | TASK: You will be provided with the fuzz driver and its crash report. The crash involves the API function(s) {RELATED_API_FUNCTIONS} within the {LIBRARY_NAME} library. Please assess whether the crash resulted from the misuse of the mentioned API function(s). If it is a misuse, provide suggestions for invoking the API(s) to prevent future crashes. 2 | 3 | OUTPUT FORMAT: If suggestions are provided, format them in JSON as follows: `{{"api_function_a": "suggestion_to_invoke_function_a", "api_function_b": "suggestion_to_invoke_function_b"}}`. Otherwise, simply respond with "null". Do not include any additional information. 4 | 5 | CRASH INFORMATION: 6 | 7 | {CRASH_REPORT} -------------------------------------------------------------------------------- /database/c-ares/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | REPO_URL="https://github.com/c-ares/c-ares.git" 4 | COMMIT_ID="$1" 5 | 6 | echo "Cloning repository..." 7 | git clone "$REPO_URL" code 8 | if [ $? -ne 0 ]; then 9 | echo "Failed to clone repository. Exiting." 10 | exit 1 11 | fi 12 | 13 | if [ -n "$COMMIT_ID" ]; then 14 | cd code 15 | git checkout "$COMMIT_ID" 16 | if [ $? -ne 0 ]; then 17 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 18 | exit 1 19 | fi 20 | cd .. 21 | fi 22 | 23 | mkdir latest 24 | # Modify the Makefile to receive LDFLAGS 25 | mv code latest 26 | 27 | cp ./build.sh ./lib.toml latest 28 | 29 | echo "Repository successfully cloned and copied to latest." -------------------------------------------------------------------------------- /database/liblouis/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | COMMIT_ID="$1" 4 | REPO_URL="https://github.com/liblouis/liblouis.git" 5 | 6 | git clone "$REPO_URL" code 7 | if [ $? -ne 0 ]; then 8 | echo "Failed to clone repository. Exiting." 9 | exit 1 10 | fi 11 | 12 | if [ -n "$COMMIT_ID" ]; then 13 | cd code 14 | git checkout "$COMMIT_ID" 15 | if [ $? -ne 0 ]; then 16 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 17 | exit 1 18 | fi 19 | cd .. 20 | fi 21 | 22 | mkdir latest 23 | mv code latest 24 | pushd latest/code && ./autogen.sh && popd || exit 25 | 26 | cp ./build.sh ./lib.toml latest 27 | 28 | echo "Repository successfully cloned and copied to '$TARGET_DIR' and latest." -------------------------------------------------------------------------------- /database/libming/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | COMMIT_ID="$1" 4 | REPO_URL="https://github.com/libming/libming.git" 5 | 6 | git clone "$REPO_URL" code 7 | if [ $? -ne 0 ]; then 8 | echo "Failed to clone repository. Exiting." 9 | exit 1 10 | fi 11 | 12 | if [ -n "$COMMIT_ID" ]; then 13 | cd code 14 | git checkout "$COMMIT_ID" 15 | if [ $? -ne 0 ]; then 16 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 17 | exit 1 18 | fi 19 | cd .. 20 | fi 21 | 22 | mkdir latest 23 | mv code latest 24 | pushd latest/code && ./autogen.sh && popd || exit 25 | 26 | cp ./build.sh ./lib.toml latest 27 | 28 | echo "Repository successfully cloned and copied to '$TARGET_DIR' and latest." -------------------------------------------------------------------------------- /database/curl/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | REPO_URL="https://github.com/curl/curl.git" 4 | COMMIT_ID="$1" 5 | 6 | echo "Cloning repository..." 7 | git clone "$REPO_URL" code 8 | if [ $? -ne 0 ]; then 9 | echo "Failed to clone repository. Exiting." 10 | exit 1 11 | fi 12 | 13 | if [ -n "$COMMIT_ID" ]; then 14 | cd code 15 | git checkout "$COMMIT_ID" 16 | if [ $? -ne 0 ]; then 17 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 18 | exit 1 19 | fi 20 | cd .. 21 | fi 22 | 23 | pushd code 24 | autoreconf -fi 25 | popd 26 | 27 | mkdir latest 28 | mv code latest 29 | 30 | cp ./build.sh ./lib.toml latest 31 | 32 | echo "Repository successfully cloned and copied to latest." 33 | -------------------------------------------------------------------------------- /database/libming/lib.toml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | [libming] 5 | 6 | language = "c" 7 | 8 | 9 | header_paths = [ 10 | "database/libming/latest/build_asan/src/ming.h", 11 | "database/libming/latest/code/mingpp.h", 12 | ] 13 | 14 | 15 | compile_commands_path = "database/libming/latest/build_asan/compile_commands.json" 16 | 17 | 18 | document_paths = ["database/libming/latest/code/README"] 19 | 20 | 21 | output_path = "database/libming/latest/out" 22 | 23 | 24 | driver_build_args = [ 25 | "database/libming/latest/bin_asan/lib/libming.a", 26 | "-lz -fcommon", 27 | ] 28 | 29 | 30 | exclude_paths = [] 31 | 32 | 33 | driver_headers = [] 34 | 35 | consumer_case_paths = ["database/libming/latest/code/test"] 36 | 37 | -------------------------------------------------------------------------------- /database/pugixml/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | COMMIT_ID="$1" 4 | REPO_URL="https://github.com/zeux/pugixml.git" 5 | 6 | echo "Cloning repository..." 7 | git clone "$REPO_URL" code 8 | if [ $? -ne 0 ]; then 9 | echo "Failed to clone repository. Exiting." 10 | exit 1 11 | fi 12 | 13 | if [ -n "$COMMIT_ID" ]; then 14 | cd code 15 | git checkout "$COMMIT_ID" 16 | if [ $? -ne 0 ]; then 17 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 18 | exit 1 19 | fi 20 | cd .. 21 | fi 22 | 23 | mkdir latest 24 | # Modify the Makefile to receive LDFLAGS 25 | mv code latest 26 | 27 | cp ./build.sh ./lib.toml latest 28 | 29 | echo "Repository successfully cloned and copied to latest." 30 | -------------------------------------------------------------------------------- /database/rapidcsv/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | COMMIT_ID="$1" 4 | REPO_URL="https://github.com/d99kris/rapidcsv.git" 5 | 6 | git clone "$REPO_URL" code 7 | if [ $? -ne 0 ]; then 8 | echo "Failed to clone repository. Exiting." 9 | exit 1 10 | fi 11 | 12 | if [ -n "$COMMIT_ID" ]; then 13 | cd code 14 | git checkout "$COMMIT_ID" 15 | if [ $? -ne 0 ]; then 16 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 17 | exit 1 18 | fi 19 | cd .. 20 | fi 21 | 22 | # since this is a single-header library, we add a source file to include the header 23 | echo '#include "rapidcsv.h"' > code/src/rapidcsv.cpp 24 | 25 | mkdir latest 26 | mv code latest 27 | 28 | cp ./build.sh ./lib.toml latest 29 | -------------------------------------------------------------------------------- /database/libjpeg-turbo/lib.toml: -------------------------------------------------------------------------------- 1 | [libjpeg-turbo] 2 | language = "c" 3 | compile_commands_path = "database/libjpeg-turbo/latest/build_asan/compile_commands.json" 4 | document_paths = [ 5 | "database/libjpeg-turbo/latest/code/README.md", 6 | "https://rawcdn.githack.com/libjpeg-turbo/libjpeg-turbo/main/doc/turbojpeg/group___turbo_j_p_e_g.html", 7 | ] 8 | document_has_api_usage = true 9 | output_path = "database/libjpeg-turbo/latest/out" 10 | header_paths = ["database/libjpeg-turbo/latest/code/src/turbojpeg.h"] 11 | driver_build_args = [ 12 | "database/libjpeg-turbo/latest/bin_asan/lib/libturbojpeg.a", 13 | "-Idatabase/libjpeg-turbo/latest/build_asan", 14 | ] 15 | consumer_case_paths = ["database/libjpeg-turbo/latest/code/fuzz"] 16 | -------------------------------------------------------------------------------- /database/ngiflib/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | ../../srclink.py code build_$MODE || ( echo "[ERROR]: No code folder find!" && exit 1 ) 8 | pushd build_$MODE 9 | 10 | if [[ $MODE == "asan" ]]; then 11 | bear -- make -j$JOBS || exit 1 12 | else 13 | make -j$JOBS || exit 1 14 | fi 15 | 16 | ar cru libngiflib.a *.o 17 | 18 | popd 19 | mkdir -p bin_$MODE/bin 20 | cp build_$MODE/gif2tga bin_$MODE/bin 21 | cp build_$MODE/SDLaffgif bin_$MODE/bin 22 | mkdir -p bin_$MODE/include 23 | cp build_$MODE/*.h bin_$MODE/include 24 | mkdir -p bin_$MODE/lib 25 | cp build_$MODE/libngiflib.a bin_$MODE/lib 26 | 27 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /src/tests/test_LittleChat.py: -------------------------------------------------------------------------------- 1 | from src.utils import setup_llm 2 | from src.llm.llm import LLMChat, ReasoningLLMClient 3 | 4 | # importing readline to enable arrow key navigation 5 | import readline 6 | 7 | 8 | def run(): 9 | llm_client = setup_llm("gpt_41nano") 10 | chat = LLMChat(llm_client) 11 | while True: 12 | try: 13 | user_input = input("> ") 14 | except KeyboardInterrupt: 15 | break 16 | if isinstance(llm_client, ReasoningLLMClient): 17 | response, reasoning = chat.query_reasoning(user_input) 18 | print("\033[90m" + reasoning + "\033[0m\n" + response) 19 | else: 20 | response = chat.query(user_input) 21 | print(response) 22 | -------------------------------------------------------------------------------- /database/re2/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | COMMIT_ID="$1" 4 | REPO_URL="https://github.com/google/re2.git" 5 | 6 | git clone "$REPO_URL" code 7 | if [ $? -ne 0 ]; then 8 | echo "Failed to clone repository. Exiting." 9 | exit 1 10 | fi 11 | 12 | if [ -n "$COMMIT_ID" ]; then 13 | cd code 14 | git checkout "$COMMIT_ID" 15 | if [ $? -ne 0 ]; then 16 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 17 | exit 1 18 | fi 19 | cd .. 20 | fi 21 | 22 | # popd 23 | mkdir latest 24 | mv code latest 25 | 26 | # cp ./build.sh "$TARGET_DIR" && cp ./lib-0.26.toml "$TARGET_DIR"/lib.toml 27 | cp ./build.sh ./lib.toml latest 28 | 29 | # echo "Repository successfully cloned and copied to '$TARGET_DIR' and latest." -------------------------------------------------------------------------------- /database/pugixml/in/Transactions - Bank Receipt.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 239 6 | 1 7 | BankReceipt 8 | 1200 9 | 2011-01-01T11:11:11 10 | 4000 11 | 239 12 | 13 |
Sale of goods on website
14 | 100 15 | 20 16 | 1 17 | 20 18 | 19 | 20 | 21 | -------------------------------------------------------------------------------- /examples/sqlite3/build_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | 3 | cd /promefuzz 4 | clang++ /promefuzz/database/sqlite3/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/sqlite3/latest/out/fuzz_driver/synthesized_driver -fsanitize=fuzzer,address,undefined -g -I/promefuzz/database/sqlite3/latest/code database/sqlite3/latest/bin_asan/lib/libsqlite3.a -DSQLITE_MAX_LENGTH=128000000 -DSQLITE_MAX_SQL_LENGTH=128000000 -DSQLITE_MAX_MEMORY=25000000 -DSQLITE_PRINTF_PRECISION_LIMIT=1048576 -DSQLITE_DEBUG=1 -DSQLITE_MAX_PAGE_COUNT=16384 -DSQLITE_ALLOW_URI_AUTHORITY -DSQLITE_ENABLE_API_ARMOR -DSQLITE_ENABLE_COLUMN_METADATA -DSQLITE_ENABLE_NORMALIZE -DSQLITE_ENABLE_PREUPDATE_HOOK -DSQLITE_ENABLE_SNAPSHOT -DSQLITE_ENABLE_STMT_SCANSTATUS -DSQLITE_ENABLE_UNLOCK_NOTIFY 5 | -------------------------------------------------------------------------------- /database/pugixml/in/Transaction with Bank Receipt.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 239 6 | 1 7 | BankReceipt 8 | 1200 9 | 2011-01-01T11:11:11 10 | 4000 11 | 239 12 | 13 |
Sale of goods on website
14 | 100 15 | 20 16 | 1 17 | 20 18 | 19 | 20 | 21 | -------------------------------------------------------------------------------- /src/tests/test_RAG.py: -------------------------------------------------------------------------------- 1 | from src.utils import setup_rag 2 | from pathlib import Path 3 | from loguru import logger 4 | from src.comprehender.dockeeper import Knowledge 5 | 6 | def run(): 7 | rag = setup_rag("embed_qwen_remote", Path("out/test")) 8 | 9 | docs = Knowledge( 10 | document_paths=["https://pugixml.org/docs/manual.html"], 11 | rag=rag, 12 | ) 13 | 14 | while True: 15 | query = input("Query: ") 16 | if query == "exit": 17 | break 18 | 19 | contents, locations = rag.retrieve(query, 4) 20 | i = 0 21 | for content, location in zip(contents, locations): 22 | i += 1 23 | logger.info(f"Result {i} of query \"{query}\" at location {location}:\n{content}") 24 | -------------------------------------------------------------------------------- /database/ffjpeg/lib.toml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | [ffjpeg] 5 | 6 | language = "c" 7 | 8 | 9 | header_paths = ["database/ffjpeg/latest/code/src"] 10 | 11 | 12 | compile_commands_path = "database/ffjpeg/latest/build_asan/compile_commands.json" 13 | 14 | 15 | document_paths = ["database/ffjpeg/latest/code/README"] 16 | 17 | 18 | output_path = "database/ffjpeg/latest/out" 19 | 20 | 21 | driver_build_args = ["database/ffjpeg/latest/bin_asan/lib/libffjpeg.a"] 22 | 23 | 24 | exclude_paths = [] 25 | 26 | 27 | driver_headers = [] 28 | 29 | consumer_case_paths = [ 30 | "database/ffjpeg/latest/code/src/ffjpeg.c", 31 | "database/ffjpeg/latest/code/src/huffman.c", 32 | "database/ffjpeg/latest/code/src/bmp.c" 33 | ] 34 | consumer_build_args = ["-D_TEST_HUFFMAN_", "-D_TEST_BMP_"] -------------------------------------------------------------------------------- /database/libming/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | mkdir build_$MODE 8 | pushd build_$MODE 9 | 10 | CFLAGS+=" -fcommon" 11 | if [[ $MODE == "aflpp" ]]; then 12 | export AFL_USE_ASAN=0 13 | CFLAGS+=" -fsanitize=address" 14 | fi 15 | export CFLAGS=$CFLAGS 16 | 17 | # ./autogen.sh 18 | ../code/configure --prefix=$PWD/../bin_$MODE --enable-static --disable-shared --disable-freetype 19 | # parallel calls to bison will cause error: 20 | # https://github.com/libming/libming/issues/49 21 | if [[ $MODE == "asan" ]]; then 22 | bear -- make || exit 1 23 | else 24 | make || exit 1 25 | fi 26 | 27 | make install 28 | 29 | popd 30 | 31 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /examples/lcms/synthesized/5.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library lcms, aiming to fuzz the following functions: 2 | // cmsOpenProfileFromMem at cmsio0.c:1295:23 in lcms2.h 3 | // cmsCloseProfile at cmsio0.c:1582:20 in lcms2.h 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | 16 | extern "C" int LLVMFuzzerTestOneInput_5(const uint8_t *Data, size_t Size) { 17 | if (Size == 0) return 0; 18 | 19 | cmsHPROFILE profile = cmsOpenProfileFromMem(Data, static_cast(Size)); 20 | if (profile) { 21 | cmsCloseProfile(profile); 22 | } 23 | 24 | return 0; 25 | } -------------------------------------------------------------------------------- /examples/cjson/synthesized/25.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library cjson, aiming to fuzz the following functions: 2 | // cJSON_ParseWithLength at cJSON.c:1200:23 in cJSON.h 3 | // cJSON_Delete at cJSON.c:253:20 in cJSON.h 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include "cJSON.h" 14 | 15 | extern "C" int LLVMFuzzerTestOneInput_25(const uint8_t *Data, size_t Size) { 16 | // Parse the JSON data 17 | cJSON *json = cJSON_ParseWithLength(reinterpret_cast(Data), Size); 18 | 19 | // Clean up the parsed JSON object 20 | if (json) { 21 | cJSON_Delete(json); 22 | } 23 | 24 | return 0; 25 | } -------------------------------------------------------------------------------- /processor/cxx/cgprocessor.hh: -------------------------------------------------------------------------------- 1 | #include "processor.hh" 2 | 3 | // ============================== 4 | // Struct definitions 5 | // ============================== 6 | 7 | struct CallingInfo { 8 | string callerName; 9 | string callerDeclLoc; 10 | string calleeName; 11 | string calleeDeclLoc; 12 | 13 | friend void to_json(json &j, const CallingInfo &ci) { 14 | j = json{{"callerName", ci.callerName}, 15 | {"callerDeclLoc", ci.callerDeclLoc}, 16 | {"calleeName", ci.calleeName}, 17 | {"calleeDeclLoc", ci.calleeDeclLoc}}; 18 | } 19 | }; 20 | 21 | // ============================== 22 | // Global variables to store the information 23 | // ============================== 24 | map callingInfoMap; 25 | 26 | string filePath; -------------------------------------------------------------------------------- /database/ffjpeg/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | COMMIT_ID="$1" 4 | REPO_URL="https://github.com/rockcarry/ffjpeg.git" 5 | 6 | git clone "$REPO_URL" code 7 | if [ $? -ne 0 ]; then 8 | echo "Failed to clone repository. Exiting." 9 | exit 1 10 | fi 11 | 12 | if [ -n "$COMMIT_ID" ]; then 13 | cd code 14 | git checkout "$COMMIT_ID" 15 | if [ $? -ne 0 ]; then 16 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 17 | exit 1 18 | fi 19 | cd .. 20 | fi 21 | 22 | echo "Copy the cloned latest repository..." 23 | mkdir latest 24 | mv code latest 25 | cp ./latest.diff latest/code && pushd latest/code && git apply ./latest.diff && popd 26 | 27 | # latest 28 | cp ./build.sh ./lib.toml latest 29 | 30 | 31 | echo "Repository successfully cloned and copied to '$TARGET_DIR' and latest." -------------------------------------------------------------------------------- /database/svgpp/lib.toml: -------------------------------------------------------------------------------- 1 | # ======================== Configuration for svgpp ======================== 2 | 3 | 4 | [svgpp] 5 | 6 | language = "c++" 7 | 8 | compile_commands_path = "database/svgpp/latest/build_asan/compile_commands.json" 9 | 10 | 11 | header_paths = ["database/svgpp/latest/code/include/svgpp"] 12 | 13 | 14 | document_paths = ["database/svgpp/latest/code/doc/sphinx/_build/text"] 15 | 16 | 17 | document_has_api_usage = true 18 | 19 | 20 | output_path = "database/svgpp/latest/out" 21 | 22 | 23 | driver_build_args = [] 24 | 25 | 26 | source_paths = [] 27 | 28 | 29 | exclude_paths = [] 30 | 31 | 32 | driver_headers = [] 33 | 34 | 35 | api_hints_path = "" 36 | 37 | consumer_case_paths = [ 38 | "database/svgpp/latest/code/src/test", 39 | "database/svgpp/latest/code/src/samples" 40 | ] 41 | -------------------------------------------------------------------------------- /database/utils/extract_gcov.py: -------------------------------------------------------------------------------- 1 | import sys 2 | import json 3 | from pathlib import Path 4 | 5 | print("e.g., python utils/extract_gcov.py ./tinygltf/latest/gcov ossfuzz") 6 | 7 | workdir = Path(sys.argv[1]) 8 | fuzz_id = sys.argv[2] 9 | 10 | 11 | list_cov_dir = [] 12 | for dir in workdir.glob(f"{fuzz_id}_*"): 13 | list_cov_dir.append(dir) 14 | list_cov_dir.sort() 15 | 16 | list_line = [] 17 | list_br = [] 18 | for cov_dir in list_cov_dir: 19 | cov_file = Path(cov_dir) / "gcov-24.json" 20 | if not cov_file.exists(): 21 | continue 22 | dict_cov = json.loads(cov_file.read_text()) 23 | list_line.append(dict_cov["Summary"]["line"]) 24 | list_br.append(dict_cov["Summary"]["branch"]) 25 | 26 | 27 | print(" ".join(str(item) for item in list_line)) 28 | print(" ".join(str(item) for item in list_br)) -------------------------------------------------------------------------------- /database/libmagic/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | COMMIT_ID="$1" 4 | REPO_URL="https://github.com/file/file.git" 5 | 6 | echo "Cloning repository..." 7 | git clone "$REPO_URL" code 8 | if [ $? -ne 0 ]; then 9 | echo "Failed to clone repository. Exiting." 10 | exit 1 11 | fi 12 | 13 | if [ -n "$COMMIT_ID" ]; then 14 | cd code 15 | git checkout "$COMMIT_ID" 16 | if [ $? -ne 0 ]; then 17 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 18 | exit 1 19 | fi 20 | cd .. 21 | fi 22 | 23 | pushd code 24 | autoreconf -fi 25 | popd 26 | 27 | mkdir latest 28 | mv code latest 29 | 30 | cp ./build.sh ./lib.toml latest 31 | 32 | # make seeds from test files 33 | rm -rf in 34 | mkdir in 35 | cp latest/code/tests/*.testfile in/ 36 | 37 | echo "Repository successfully cloned and copied to latest." 38 | -------------------------------------------------------------------------------- /database/ngiflib/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | COMMIT_ID="$1" 4 | REPO_URL="https://github.com/miniupnp/ngiflib.git" 5 | 6 | git clone "$REPO_URL" code 7 | if [ $? -ne 0 ]; then 8 | echo "Failed to clone repository. Exiting." 9 | exit 1 10 | fi 11 | 12 | if [ -n "$COMMIT_ID" ]; then 13 | cd code 14 | git checkout "$COMMIT_ID" 15 | if [ $? -ne 0 ]; then 16 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 17 | exit 1 18 | fi 19 | cd .. 20 | fi 21 | 22 | mkdir latest 23 | # Modify the Makefile to receive LDFLAGS 24 | sed -i 's/^LDFLAGS=\$(shell pkg-config sdl --libs-only-L)$/LDFLAGS+=\$(shell pkg-config sdl --libs-only-L)/' code/Makefile 25 | mv code latest 26 | 27 | cp ./build.sh ./lib.toml latest 28 | 29 | echo "Repository successfully cloned and copied to '$TARGET_DIR' and latest." -------------------------------------------------------------------------------- /database/libpcap/lib.toml: -------------------------------------------------------------------------------- 1 | 2 | [libpcap] 3 | 4 | language = "c" 5 | 6 | compile_commands_path = "database/libpcap/latest/build_asan/compile_commands.json" 7 | 8 | 9 | header_paths = ["database/libpcap/latest/code/pcap"] 10 | 11 | 12 | document_paths = ["database/libpcap/latest/build_asan/mandoc.txt"] 13 | 14 | 15 | document_has_api_usage = true 16 | 17 | 18 | output_path = "database/libpcap/latest/out" 19 | 20 | 21 | driver_build_args = ["database/libpcap/latest/build_asan/libpcap.a", "-Idatabase/libpcap/latest/code", "-ldbus-1"] 22 | 23 | 24 | consumer_case_paths = ["database/libpcap/latest/code/testprogs"] 25 | 26 | 27 | consumer_build_args = ["-Idatabase/libpcap/latest/code"] 28 | 29 | 30 | source_paths = [] 31 | 32 | 33 | exclude_paths = [] 34 | 35 | 36 | driver_headers = [] 37 | 38 | 39 | api_hints_path = "" 40 | 41 | -------------------------------------------------------------------------------- /database/liblouis/lib.toml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | [liblouis] 5 | 6 | language = "c" 7 | 8 | 9 | header_paths = ["database/liblouis/latest/build_asan/liblouis/liblouis.h"] 10 | 11 | 12 | compile_commands_path = "database/liblouis/latest/build_asan/compile_commands.json" 13 | 14 | 15 | document_paths = [ 16 | "database/liblouis/latest/code/README", 17 | "https://liblouis.io/documentation/liblouis.html", 18 | ] 19 | 20 | 21 | document_has_api_usage = true 22 | 23 | 24 | output_path = "database/liblouis/latest/out" 25 | 26 | 27 | driver_build_args = [ 28 | "database/liblouis/latest/bin_asan/lib/liblouis.a", 29 | "-lyaml", 30 | ] 31 | 32 | 33 | exclude_paths = [] 34 | 35 | 36 | driver_headers = [] 37 | 38 | 39 | api_hints_path = "database/liblouis/api_hints.json" 40 | 41 | consumer_case_paths = ["database/liblouis/latest/code/tests"] 42 | -------------------------------------------------------------------------------- /database/srclink.py: -------------------------------------------------------------------------------- 1 | #! /usr/bin/env python3 2 | # -*- coding: utf-8 -*- 3 | """ 4 | Create soft link for all files in the source directory to the target directory, 5 | with the same directory structure. 6 | Used by build.sh in database. 7 | """ 8 | 9 | import sys 10 | from pathlib import Path 11 | 12 | def create_soft_link(src: Path, dst: Path): 13 | for file in src.rglob("*"): 14 | if file.is_file(): 15 | target = dst / file.relative_to(src) 16 | target.parent.mkdir(parents=True, exist_ok=True) 17 | target.symlink_to(file.resolve()) 18 | 19 | def main(): 20 | if len(sys.argv) != 3: 21 | print("Usage: srclink.py ") 22 | sys.exit(1) 23 | 24 | src = Path(sys.argv[1]) 25 | dst = Path(sys.argv[2]) 26 | create_soft_link(src, dst) 27 | 28 | if __name__ == "__main__": 29 | main() -------------------------------------------------------------------------------- /database/libpcap/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | COMMIT_ID="$1" 4 | REPO_URL="https://github.com/the-tcpdump-group/libpcap.git" 5 | 6 | git clone "$REPO_URL" code 7 | if [ $? -ne 0 ]; then 8 | echo "Failed to clone repository. Exiting." 9 | exit 1 10 | fi 11 | 12 | if [ -n "$COMMIT_ID" ]; then 13 | cd code 14 | git checkout "$COMMIT_ID" 15 | if [ $? -ne 0 ]; then 16 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 17 | exit 1 18 | fi 19 | cd .. 20 | fi 21 | 22 | mkdir latest 23 | mv code latest 24 | 25 | cp ./build.sh ./lib.toml latest 26 | 27 | # apply patch to disable abort(), which causes libfuzzer to crash 28 | pushd latest/code 29 | git apply ../../disable_aborts.patch 30 | popd 31 | 32 | # make seeds directory 33 | rm -rf in 34 | mkdir in 35 | cp latest/code/testprogs/BPF/* in/ 36 | cp -r latest/code/tests/* in/ -------------------------------------------------------------------------------- /database/sqlite3/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | COMMIT_ID="$1" 4 | REPO_URL="https://github.com/sqlite/sqlite.git" 5 | 6 | git clone "$REPO_URL" code 7 | if [ $? -ne 0 ]; then 8 | echo "Failed to clone repository. Exiting." 9 | exit 1 10 | fi 11 | 12 | if [ -n "$COMMIT_ID" ]; then 13 | cd code 14 | git checkout "$COMMIT_ID" 15 | if [ $? -ne 0 ]; then 16 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 17 | exit 1 18 | fi 19 | cd .. 20 | fi 21 | 22 | mkdir code/build 23 | pushd code/build 24 | ../configure 25 | make 26 | popd 27 | 28 | mkdir -p latest/code 29 | cp code/README.md code/build/sqlite3.c code/build/sqlite3.h code/build/sqlite3ext.h ./Makefile latest/code 30 | # Replace the header file 31 | ./replace_header.py latest/code/sqlite3.c 32 | 33 | cp -r code/test latest/code 34 | cp ./build.sh ./lib.toml latest 35 | -------------------------------------------------------------------------------- /src/configurer/__init__.py: -------------------------------------------------------------------------------- 1 | """ 2 | Configuration management utilities for PromeFuzz. 3 | 4 | This module provides utilities for managing TOML configuration files, 5 | LLM configurations, and related operations without comment preservation. 6 | """ 7 | 8 | from .file_io import load_config_file, save_config_file 9 | from .llm_utils import ( 10 | get_llm_instances, 11 | mask_api_key, 12 | get_modules_using_llm, 13 | display_llm_details, 14 | validate_llm_exists, 15 | ) 16 | from .template import create_minimal_config 17 | from .assignments import set_module_llm 18 | 19 | __all__ = [ 20 | "load_config_file", 21 | "save_config_file", 22 | "get_llm_instances", 23 | "mask_api_key", 24 | "get_modules_using_llm", 25 | "display_llm_details", 26 | "validate_llm_exists", 27 | "create_minimal_config", 28 | "set_module_llm", 29 | ] 30 | -------------------------------------------------------------------------------- /database/tinygltf/lib.toml: -------------------------------------------------------------------------------- 1 | # ======================== Configuration for tinygltf ======================== 2 | 3 | 4 | [tinygltf] 5 | 6 | language = "c++" 7 | 8 | compile_commands_path = "database/tinygltf/latest/build_asan/compile_commands.json" 9 | 10 | 11 | header_paths = ["database/tinygltf/latest/code/tiny_gltf.h"] 12 | 13 | 14 | document_paths = ["database/tinygltf/latest/code/README.md"] 15 | 16 | 17 | document_has_api_usage = false 18 | 19 | 20 | output_path = "database/tinygltf/latest/out" 21 | 22 | 23 | driver_build_args = ["database/tinygltf/latest/build_asan/libtinygltf.a"] 24 | 25 | 26 | source_paths = [] 27 | 28 | 29 | exclude_paths = [] 30 | 31 | 32 | driver_headers = [] 33 | 34 | 35 | api_hints_path = "" 36 | 37 | consumer_case_paths = [ 38 | "database/tinygltf/latest/code/tests", 39 | "database/tinygltf/latest/code/examples" 40 | ] 41 | -------------------------------------------------------------------------------- /examples/c-ares/synthesized/40.c: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library cares, aiming to fuzz the following functions: 2 | // ares_init at ares_init.c:67:5 in ares.h 3 | // ares_queue_active_queries at ares_send.c:285:8 in ares.h 4 | // ares_cancel at ares_cancel.c:34:6 in ares.h 5 | // ares_destroy at ares_destroy.c:32:6 in ares.h 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | 15 | int LLVMFuzzerTestOneInput_40(const uint8_t *Data, size_t Size) { 16 | ares_channel_t *channel; 17 | if (ares_init(&channel) != ARES_SUCCESS) { 18 | return 0; 19 | } 20 | 21 | size_t active_queries = ares_queue_active_queries(channel); 22 | ares_cancel(channel); 23 | 24 | ares_destroy(channel); 25 | return 0; 26 | } -------------------------------------------------------------------------------- /examples/zlib/synthesized/6.c: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library zlib, aiming to fuzz the following functions: 2 | // zlibVersion at zutil.c:27:22 in zlib.h 3 | // zlibVersion at zutil.c:27:22 in zlib.h 4 | // zlibVersion at zutil.c:27:22 in zlib.h 5 | // zlibCompileFlags at zutil.c:31:15 in zlib.h 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | 14 | int LLVMFuzzerTestOneInput_6(const uint8_t *Data, size_t Size) { 15 | (void)Data; 16 | (void)Size; 17 | 18 | // Call zlibVersion three times 19 | const char *version1 = zlibVersion(); 20 | const char *version2 = zlibVersion(); 21 | const char *version3 = zlibVersion(); 22 | 23 | // Call zlibCompileFlags 24 | uLong flags = zlibCompileFlags(); 25 | 26 | return 0; 27 | } -------------------------------------------------------------------------------- /database/sqlite3/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | ../../srclink.py code build_$MODE 8 | pushd build_$MODE 9 | export INSTALL_PREFIX=$PWD/../bin_$MODE 10 | export CFLAGS+=" -DSQLITE_MAX_LENGTH=128000000 -DSQLITE_MAX_SQL_LENGTH=128000000 -DSQLITE_MAX_MEMORY=25000000 -DSQLITE_PRINTF_PRECISION_LIMIT=1048576 -DSQLITE_DEBUG=1 -DSQLITE_MAX_PAGE_COUNT=16384 -DSQLITE_ALLOW_URI_AUTHORITY -DSQLITE_ENABLE_API_ARMOR -DSQLITE_ENABLE_COLUMN_METADATA -DSQLITE_ENABLE_NORMALIZE -DSQLITE_ENABLE_PREUPDATE_HOOK -DSQLITE_ENABLE_SNAPSHOT -DSQLITE_ENABLE_STMT_SCANSTATUS -DSQLITE_ENABLE_UNLOCK_NOTIFY " 11 | 12 | if [[ $MODE == "asan" ]]; then 13 | bear -- make -j$JOBS || exit 1 14 | else 15 | make -j$JOBS || exit 1 16 | fi 17 | 18 | 19 | make install || exit 1 20 | 21 | popd 22 | 23 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /database/utils/run_asan.py: -------------------------------------------------------------------------------- 1 | import sys 2 | import tomllib 3 | from pathlib import Path 4 | from loguru import logger 5 | from multiprocessing import Pool 6 | 7 | from asan import ASan 8 | 9 | if __name__ == "__main__": 10 | # p = Pool(20) 11 | # p.map_async(run_asan, id_list) 12 | try: 13 | path_config = Path(sys.argv[1]) 14 | except: 15 | logger.error("python run_asan.py fuzz.toml") 16 | exit(-1) 17 | config = tomllib.loads(path_config.read_text()) 18 | 19 | asan_path = Path("./asan") 20 | if not asan_path.exists(): 21 | asan_path.mkdir() 22 | 23 | project_name = "ngiflib" 24 | version = "latest" 25 | fuzz_id = "promefuzz" 26 | 27 | list_out_id = ["promefuzz_24_0", "promefuzz_24_1", "promefuzz_24_2", "promefuzz_24_3"] 28 | 29 | asan = ASan(config) 30 | for out_id in list_out_id: 31 | asan.run(project_name, version, fuzz_id, out_id, 24) 32 | -------------------------------------------------------------------------------- /src/configurer/template.py: -------------------------------------------------------------------------------- 1 | """ 2 | Configuration file templates. 3 | 4 | This module provides template generation functions for creating 5 | clean configuration files without comments. 6 | """ 7 | 8 | import os 9 | 10 | 11 | def create_minimal_config() -> str: 12 | """Create empty configuration file with basic structure.""" 13 | # Use appropriate binary extension for the current platform 14 | exe_ext = ".exe" if os.name == "nt" else "" 15 | 16 | return f"""[preprocessor] 17 | 18 | [comprehender] 19 | embedding_llm = "" 20 | comprehension_llm = "" 21 | 22 | [generator] 23 | generation_llm = "" 24 | 25 | [generator.schedule_weights] 26 | type_relevance = 2 27 | call_scope_relevance = 3 28 | semantic_relevance = 5 29 | coverage = 3 30 | relevance = 1 31 | 32 | [analyzer] 33 | analysis_llm = "" 34 | 35 | [llm] 36 | default_llm = "" 37 | validate_llm = true 38 | enable_log = true 39 | 40 | [bin] 41 | 42 | """ 43 | -------------------------------------------------------------------------------- /src/prompt/generate_c_driver.sys: -------------------------------------------------------------------------------- 1 | {LIBRARY_PURPOSE} You are a security testing engineer with expertise in writing C fuzz driver programs for {LIBRARY_NAME}. To effectively create a fuzz driver that tests given API functions, follow these steps: 2 | 3 | 1. Prepare the environment necessary before invoking the target function. Identify the required data types and initialize them with appropriate values. 4 | 2. Conduct any required cleanup afterward. Pay attention to the return value of the function and handle exceptions properly. 5 | 3. Try to explore more program states by invoking the target function diversely. 6 | 4. Wrap all logic within the `int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)` function, which acts as the entry point for fuzzing. 7 | 5. If the code requires a file, use "./dummy_file" and write the necessary data to it. 8 | 6. If defining any functions other than `LLVMFuzzerTestOneInput`, use `static` keyword to avoid name conflicts. -------------------------------------------------------------------------------- /database/utils/run_gcov.py: -------------------------------------------------------------------------------- 1 | import os 2 | import sys 3 | import tomllib 4 | from pathlib import Path 5 | from loguru import logger 6 | from multiprocessing import Pool 7 | 8 | from gcov import GCov 9 | 10 | if __name__ == "__main__": 11 | try: 12 | path_config = Path(sys.argv[1]) 13 | except: 14 | logger.error("python run_gcov.py fuzz.toml") 15 | exit(-1) 16 | config = tomllib.loads(path_config.read_text()) 17 | 18 | gcov_path = Path("./gcov") 19 | if not gcov_path.exists(): 20 | gcov_path.mkdir() 21 | 22 | project_name = "ngiflib" 23 | version = "latest" 24 | fuzz_id = "promefuzz" 25 | 26 | list_out_id = [ 27 | "promefuzz_24_0", 28 | # "promefuzz_24_1", 29 | # "promefuzz_24_2", 30 | # "promefuzz_24_3" 31 | ] 32 | 33 | gcov = GCov(config) 34 | for out_id in list_out_id: 35 | gcov.run(project_name, version, fuzz_id, out_id, 24) 36 | -------------------------------------------------------------------------------- /database/zlib/lib.toml: -------------------------------------------------------------------------------- 1 | 2 | [zlib] 3 | 4 | language = "c" 5 | 6 | compile_commands_path = "database/zlib/latest/build_asan/compile_commands.json" 7 | 8 | 9 | header_paths = ["database/zlib/latest/code/zlib.h", "database/zlib/latest/code/zconf.h"] 10 | 11 | 12 | document_paths = ["database/zlib/latest/code/zlib.h"] 13 | 14 | 15 | document_has_api_usage = true 16 | 17 | 18 | output_path = "database/zlib/latest/out" 19 | 20 | 21 | driver_build_args = [ 22 | "database/zlib/latest/build_asan/libz.a", 23 | "-DHAVE_HIDDEN", 24 | "-DNO_FSEEKO", 25 | "-DZLIB_BUILD", 26 | "-DZLIB_DLL", 27 | "-D_LARGEFILE64_SOURCE=1" 28 | ] 29 | 30 | 31 | consumer_case_paths = ["database/zlib/latest/code/examples", "database/zlib/latest/code/test"] 32 | 33 | 34 | consumer_build_args = [] 35 | 36 | 37 | source_paths = [] 38 | 39 | 40 | exclude_paths = [] 41 | 42 | 43 | driver_headers = [] 44 | 45 | 46 | api_hints_path = "" 47 | 48 | -------------------------------------------------------------------------------- /database/pugixml/in/Import Stock Quantities using Stock Transactions.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | AdjustmentIn 6 | 9 | 1 10 | GREENFORK 11 | 2017-01-01T11:11:11 12 | Extra Stock 13 |
Adding Extra Stock
14 | 10 15 | 1 16 | 0 17 | 1 18 | 19 | 20 | 21 | -------------------------------------------------------------------------------- /database/cre2/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | COMMIT_ID="$1" 4 | REPO_URL="https://github.com/marcomaggi/cre2.git" 5 | REPO_URL_2="https://github.com/google/re2.git" 6 | 7 | git clone "$REPO_URL" cre2 8 | if [ $? -ne 0 ]; then 9 | echo "Failed to clone cre2 repository. Exiting." 10 | exit 1 11 | fi 12 | git clone "$REPO_URL_2" re2 13 | if [ $? -ne 0 ]; then 14 | echo "Failed to clone re2 repository. Exiting." 15 | exit 1 16 | fi 17 | 18 | if [ -n "$COMMIT_ID" ]; then 19 | cd re2 20 | git checkout "$COMMIT_ID" 21 | if [ $? -ne 0 ]; then 22 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 23 | exit 1 24 | fi 25 | cd .. 26 | fi 27 | 28 | mkdir code 29 | mv cre2 code 30 | mv re2 code 31 | 32 | pushd code/cre2 33 | autoreconf -fi 34 | popd 35 | 36 | mkdir latest 37 | mv code latest 38 | 39 | cp ./build.sh ./lib.toml latest 40 | 41 | echo "Repository successfully cloned and copied to 'latest' directory." -------------------------------------------------------------------------------- /examples/exiv2/synthesized/44.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library exiv2, aiming to fuzz the following functions: 2 | // Exiv2::Uri::Parse at futils.cpp:278:10 in futils.hpp 3 | // Exiv2::Uri::Decode at futils.cpp:270:11 in futils.hpp 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | 17 | extern "C" int LLVMFuzzerTestOneInput_44(const uint8_t *Data, size_t Size) { 18 | if (Size == 0) { 19 | return 0; 20 | } 21 | 22 | try { 23 | std::string uri_str(reinterpret_cast(Data), Size); 24 | Exiv2::Uri uri = Exiv2::Uri::Parse(uri_str); 25 | Exiv2::Uri::Decode(uri); 26 | } catch (...) { 27 | // Ignore all exceptions 28 | } 29 | 30 | return 0; 31 | } -------------------------------------------------------------------------------- /examples/sqlite3/synthesized/138.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library sqlite3, aiming to fuzz the following functions: 2 | // sqlite3_value_dup at sqlite3.c:77726:27 in sqlite3.h 3 | // sqlite3_value_text16be at sqlite3.c:77615:24 in sqlite3.h 4 | // sqlite3_value_subtype at sqlite3.c:77591:25 in sqlite3.h 5 | // sqlite3_value_text16 at sqlite3.c:77612:24 in sqlite3.h 6 | // sqlite3_value_free at sqlite3.c:77752:17 in sqlite3.h 7 | #include 8 | #include 9 | #include 10 | #include 11 | 12 | extern "C" int LLVMFuzzerTestOneInput_138(const uint8_t *Data, size_t Size) { 13 | if (Size < 1) { 14 | return 0; 15 | } 16 | 17 | sqlite3_value *value = sqlite3_value_dup(nullptr); 18 | if (value) { 19 | sqlite3_value_text16be(value); 20 | sqlite3_value_subtype(value); 21 | sqlite3_value_text16(value); 22 | sqlite3_value_free(value); 23 | } 24 | 25 | return 0; 26 | } -------------------------------------------------------------------------------- /examples/sqlite3/synthesized/91.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library sqlite3, aiming to fuzz the following functions: 2 | // sqlite3_value_dup at sqlite3.c:77726:27 in sqlite3.h 3 | // sqlite3_value_text16be at sqlite3.c:77615:24 in sqlite3.h 4 | // sqlite3_value_text16le at sqlite3.c:77618:24 in sqlite3.h 5 | // sqlite3_value_text16 at sqlite3.c:77612:24 in sqlite3.h 6 | // sqlite3_value_free at sqlite3.c:77752:17 in sqlite3.h 7 | #include 8 | #include 9 | #include 10 | #include 11 | 12 | extern "C" int LLVMFuzzerTestOneInput_91(const uint8_t *Data, size_t Size) { 13 | if (Size < 1) { 14 | return 0; 15 | } 16 | 17 | sqlite3_value *value = sqlite3_value_dup(nullptr); 18 | if (value) { 19 | sqlite3_value_text16be(value); 20 | sqlite3_value_text16le(value); 21 | sqlite3_value_text16(value); 22 | sqlite3_value_free(value); 23 | } 24 | 25 | return 0; 26 | } -------------------------------------------------------------------------------- /src/prompt/generate_cpp_driver.sys: -------------------------------------------------------------------------------- 1 | {LIBRARY_PURPOSE} You are a security testing engineer with expertise in writing C++ fuzz driver programs for {LIBRARY_NAME}. To effectively create a fuzz driver that tests given API functions, follow these steps: 2 | 3 | 1. Prepare the environment necessary before invoking the target function. Identify the required data types and classes, initialize them with appropriate values. 4 | 2. Conduct any required cleanup afterward. Pay attention to the return value of the function and handle exceptions properly. 5 | 3. Try to explore more program states by invoking the target function diversely. 6 | 4. Wrap all logic within the `extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)` function, which acts as the entry point for fuzzing. 7 | 5. If the code requires a file, use "./dummy_file" and write the necessary data to it. 8 | 6. If defining any functions other than `LLVMFuzzerTestOneInput`, use `static` keyword to avoid name conflicts. -------------------------------------------------------------------------------- /examples/sqlite3/synthesized/40.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library sqlite3, aiming to fuzz the following functions: 2 | // sqlite3_open at sqlite3.c:171349:16 in sqlite3.h 3 | // sqlite3_close at sqlite3.c:169058:16 in sqlite3.h 4 | // sqlite3_memory_highwater at sqlite3.c:17097:26 in sqlite3.h 5 | // sqlite3_memory_used at sqlite3.c:17086:26 in sqlite3.h 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | 17 | extern "C" int LLVMFuzzerTestOneInput_40(const uint8_t *Data, size_t Size) { 18 | sqlite3 *db; 19 | if (sqlite3_open(":memory:", &db) != SQLITE_OK) { 20 | return 0; 21 | } 22 | 23 | sqlite3_close(db); 24 | sqlite3_int64 highwater = sqlite3_memory_highwater(0); 25 | sqlite3_int64 used = sqlite3_memory_used(); 26 | 27 | return 0; 28 | } -------------------------------------------------------------------------------- /src/vars.py: -------------------------------------------------------------------------------- 1 | """ 2 | Global variables 3 | """ 4 | 5 | from enum import Enum 6 | from pathlib import Path 7 | 8 | 9 | # ==================== Basic Info ==================== 10 | class SupportedLanguages(Enum): 11 | """ 12 | Supported languages 13 | """ 14 | 15 | NONE = "none" 16 | C = "c" 17 | CPP = "c++" 18 | RUST = "rust" 19 | 20 | 21 | promefuzz_path: Path = None 22 | 23 | # ==================== Configuration ==================== 24 | 25 | # template configuration, as default value 26 | config_template = dict() 27 | libraries_template = dict() 28 | 29 | # PromeFuzz configuration 30 | config = dict() 31 | 32 | # libraries configuration 33 | libraries = dict() 34 | 35 | # ==================== Current Library ==================== 36 | 37 | # target library name 38 | library_name = "" 39 | 40 | # target library language 41 | library_language = SupportedLanguages.NONE 42 | 43 | # target library configuration 44 | library_config = dict() 45 | -------------------------------------------------------------------------------- /database/curl/in/test1: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | HTTP 5 | HTTP GET 6 | 7 | 8 | 9 | # 10 | # Server-side 11 | 12 | 13 | HTTP/1.1 200 OK 14 | Date: Tue, 09 Nov 2010 14:49:00 GMT 15 | Server: test-server/fake 16 | Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT 17 | ETag: "21025-dc7-39462498" 18 | Accept-Ranges: bytes 19 | Content-Length: 6 20 | Connection: close 21 | Content-Type: text/html 22 | Funny-head: yesyes 23 | 24 | -foo- 25 | 26 | 27 | 28 | # 29 | # Client-side 30 | 31 | 32 | http 33 | 34 | 35 | HTTP GET 36 | 37 | 38 | http://%HOSTIP:%HTTPPORT/%TESTNUMBER 39 | 40 | 41 | 42 | # 43 | # Verify data after the test has been "shot" 44 | 45 | 46 | GET /%TESTNUMBER HTTP/1.1 47 | Host: %HOSTIP:%HTTPPORT 48 | User-Agent: curl/%VERSION 49 | Accept: */* 50 | 51 | 52 | 53 | 54 | -------------------------------------------------------------------------------- /database/libmagic/lib.toml: -------------------------------------------------------------------------------- 1 | 2 | [libmagic] 3 | 4 | language = "c" 5 | 6 | compile_commands_path = "database/libmagic/latest/build_asan/compile_commands.json" 7 | 8 | 9 | header_paths = ["database/libmagic/latest/build_asan/src/magic.h"] 10 | 11 | 12 | document_paths = ["database/libmagic/latest/build_asan/mandoc.txt"] 13 | 14 | 15 | document_has_api_usage = true 16 | 17 | 18 | output_path = "database/libmagic/latest/out" 19 | 20 | 21 | driver_build_args = [ 22 | "database/libmagic/latest/bin_asan/lib/libmagic.a", 23 | "-llzma", 24 | "-lzstd", 25 | "-lz" 26 | ] 27 | 28 | 29 | consumer_case_paths = ["database/libmagic/latest/code/src/file.c", "database/libmagic/latest/code/tests/test.c", "database/libmagic/latest/code/fuzz/magic_fuzzer.c"] 30 | 31 | 32 | consumer_build_args = [] 33 | 34 | 35 | source_paths = [] 36 | 37 | 38 | exclude_paths = [] 39 | 40 | 41 | driver_headers = [] 42 | 43 | 44 | api_hints_path = "database/libmagic/api_hints.json" 45 | 46 | -------------------------------------------------------------------------------- /database/sqlite3/lib.toml: -------------------------------------------------------------------------------- 1 | [sqlite3] 2 | language = "c" 3 | compile_commands_path = "database/sqlite3/latest/build_asan/compile_commands.json" 4 | document_paths = ["database/sqlite3/latest/code/README.md"] 5 | document_has_api_usage = false 6 | output_path = "database/sqlite3/latest/out" 7 | header_paths = ["database/sqlite3/latest/code/sqlite3.h"] 8 | driver_build_args = [ 9 | "database/sqlite3/latest/bin_asan/lib/libsqlite3.a", 10 | "-DSQLITE_MAX_LENGTH=128000000 -DSQLITE_MAX_SQL_LENGTH=128000000 -DSQLITE_MAX_MEMORY=25000000 -DSQLITE_PRINTF_PRECISION_LIMIT=1048576 -DSQLITE_DEBUG=1 -DSQLITE_MAX_PAGE_COUNT=16384 -DSQLITE_ALLOW_URI_AUTHORITY -DSQLITE_ENABLE_API_ARMOR -DSQLITE_ENABLE_COLUMN_METADATA -DSQLITE_ENABLE_NORMALIZE -DSQLITE_ENABLE_PREUPDATE_HOOK -DSQLITE_ENABLE_SNAPSHOT -DSQLITE_ENABLE_STMT_SCANSTATUS -DSQLITE_ENABLE_UNLOCK_NOTIFY", 11 | ] 12 | consumer_case_paths = ["database/sqlite3/latest/code/test"] 13 | consumer_build_args = ["-Idatabase/sqlite3/latest/bin_asan/include"] 14 | -------------------------------------------------------------------------------- /examples/exiv2/synthesized/16.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library exiv2, aiming to fuzz the following functions: 2 | // Exiv2::ExifData::end at exif.hpp:439:12 in exif.hpp 3 | // Exiv2::ExifData::empty at exif.hpp:465:22 in exif.hpp 4 | // Exiv2::IptcData::empty at iptc.hpp:247:22 in iptc.hpp 5 | // Exiv2::XmpData::empty at xmp.cpp:464:15 in xmp_exiv2.hpp 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | 19 | extern "C" int LLVMFuzzerTestOneInput_16(const uint8_t *Data, size_t Size) { 20 | Exiv2::XmpData xmpData; 21 | Exiv2::IptcData iptcData; 22 | Exiv2::ExifData exifData; 23 | 24 | (void)exifData.end(); 25 | (void)exifData.empty(); 26 | (void)iptcData.empty(); 27 | (void)xmpData.empty(); 28 | 29 | return 0; 30 | } -------------------------------------------------------------------------------- /examples/libtiff/synthesized/4.c: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library libtiff, aiming to fuzz the following functions: 2 | // TIFFClose at tif_close.c:156:6 in tiffio.h 3 | // TIFFOpen at tif_unix.c:228:7 in tiffio.h 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | 13 | int LLVMFuzzerTestOneInput_4(const uint8_t *Data, size_t Size) { 14 | const char *filename = "./dummy_file"; 15 | FILE *file = fopen(filename, "wb+"); 16 | if (file == NULL) { 17 | return 0; 18 | } 19 | 20 | fwrite(Data, 1, Size, file); 21 | fclose(file); 22 | 23 | /* Use "rh" mode to enable TIFF_HEADERONLY flag */ 24 | TIFF *tif = TIFFOpen(filename, "rh"); 25 | if (tif == NULL) { 26 | return 0; 27 | } 28 | 29 | /* Prevent directory parsing operations */ 30 | TIFFClose(tif); 31 | unlink(filename); 32 | return 0; 33 | } -------------------------------------------------------------------------------- /database/libtiff/lib.toml: -------------------------------------------------------------------------------- 1 | [libtiff] 2 | language = "c" 3 | header_paths = [ 4 | "database/libtiff/latest/code/libtiff/tiff.h", 5 | "database/libtiff/latest/code/libtiff/tiffio.h", 6 | "database/libtiff/latest/code/libtiff/tiffio.hxx", 7 | ] 8 | compile_commands_path = "database/libtiff/latest/build_asan/compile_commands.json" 9 | document_paths = [ 10 | "database/libtiff/latest/code/doc/libtiff.rst", 11 | "database/libtiff/latest/code/doc/functions", 12 | ] 13 | document_has_api_usage = true 14 | output_path = "database/libtiff/latest/out" 15 | driver_build_args = [ 16 | "-Idatabase/libtiff/latest/bin_asan/include", 17 | "database/libtiff/latest/bin_asan/lib/libtiff.a", 18 | "database/libtiff/latest/bin_asan/lib/libtiffxx.a", 19 | "-lz -ljpeg -ljbig -llzma -lzstd", 20 | ] 21 | source_paths = [] 22 | exclude_paths = [] 23 | driver_headers = [] 24 | consumer_case_paths = ["database/libtiff/latest/code/test"] 25 | consumer_build_args = ["-Idatabase/libtiff/latest/build_asan/libtiff"] -------------------------------------------------------------------------------- /pyproject.toml: -------------------------------------------------------------------------------- 1 | [project] 2 | name = "promefuzz" 3 | version = "0.1.0" 4 | description = "API Functions Fuzz Driver Generator using Large Language Model" 5 | readme = "README.md" 6 | requires-python = ">=3.12" 7 | dependencies = [ 8 | "bs4>=0.0.2", 9 | "chromadb>=0.5.20", 10 | "click==8.1.7", 11 | "langchain-chroma>=0.1.4", 12 | "langchain-community>=0.3.8", 13 | "langchain-openai>=0.2.10", 14 | "loguru==0.7.2", 15 | "ollama==0.4.7", 16 | "openai>=1.60.0", 17 | "parse==1.20.2", 18 | "tiktoken>=0.8.0", 19 | "tree-sitter-rust>=0.23.2", 20 | "tree-sitter>=0.23.2", 21 | "openpyxl>=3.1.5", 22 | "unstructured>=0.16.12", 23 | "markdown>=3.7", 24 | "chardet>=5.2.0", 25 | "langchain-unstructured>=0.1.6", 26 | "libtmux>=0.40.1", 27 | "matplotlib>=3.10.1", 28 | "tree-sitter-c==0.23.0", 29 | "tree-sitter-cpp>=0.23.4", 30 | "tomlkit>=0.13.3", 31 | ] 32 | 33 | [tool.uv] 34 | index-url = "https://mirrors.tuna.tsinghua.edu.cn/pypi/web/simple" 35 | -------------------------------------------------------------------------------- /database/cre2/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | . ../../common.sh $1 3 | 4 | echo "start compiling $PWD with $MODE" 5 | 6 | rm -rf build_$MODE bin_$MODE 7 | mkdir build_$MODE 8 | mkdir build_$MODE/re2 9 | mkdir build_$MODE/cre2 10 | 11 | # build re2 12 | pushd build_$MODE/re2 13 | cmake ../../code/re2 -DCMAKE_INSTALL_PREFIX=$PWD/../../bin_$MODE/re2 -DCMAKE_PREFIX_PATH=$PWD/../../../abseil-cpp/bin 14 | if [[ $MODE == "asan" ]]; then 15 | bear -- make -j$JOBS || exit 1 16 | else 17 | make -j$JOBS || exit 1 18 | fi 19 | make install || exit 1 20 | popd 21 | 22 | # build cre2 23 | pushd build_$MODE/cre2 24 | PKG_CONFIG_PATH=$PWD/../../bin_$MODE/re2/lib/pkgconfig:$PWD/../../../abseil-cpp/bin/lib/pkgconfig ../../code/cre2/configure --enable-maintainer-mode --prefix=$PWD/../../bin_$MODE/cre2 --enable-static --disable-shared 25 | if [[ $MODE == "asan" ]]; then 26 | bear -- make -j$JOBS || exit 1 27 | else 28 | make -j$JOBS || exit 1 29 | fi 30 | make install || exit 1 31 | popd 32 | 33 | echo "end compiling $PWD with $MODE" -------------------------------------------------------------------------------- /database/tinygltf/separate_del_and_impl.py: -------------------------------------------------------------------------------- 1 | #! /usr/bin/env python3 2 | # -*- coding: utf-8 -*- 3 | """ 4 | The tinygltf library is a single-header library. 5 | Inside the header, there is a macro named `TINYGLTF_IMPLEMENTATION`. 6 | If it is defined, the implementation of the library is included in the header. 7 | If it is not defined, only the declaration is included. 8 | This will cause tricky problems when extracting the API functions from the header. 9 | The solution is to separate the declaration and implementation, and 10 | move the implementation to the source file. 11 | """ 12 | 13 | import sys 14 | from pathlib import Path 15 | 16 | gltf_dir = Path(sys.argv[1]) 17 | gltf_header = gltf_dir / "tiny_gltf.h" 18 | gltf_src = gltf_dir / "tiny_gltf.cc" 19 | 20 | gltf_decl, gltf_impl = gltf_header.read_text().split( 21 | "#if defined(TINYGLTF_IMPLEMENTATION)" 22 | ) 23 | with gltf_header.open("w") as f: 24 | f.write(gltf_decl) 25 | with gltf_src.open("a") as f: 26 | f.write("#if defined(TINYGLTF_IMPLEMENTATION)" + gltf_impl) 27 | -------------------------------------------------------------------------------- /examples/cjson/synthesized/34.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library cjson, aiming to fuzz the following functions: 2 | // cJSON_CreateBool at cJSON.c:2452:23 in cJSON.h 3 | // cJSON_IsBool at cJSON.c:2961:26 in cJSON.h 4 | // cJSON_IsTrue at cJSON.c:2950:26 in cJSON.h 5 | // cJSON_IsFalse at cJSON.c:2940:26 in cJSON.h 6 | // cJSON_Delete at cJSON.c:253:20 in cJSON.h 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include "cJSON.h" 17 | 18 | extern "C" int LLVMFuzzerTestOneInput_34(const uint8_t *Data, size_t Size) { 19 | if (Size < 1) return 0; 20 | 21 | cJSON_bool boolean = Data[0] % 2; 22 | cJSON *bool_item = cJSON_CreateBool(boolean); 23 | if (bool_item == nullptr) return 0; 24 | 25 | cJSON_IsBool(bool_item); 26 | cJSON_IsTrue(bool_item); 27 | cJSON_IsFalse(bool_item); 28 | 29 | cJSON_Delete(bool_item); 30 | 31 | return 0; 32 | } -------------------------------------------------------------------------------- /examples/sqlite3/synthesized/45.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library sqlite3, aiming to fuzz the following functions: 2 | // sqlite3_memory_used at sqlite3.c:17086:26 in sqlite3.h 3 | // sqlite3_shutdown at sqlite3.c:168087:16 in sqlite3.h 4 | // sqlite3_config at sqlite3.c:168141:16 in sqlite3.h 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | 16 | extern "C" int LLVMFuzzerTestOneInput_45(const uint8_t *Data, size_t Size) { 17 | // Call sqlite3_memory_used to get the current memory usage 18 | sqlite3_int64 memory_used = sqlite3_memory_used(); 19 | 20 | // Call sqlite3_shutdown to cleanly shut down the SQLite library 21 | int shutdown_result = sqlite3_shutdown(); 22 | 23 | // Call sqlite3_config with a dummy configuration option 24 | int config_result = sqlite3_config(SQLITE_CONFIG_SINGLETHREAD); 25 | 26 | return 0; 27 | } -------------------------------------------------------------------------------- /examples/re2/synthesized/9.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library re2, aiming to fuzz the following functions: 2 | // re2::RE2::ok at re2.h:307:8 in re2.h 3 | // re2::RE2::error_code at re2.h:320:13 in re2.h 4 | // re2::RE2::error at re2.h:316:22 in re2.h 5 | // re2::RE2::error_arg at re2.h:324:22 in re2.h 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include "re2/re2.h" 16 | #include 17 | #include 18 | 19 | extern "C" int LLVMFuzzerTestOneInput_9(const uint8_t *Data, size_t Size) { 20 | if (Size < 1) return 0; 21 | 22 | std::string pattern(reinterpret_cast(Data), Size); 23 | re2::RE2 regex(pattern); 24 | 25 | bool ok = regex.ok(); 26 | re2::RE2::ErrorCode error_code = regex.error_code(); 27 | const std::string& error = regex.error(); 28 | const std::string& error_arg = regex.error_arg(); 29 | 30 | return 0; 31 | } -------------------------------------------------------------------------------- /database/svgpp/fetch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | COMMIT_ID="$1" 4 | REPO_URL="https://github.com/svgpp/svgpp.git" 5 | 6 | git clone "$REPO_URL" code 7 | if [ $? -ne 0 ]; then 8 | echo "Failed to clone repository. Exiting." 9 | exit 1 10 | fi 11 | 12 | if [ -n "$COMMIT_ID" ]; then 13 | cd code 14 | git checkout "$COMMIT_ID" 15 | if [ $? -ne 0 ]; then 16 | echo "Failed to checkout to commit $COMMIT_ID. Exiting." 17 | exit 1 18 | fi 19 | cd .. 20 | fi 21 | 22 | # since this is a header-only library, we add a source file to include the header 23 | cat < code/svgpp.cpp 24 | #include "svgpp/attribute_dispatcher.hpp" 25 | #include "svgpp/config.hpp" 26 | #include "svgpp/definitions.hpp" 27 | #include "svgpp/document_traversal.hpp" 28 | #include "svgpp/number_type.hpp" 29 | #include "svgpp/svgpp.hpp" 30 | #include "svgpp/template_parameters.hpp" 31 | EOF 32 | 33 | # build documents 34 | pushd code/doc/sphinx 35 | make text 36 | popd 37 | 38 | mkdir latest 39 | mv code latest 40 | 41 | cp ./build.sh ./lib.toml latest 42 | -------------------------------------------------------------------------------- /examples/cjson/synthesized/24.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library cjson, aiming to fuzz the following functions: 2 | // cJSON_CreateObject at cJSON.c:2567:23 in cJSON.h 3 | // cJSON_AddTrueToObject at cJSON.c:2120:22 in cJSON.h 4 | // cJSON_Delete at cJSON.c:253:20 in cJSON.h 5 | // cJSON_Delete at cJSON.c:253:20 in cJSON.h 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include "cJSON.h" 16 | 17 | extern "C" int LLVMFuzzerTestOneInput_24(const uint8_t *Data, size_t Size) { 18 | if (Size < 1) { 19 | return 0; 20 | } 21 | 22 | cJSON *root = cJSON_CreateObject(); 23 | if (root == nullptr) { 24 | return 0; 25 | } 26 | 27 | const char *name = "fuzz_key"; 28 | cJSON *true_item = cJSON_AddTrueToObject(root, name); 29 | if (true_item == nullptr) { 30 | cJSON_Delete(root); 31 | return 0; 32 | } 33 | 34 | cJSON_Delete(root); 35 | return 0; 36 | } -------------------------------------------------------------------------------- /examples/re2/synthesized/4.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library re2, aiming to fuzz the following functions: 2 | // re2::RE2::pattern at re2.h:312:22 in re2.h 3 | // re2::RE2::error at re2.h:316:22 in re2.h 4 | // re2::RE2::ok at re2.h:307:8 in re2.h 5 | // re2::RE2::error_code at re2.h:320:13 in re2.h 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include "re2/re2.h" 16 | #include 17 | #include 18 | 19 | extern "C" int LLVMFuzzerTestOneInput_4(const uint8_t *Data, size_t Size) { 20 | if (Size == 0) { 21 | return 0; 22 | } 23 | 24 | // Ensure null-terminated string 25 | char *pattern = new char[Size + 1]; 26 | memcpy(pattern, Data, Size); 27 | pattern[Size] = '\0'; 28 | 29 | re2::RE2 regex(pattern); 30 | regex.pattern(); 31 | regex.error(); 32 | regex.ok(); 33 | regex.error_code(); 34 | 35 | delete[] pattern; 36 | return 0; 37 | } -------------------------------------------------------------------------------- /database/pugixml/in/Sage 200 Transaction.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 12944 6 | SalesInvoice 7 | ONBOARD 8 | 2012-03-19T00:00:00 9 | DXB_000003206C 10 |
11 | 1093.23 12 | 0 13 | 1093.23 14 | 1 15 | 16 | 17 | -------------------------------------------------------------------------------- /examples/cjson/synthesized/17.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library cjson, aiming to fuzz the following functions: 2 | // cJSON_CreateObject at cJSON.c:2567:23 in cJSON.h 3 | // cJSON_AddBoolToObject at cJSON.c:2144:22 in cJSON.h 4 | // cJSON_AddBoolToObject at cJSON.c:2144:22 in cJSON.h 5 | // cJSON_Delete at cJSON.c:253:20 in cJSON.h 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include "cJSON.h" 16 | 17 | extern "C" int LLVMFuzzerTestOneInput_17(const uint8_t *Data, size_t Size) { 18 | if (Size < 1) { 19 | return 0; 20 | } 21 | 22 | cJSON *root = cJSON_CreateObject(); 23 | if (!root) { 24 | return 0; 25 | } 26 | 27 | cJSON_bool boolean1 = (Data[0] & 1) ? 1 : 0; 28 | cJSON_bool boolean2 = (Data[0] & 2) ? 1 : 0; 29 | 30 | cJSON_AddBoolToObject(root, "bool1", boolean1); 31 | cJSON_AddBoolToObject(root, "bool2", boolean2); 32 | 33 | cJSON_Delete(root); 34 | 35 | return 0; 36 | } -------------------------------------------------------------------------------- /examples/exiv2/synthesized/25.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library exiv2, aiming to fuzz the following functions: 2 | // Exiv2::version at version.cpp:81:13 in version.hpp 3 | // Exiv2::versionNumber at version.cpp:65:10 in version.hpp 4 | // Exiv2::versionString at version.cpp:69:13 in version.hpp 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | 18 | extern "C" int LLVMFuzzerTestOneInput_25(const uint8_t *Data, size_t Size) { 19 | // Call version functions in the specified order 20 | const char* version_cstr = Exiv2::version(); 21 | (void)version_cstr; // Avoid unused variable warning 22 | 23 | uint32_t version_num = Exiv2::versionNumber(); 24 | (void)version_num; // Avoid unused variable warning 25 | 26 | std::string version_str = Exiv2::versionString(); 27 | (void)version_str; // Avoid unused variable warning 28 | 29 | return 0; 30 | } -------------------------------------------------------------------------------- /examples/exiv2/synthesized/476.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library exiv2, aiming to fuzz the following functions: 2 | // Exiv2::Internal::PtrSliceStorage::unsafeGetIteratorAt at slice.hpp:363:26 in slice.hpp 3 | // Exiv2::Internal::PtrSliceStorage::unsafeAt at slice.hpp:349:29 in slice.hpp 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | extern "C" int LLVMFuzzerTestOneInput_476(const uint8_t *Data, size_t Size) { 12 | if (Size < 1) return 0; 13 | 14 | try { 15 | // Create a vector to use as data storage 16 | std::vector vec(Data, Data + Size); 17 | 18 | // Initialize PtrSliceStorage 19 | Exiv2::Internal::PtrSliceStorage storage(vec.data(), 0, Size); 20 | 21 | // Test PtrSliceStorage functions 22 | size_t index = Data[0] % Size; 23 | (void)storage.unsafeGetIteratorAt(index % Size); 24 | (void)storage.unsafeAt(index % Size); 25 | 26 | } catch (...) { 27 | // Catch all exceptions 28 | } 29 | 30 | return 0; 31 | } -------------------------------------------------------------------------------- /examples/ffjpeg/synthesized/43.c: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library ffjpeg, aiming to fuzz the following functions: 2 | // bmp_create at bmp.c:62:5 in bmp.h 3 | // bmp_free at bmp.c:102:6 in bmp.h 4 | // jfif_save at jfif.c:261:5 in jfif.h 5 | // jfif_encode at jfif.c:659:7 in jfif.h 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include "jfif.h" 12 | #include "bmp.h" 13 | 14 | int LLVMFuzzerTestOneInput_43(const uint8_t *Data, size_t Size) { 15 | BMP bmp; 16 | void *jpeg_data; 17 | char *dummy_file = "./dummy_file"; 18 | 19 | if (bmp_create(&bmp, 100, 100) != 0) { 20 | return 0; 21 | } 22 | 23 | // Copy fuzz data into BMP pixel buffer only 24 | size_t bmp_size = (size_t)bmp.stride * bmp.height; 25 | size_t copy_size = Size < bmp_size ? Size : bmp_size; 26 | if (copy_size > 0) { 27 | memcpy(bmp.pdata, Data, copy_size); 28 | } 29 | 30 | jpeg_data = jfif_encode(&bmp); 31 | jfif_save(jpeg_data, dummy_file); 32 | 33 | bmp_free(&bmp); 34 | free(jpeg_data); 35 | 36 | return 0; 37 | } -------------------------------------------------------------------------------- /examples/sqlite3/synthesized/24.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library sqlite3, aiming to fuzz the following functions: 2 | // sqlite3_vfs_find at sqlite3.c:13060:25 in sqlite3.h 3 | // sqlite3_vfs_register at sqlite3.c:13106:16 in sqlite3.h 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | 18 | extern "C" int LLVMFuzzerTestOneInput_24(const uint8_t *Data, size_t Size) { 19 | if (Size < 1) return 0; 20 | 21 | // Create a dummy VFS name from the input data 22 | char *vfsName = static_cast(malloc(Size + 1)); 23 | if (!vfsName) return 0; 24 | memcpy(vfsName, Data, Size); 25 | vfsName[Size] = '\0'; 26 | 27 | // Find the VFS by name 28 | sqlite3_vfs *vfs = sqlite3_vfs_find(vfsName); 29 | if (vfs) { 30 | // Register the found VFS 31 | sqlite3_vfs_register(vfs, 0); 32 | } 33 | 34 | free(vfsName); 35 | return 0; 36 | } -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2025 Liu, Deng et al. 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. -------------------------------------------------------------------------------- /examples/cjson/synthesized/21.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library cjson, aiming to fuzz the following functions: 2 | // cJSON_CreateObject at cJSON.c:2567:23 in cJSON.h 3 | // cJSON_Delete at cJSON.c:253:20 in cJSON.h 4 | // cJSON_AddNullToObject at cJSON.c:2108:22 in cJSON.h 5 | // cJSON_Delete at cJSON.c:253:20 in cJSON.h 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include "cJSON.h" 16 | 17 | extern "C" int LLVMFuzzerTestOneInput_21(const uint8_t *Data, size_t Size) { 18 | if (Size < 1) { 19 | return 0; 20 | } 21 | 22 | cJSON *obj = cJSON_CreateObject(); 23 | if (obj == NULL) { 24 | return 0; 25 | } 26 | 27 | char *name = (char *)malloc(Size + 1); 28 | if (name == NULL) { 29 | cJSON_Delete(obj); 30 | return 0; 31 | } 32 | memcpy(name, Data, Size); 33 | name[Size] = '\0'; 34 | 35 | cJSON_AddNullToObject(obj, name); 36 | 37 | free(name); 38 | cJSON_Delete(obj); 39 | 40 | return 0; 41 | } -------------------------------------------------------------------------------- /examples/exiv2/synthesized/667.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library exiv2, aiming to fuzz the following functions: 2 | // Exiv2::readFile at basicio.cpp:1703:9 in basicio.hpp 3 | // Exiv2::writeFile at basicio.cpp:1715:8 in basicio.hpp 4 | // Exiv2::DataBuf::reset at types.cpp:104:15 in types.hpp 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | 12 | extern "C" int LLVMFuzzerTestOneInput_667(const uint8_t *Data, size_t Size) { 13 | if (Size < 1) return 0; 14 | 15 | const std::string dummy_file = "./dummy_file"; 16 | std::ofstream out(dummy_file, std::ios::binary); 17 | out.write(reinterpret_cast(Data), Size); 18 | out.close(); 19 | 20 | try { 21 | // Test Exiv2::readFile 22 | Exiv2::DataBuf buf1 = Exiv2::readFile(dummy_file); 23 | 24 | // Test Exiv2::writeFile 25 | Exiv2::writeFile(buf1, dummy_file); 26 | 27 | // Test Exiv2::DataBuf::reset 28 | buf1.reset(); 29 | 30 | } catch (...) { 31 | // Ignore exceptions 32 | } 33 | 34 | return 0; 35 | } -------------------------------------------------------------------------------- /examples/re2/synthesized/48.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library re2, aiming to fuzz the following functions: 2 | // re2::RE2::Octal at re2.h:964:22 in re2.h 3 | // re2::RE2::Octal at re2.h:964:22 in re2.h 4 | // re2::RE2::CRadix at re2.h:950:22 in re2.h 5 | // re2::RE2::CRadix at re2.h:950:22 in re2.h 6 | // re2::RE2::Hex at re2.h:957:22 in re2.h 7 | // re2::RE2::Hex at re2.h:957:22 in re2.h 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include "re2/re2.h" 18 | 19 | extern "C" int LLVMFuzzerTestOneInput_48(const uint8_t *Data, size_t Size) { 20 | if (Size < sizeof(int)) return 0; 21 | 22 | int value = *reinterpret_cast(Data); 23 | 24 | // Invoke RE2::Octal 25 | re2::RE2::Octal(&value); 26 | re2::RE2::Octal(&value); 27 | 28 | // Invoke RE2::CRadix 29 | re2::RE2::CRadix(&value); 30 | re2::RE2::CRadix(&value); 31 | 32 | // Invoke RE2::Hex 33 | re2::RE2::Hex(&value); 34 | re2::RE2::Hex(&value); 35 | 36 | return 0; 37 | } -------------------------------------------------------------------------------- /examples/re2/synthesized/49.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library re2, aiming to fuzz the following functions: 2 | // re2::RE2::Octal at re2.h:964:22 in re2.h 3 | // re2::RE2::Octal at re2.h:964:22 in re2.h 4 | // re2::RE2::CRadix at re2.h:950:22 in re2.h 5 | // re2::RE2::CRadix at re2.h:950:22 in re2.h 6 | // re2::RE2::Hex at re2.h:957:22 in re2.h 7 | // re2::RE2::Hex at re2.h:957:22 in re2.h 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include "re2/re2.h" 18 | 19 | extern "C" int LLVMFuzzerTestOneInput_49(const uint8_t *Data, size_t Size) { 20 | if (Size < sizeof(int)) return 0; 21 | 22 | int value = *reinterpret_cast(Data); 23 | 24 | // Test RE2::Octal 25 | re2::RE2::Octal(&value); 26 | re2::RE2::Octal(&value); 27 | 28 | // Test RE2::CRadix 29 | re2::RE2::CRadix(&value); 30 | re2::RE2::CRadix(&value); 31 | 32 | // Test RE2::Hex 33 | re2::RE2::Hex(&value); 34 | re2::RE2::Hex(&value); 35 | 36 | return 0; 37 | } -------------------------------------------------------------------------------- /examples/c-ares/synthesized/38.c: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library cares, aiming to fuzz the following functions: 2 | // ares_dns_class_tostr at ares_dns_mapping.c:236:13 in ares_dns_record.h 3 | // ares_dns_rec_type_tostr at ares_dns_mapping.c:189:13 in ares_dns_record.h 4 | // ares_dns_section_tostr at ares_dns_mapping.c:737:13 in ares_dns_record.h 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include "ares.h" 11 | #include "ares_dns_record.h" 12 | 13 | int LLVMFuzzerTestOneInput_38(const uint8_t *Data, size_t Size) { 14 | if (Size < 3) { 15 | return 0; 16 | } 17 | 18 | ares_dns_class_t qclass = (ares_dns_class_t)Data[0]; 19 | ares_dns_rec_type_t type = (ares_dns_rec_type_t)Data[1]; 20 | ares_dns_section_t section = (ares_dns_section_t)Data[2]; 21 | 22 | const char *class_str = ares_dns_class_tostr(qclass); 23 | const char *type_str = ares_dns_rec_type_tostr(type); 24 | const char *section_str = ares_dns_section_tostr(section); 25 | 26 | (void)class_str; 27 | (void)type_str; 28 | (void)section_str; 29 | 30 | return 0; 31 | } -------------------------------------------------------------------------------- /examples/re2/synthesized/39.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library re2, aiming to fuzz the following functions: 2 | // re2::RE2::Octal at re2.h:964:22 in re2.h 3 | // re2::RE2::Octal at re2.h:964:22 in re2.h 4 | // re2::RE2::CRadix at re2.h:950:22 in re2.h 5 | // re2::RE2::CRadix at re2.h:950:22 in re2.h 6 | // re2::RE2::Hex at re2.h:957:22 in re2.h 7 | // re2::RE2::Hex at re2.h:957:22 in re2.h 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include "re2/re2.h" 18 | 19 | extern "C" int LLVMFuzzerTestOneInput_39(const uint8_t *Data, size_t Size) { 20 | if (Size < sizeof(int)) return 0; 21 | 22 | int value = *reinterpret_cast(Data); 23 | int* ptr = &value; 24 | 25 | // Test RE2::Octal 26 | re2::RE2::Octal(ptr); 27 | re2::RE2::Octal(ptr); 28 | 29 | // Test RE2::CRadix 30 | re2::RE2::CRadix(ptr); 31 | re2::RE2::CRadix(ptr); 32 | 33 | // Test RE2::Hex 34 | re2::RE2::Hex(ptr); 35 | re2::RE2::Hex(ptr); 36 | 37 | return 0; 38 | } -------------------------------------------------------------------------------- /examples/re2/synthesized/43.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library re2, aiming to fuzz the following functions: 2 | // re2::RE2::Octal at re2.h:964:22 in re2.h 3 | // re2::RE2::Octal at re2.h:964:22 in re2.h 4 | // re2::RE2::CRadix at re2.h:950:22 in re2.h 5 | // re2::RE2::CRadix at re2.h:950:22 in re2.h 6 | // re2::RE2::Hex at re2.h:957:22 in re2.h 7 | // re2::RE2::Hex at re2.h:957:22 in re2.h 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include "re2/re2.h" 18 | 19 | extern "C" int LLVMFuzzerTestOneInput_43(const uint8_t *Data, size_t Size) { 20 | if (Size < sizeof(int)) return 0; 21 | 22 | int value; 23 | memcpy(&value, Data, sizeof(int)); 24 | 25 | // Test RE2::Octal 26 | re2::RE2::Octal(&value); 27 | re2::RE2::Octal(&value); 28 | 29 | // Test RE2::CRadix 30 | re2::RE2::CRadix(&value); 31 | re2::RE2::CRadix(&value); 32 | 33 | // Test RE2::Hex 34 | re2::RE2::Hex(&value); 35 | re2::RE2::Hex(&value); 36 | 37 | return 0; 38 | } -------------------------------------------------------------------------------- /examples/rapidcsv/build_additional_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | if [ -z "$AFLPP_PATH" ]; then 3 | AFL_CLANG_FAST_PATH=$(command -v afl-clang-fast) 4 | if [ -z "$AFL_CLANG_FAST_PATH" ]; then 5 | echo "Please install AFL++ and set AFLPP_PATH" && exit 1 6 | fi 7 | AFLPP_PATH=$(dirname "$AFL_CLANG_FAST_PATH") 8 | fi 9 | cd /promefuzz 10 | # aflpp 11 | AFL_LLVM_USE_TRACE_PC=1 AFL_USE_ASAN=1 $AFLPP_PATH/afl-clang-fast++ /promefuzz/database/rapidcsv/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/rapidcsv/latest/out/fuzz_driver/aflpp_synthesized_driver -fsanitize=fuzzer -g -I/promefuzz/database/rapidcsv/latest/code/src 12 | # gcov 13 | clang++ /promefuzz/database/rapidcsv/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/rapidcsv/latest/out/fuzz_driver/gcov_synthesized_driver --coverage -fsanitize=fuzzer -g -I/promefuzz/database/rapidcsv/latest/code/src 14 | # cov 15 | clang++ /promefuzz/database/rapidcsv/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/rapidcsv/latest/out/fuzz_driver/cov_synthesized_driver -fprofile-instr-generate -fcoverage-mapping -fsanitize=fuzzer -g -I/promefuzz/database/rapidcsv/latest/code/src -------------------------------------------------------------------------------- /examples/re2/synthesized/12.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library re2, aiming to fuzz the following functions: 2 | // re2::RE2::Extract at re2.cc:537:11 in re2.h 3 | // re2::RE2::Replace at re2.cc:445:11 in re2.h 4 | // re2::RE2::GlobalReplace at re2.cc:467:10 in re2.h 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include "re2/re2.h" 15 | #include 16 | #include 17 | 18 | extern "C" int LLVMFuzzerTestOneInput_12(const uint8_t *Data, size_t Size) { 19 | if (Size < 1) return 0; 20 | 21 | std::string input(reinterpret_cast(Data), Size); 22 | std::string pattern = "a+"; 23 | std::string rewrite = "b"; 24 | std::string output; 25 | 26 | re2::RE2 re(pattern); 27 | 28 | // Test RE2::Extract 29 | re2::RE2::Extract(input, re, rewrite, &output); 30 | 31 | // Test RE2::Replace 32 | re2::RE2::Replace(&input, re, rewrite); 33 | 34 | // Test RE2::GlobalReplace 35 | re2::RE2::GlobalReplace(&input, re, rewrite); 36 | 37 | return 0; 38 | } -------------------------------------------------------------------------------- /examples/libtiff/synthesized/97.c: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library libtiff, aiming to fuzz the following functions: 2 | // TIFFClose at tif_close.c:156:6 in tiffio.h 3 | // TIFFFileno at tif_open.c:813:5 in tiffio.h 4 | // TIFFGetMode at tif_open.c:843:5 in tiffio.h 5 | // TIFFFreeDirectory at tif_dir.c:1619:6 in tiffio.h 6 | // TIFFCreateDirectory at tif_dir.c:1688:5 in tiffio.h 7 | // TIFFRewriteDirectory at tif_dirwrite.c:480:5 in tiffio.h 8 | // TIFFOpen at tif_unix.c:228:7 in tiffio.h 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include "tiffio.h" 16 | 17 | int LLVMFuzzerTestOneInput_97(const uint8_t *Data, size_t Size) { 18 | FILE *file = fopen("./dummy_file", "wb"); 19 | if (file) { 20 | fwrite(Data, 1, Size, file); 21 | fclose(file); 22 | } 23 | 24 | TIFF *tif = TIFFOpen("./dummy_file", "w+"); 25 | if (!tif) return 0; 26 | 27 | TIFFGetMode(tif); 28 | TIFFCreateDirectory(tif); 29 | TIFFRewriteDirectory(tif); 30 | TIFFFileno(tif); 31 | TIFFFreeDirectory(tif); 32 | 33 | TIFFClose(tif); 34 | return 0; 35 | } -------------------------------------------------------------------------------- /examples/re2/synthesized/38.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library re2, aiming to fuzz the following functions: 2 | // re2::RE2::Options::set_one_line at re2.h:733:10 in re2.h 3 | // re2::RE2::Options::set_never_capture at re2.h:721:10 in re2.h 4 | // re2::RE2::Options::set_literal at re2.h:712:10 in re2.h 5 | // re2::RE2::Options::set_log_errors at re2.h:709:10 in re2.h 6 | // re2::RE2::Options::set_dot_nl at re2.h:718:10 in re2.h 7 | // re2::RE2::Options::Copy at re2.h:735:10 in re2.h 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include "re2/re2.h" 18 | 19 | extern "C" int LLVMFuzzerTestOneInput_38(const uint8_t *Data, size_t Size) { 20 | if (Size < 1) return 0; 21 | 22 | re2::RE2::Options options; 23 | bool b = Data[0] & 1; 24 | 25 | options.set_one_line(b); 26 | options.set_never_capture(b); 27 | options.set_literal(b); 28 | options.set_log_errors(b); 29 | options.set_dot_nl(b); 30 | 31 | re2::RE2::Options src_options; 32 | options.Copy(src_options); 33 | 34 | return 0; 35 | } -------------------------------------------------------------------------------- /examples/re2/synthesized/31.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library re2, aiming to fuzz the following functions: 2 | // re2::RE2::Hex at re2.h:957:22 in re2.h 3 | // re2::RE2::Hex at re2.h:957:22 in re2.h 4 | // re2::RE2::CRadix at re2.h:950:22 in re2.h 5 | // re2::RE2::CRadix at re2.h:950:22 in re2.h 6 | // re2::RE2::Octal at re2.h:964:22 in re2.h 7 | // re2::RE2::Octal at re2.h:964:22 in re2.h 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include "re2/re2.h" 18 | 19 | extern "C" int LLVMFuzzerTestOneInput_31(const uint8_t *Data, size_t Size) { 20 | if (Size < sizeof(int)) return 0; 21 | 22 | int value; 23 | memcpy(&value, Data, sizeof(int)); 24 | 25 | // Invoke RE2::Hex overloads 26 | re2::RE2::Hex(&value); 27 | re2::RE2::Hex(&value); 28 | 29 | // Invoke RE2::CRadix overloads 30 | re2::RE2::CRadix(&value); 31 | re2::RE2::CRadix(&value); 32 | 33 | // Invoke RE2::Octal overloads 34 | re2::RE2::Octal(&value); 35 | re2::RE2::Octal(&value); 36 | 37 | return 0; 38 | } -------------------------------------------------------------------------------- /examples/re2/synthesized/34.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library re2, aiming to fuzz the following functions: 2 | // re2::RE2::Hex at re2.h:957:22 in re2.h 3 | // re2::RE2::Hex at re2.h:957:22 in re2.h 4 | // re2::RE2::CRadix at re2.h:950:22 in re2.h 5 | // re2::RE2::CRadix at re2.h:950:22 in re2.h 6 | // re2::RE2::Octal at re2.h:964:22 in re2.h 7 | // re2::RE2::Octal at re2.h:964:22 in re2.h 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include "re2/re2.h" 18 | 19 | extern "C" int LLVMFuzzerTestOneInput_34(const uint8_t *Data, size_t Size) { 20 | if (Size < sizeof(int)) return 0; 21 | 22 | int value; 23 | memcpy(&value, Data, sizeof(int)); 24 | 25 | // Invoke RE2::Hex overloads 26 | re2::RE2::Hex(&value); 27 | re2::RE2::Hex(&value); 28 | 29 | // Invoke RE2::CRadix overloads 30 | re2::RE2::CRadix(&value); 31 | re2::RE2::CRadix(&value); 32 | 33 | // Invoke RE2::Octal overloads 34 | re2::RE2::Octal(&value); 35 | re2::RE2::Octal(&value); 36 | 37 | return 0; 38 | } -------------------------------------------------------------------------------- /examples/cjson/synthesized/36.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library cjson, aiming to fuzz the following functions: 2 | // cJSON_IsString at cJSON.c:2990:26 in cJSON.h 3 | // cJSON_IsArray at cJSON.c:3000:26 in cJSON.h 4 | // cJSON_IsInvalid at cJSON.c:2930:26 in cJSON.h 5 | // cJSON_IsNull at cJSON.c:2970:26 in cJSON.h 6 | // cJSON_IsNumber at cJSON.c:2980:26 in cJSON.h 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include "cJSON.h" 17 | 18 | extern "C" int LLVMFuzzerTestOneInput_36(const uint8_t *Data, size_t Size) { 19 | if (Size < 1) return 0; 20 | 21 | // Create a dummy cJSON item with type based on input data 22 | cJSON item; 23 | item.type = Data[0] % 6; // 0: Invalid, 1: Null, 2: Number, 3: String, 4: Array, 5: Object 24 | item.valuestring = nullptr; 25 | item.valuedouble = 0.0; 26 | 27 | // Call the target functions 28 | cJSON_IsString(&item); 29 | cJSON_IsArray(&item); 30 | cJSON_IsInvalid(&item); 31 | cJSON_IsNull(&item); 32 | cJSON_IsNumber(&item); 33 | 34 | return 0; 35 | } -------------------------------------------------------------------------------- /examples/re2/synthesized/17.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library re2, aiming to fuzz the following functions: 2 | // re2::RE2::Options::case_sensitive at re2.h:723:10 in re2.h 3 | // re2::RE2::Options::log_errors at re2.h:708:10 in re2.h 4 | // re2::RE2::Options::never_capture at re2.h:720:10 in re2.h 5 | // re2::RE2::Options::longest_match at re2.h:705:10 in re2.h 6 | // re2::RE2::Options::perl_classes at re2.h:726:10 in re2.h 7 | // re2::RE2::Options::literal at re2.h:711:10 in re2.h 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include "re2/re2.h" 18 | 19 | extern "C" int LLVMFuzzerTestOneInput_17(const uint8_t *Data, size_t Size) { 20 | re2::RE2::Options options(re2::RE2::DefaultOptions); 21 | 22 | bool case_sensitive = options.case_sensitive(); 23 | bool log_errors = options.log_errors(); 24 | bool never_capture = options.never_capture(); 25 | bool longest_match = options.longest_match(); 26 | bool perl_classes = options.perl_classes(); 27 | bool literal = options.literal(); 28 | 29 | return 0; 30 | } -------------------------------------------------------------------------------- /examples/zlib/synthesized/42.c: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library zlib, aiming to fuzz the following functions: 2 | // gzopen at gzlib.c:263:16 in zlib.h 3 | // gzoffset at gzlib.c:467:17 in zlib.h 4 | // gztell at gzlib.c:438:17 in zlib.h 5 | // gzseek at gzlib.c:415:17 in zlib.h 6 | // gzclose at gzclose.c:11:13 in zlib.h 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | 17 | #define ZLIB_WINAPI 18 | #define Z_LARGE64 19 | 20 | int LLVMFuzzerTestOneInput_42(const uint8_t *Data, size_t Size) { 21 | if (Size < 1) return 0; 22 | 23 | FILE *file = fopen("./dummy_file", "wb"); 24 | if (!file) return 0; 25 | fwrite(Data, 1, Size, file); 26 | fclose(file); 27 | 28 | gzFile gz = gzopen("./dummy_file", "rb"); 29 | if (!gz) { 30 | remove("./dummy_file"); 31 | return 0; 32 | } 33 | 34 | z_off_t offset = gzoffset(gz); 35 | z_off_t tell = gztell(gz); 36 | z_off_t seek = gzseek(gz, Size / 2, SEEK_SET); 37 | 38 | gzclose(gz); 39 | remove("./dummy_file"); 40 | 41 | return 0; 42 | } -------------------------------------------------------------------------------- /examples/zlib/synthesized/45.c: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library zlib, aiming to fuzz the following functions: 2 | // gzopen at gzlib.c:263:16 in zlib.h 3 | // gzoffset at gzlib.c:467:17 in zlib.h 4 | // gztell at gzlib.c:438:17 in zlib.h 5 | // gzseek at gzlib.c:415:17 in zlib.h 6 | // gzclose at gzclose.c:11:13 in zlib.h 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | 17 | #define ZLIB_CONST 18 | #include 19 | 20 | int LLVMFuzzerTestOneInput_45(const uint8_t *Data, size_t Size) { 21 | if (Size < 1) return 0; 22 | 23 | FILE *file = fopen("./dummy_file", "wb"); 24 | if (!file) return 0; 25 | fwrite(Data, 1, Size, file); 26 | fclose(file); 27 | 28 | gzFile gz = gzopen("./dummy_file", "rb"); 29 | if (!gz) { 30 | remove("./dummy_file"); 31 | return 0; 32 | } 33 | 34 | z_off_t offset = gzoffset(gz); 35 | z_off_t tell = gztell(gz); 36 | z_off_t seek = gzseek(gz, Size / 2, SEEK_SET); 37 | 38 | gzclose(gz); 39 | remove("./dummy_file"); 40 | 41 | return 0; 42 | } -------------------------------------------------------------------------------- /examples/exiv2/synthesized/229.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library exiv2, aiming to fuzz the following functions: 2 | // Exiv2::Internal::PtrSliceStorage::unsafeGetIteratorAt at slice.hpp:363:26 in slice.hpp 3 | // Exiv2::Internal::PtrSliceStorage::unsafeAt at slice.hpp:349:29 in slice.hpp 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | 10 | extern "C" int LLVMFuzzerTestOneInput_229(const uint8_t *Data, size_t Size) { 11 | if (Size < 1) return 0; 12 | 13 | try { 14 | // Create a dummy vector to use as storage 15 | std::vector vec(Data, Data + Size); 16 | Exiv2::byte* data = vec.data(); 17 | size_t begin = 0; 18 | size_t end = Size; 19 | 20 | // Create PtrSliceStorage object 21 | Exiv2::Internal::PtrSliceStorage storage(data, begin, end); 22 | 23 | // Test PtrSliceStorage functions 24 | size_t index = Data[0] % Size; 25 | (void)storage.unsafeGetIteratorAt(index); 26 | (void)storage.unsafeAt(index); 27 | 28 | } catch (...) { 29 | // Ignore all exceptions 30 | } 31 | 32 | return 0; 33 | } -------------------------------------------------------------------------------- /examples/re2/synthesized/47.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library re2, aiming to fuzz the following functions: 2 | // re2::RE2::Octal at re2.h:964:22 in re2.h 3 | // re2::RE2::Octal at re2.h:964:22 in re2.h 4 | // re2::RE2::CRadix at re2.h:950:22 in re2.h 5 | // re2::RE2::CRadix at re2.h:950:22 in re2.h 6 | // re2::RE2::Hex at re2.h:957:22 in re2.h 7 | // re2::RE2::Hex at re2.h:957:22 in re2.h 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include "re2/re2.h" 18 | #include 19 | #include 20 | 21 | extern "C" int LLVMFuzzerTestOneInput_47(const uint8_t *Data, size_t Size) { 22 | if (Size < sizeof(int)) return 0; 23 | 24 | int value = *reinterpret_cast(Data); 25 | int* ptr = &value; 26 | 27 | // Test RE2::Octal 28 | re2::RE2::Octal(ptr); 29 | re2::RE2::Octal(ptr); 30 | 31 | // Test RE2::CRadix 32 | re2::RE2::CRadix(ptr); 33 | re2::RE2::CRadix(ptr); 34 | 35 | // Test RE2::Hex 36 | re2::RE2::Hex(ptr); 37 | re2::RE2::Hex(ptr); 38 | 39 | return 0; 40 | } -------------------------------------------------------------------------------- /examples/cjson/synthesized/16.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library cjson, aiming to fuzz the following functions: 2 | // cJSON_CreateObject at cJSON.c:2567:23 in cJSON.h 3 | // cJSON_AddFalseToObject at cJSON.c:2132:22 in cJSON.h 4 | // cJSON_Delete at cJSON.c:253:20 in cJSON.h 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include "cJSON.h" 15 | 16 | extern "C" int LLVMFuzzerTestOneInput_16(const uint8_t *Data, size_t Size) { 17 | if (Size < 1) { 18 | return 0; 19 | } 20 | 21 | // Create a cJSON object 22 | cJSON *json_object = cJSON_CreateObject(); 23 | if (!json_object) { 24 | return 0; 25 | } 26 | 27 | // Generate a dummy name for the false value 28 | char name[256]; 29 | for (size_t i = 0; i < Size && i < 255; ++i) { 30 | name[i] = Data[i]; 31 | } 32 | name[Size < 255 ? Size : 255] = '\0'; 33 | 34 | // Add a false value to the object 35 | cJSON_AddFalseToObject(json_object, name); 36 | 37 | // Clean up 38 | cJSON_Delete(json_object); 39 | 40 | return 0; 41 | } -------------------------------------------------------------------------------- /examples/cjson/synthesized/39.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library cjson, aiming to fuzz the following functions: 2 | // cJSON_IsString at cJSON.c:2990:26 in cJSON.h 3 | // cJSON_IsBool at cJSON.c:2961:26 in cJSON.h 4 | // cJSON_IsInvalid at cJSON.c:2930:26 in cJSON.h 5 | // cJSON_IsTrue at cJSON.c:2950:26 in cJSON.h 6 | // cJSON_IsFalse at cJSON.c:2940:26 in cJSON.h 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include "cJSON.h" 17 | #include 18 | #include 19 | 20 | extern "C" int LLVMFuzzerTestOneInput_39(const uint8_t *Data, size_t Size) { 21 | if (Size < 1) return 0; 22 | 23 | // Create a dummy cJSON item with a type based on the input data 24 | cJSON item; 25 | item.type = Data[0] % 7; // Random type based on input 26 | item.valuestring = nullptr; 27 | item.valuedouble = 0.0; 28 | 29 | // Call the target functions 30 | cJSON_IsString(&item); 31 | cJSON_IsBool(&item); 32 | cJSON_IsInvalid(&item); 33 | cJSON_IsTrue(&item); 34 | cJSON_IsFalse(&item); 35 | 36 | return 0; 37 | } -------------------------------------------------------------------------------- /examples/libpng/synthesized/9.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library libpng, aiming to fuzz the following functions: 2 | // png_create_read_struct at pngread.c:24:1 in png.h 3 | // png_create_info_struct at png.c:361:1 in png.h 4 | // png_destroy_read_struct at pngread.c:825:1 in png.h 5 | // png_destroy_read_struct at pngread.c:825:1 in png.h 6 | // png_set_mem_fn at pngmem.c:258:1 in png.h 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | 18 | extern "C" int LLVMFuzzerTestOneInput_9(const uint8_t *Data, size_t Size) { 19 | png_structp png_ptr = png_create_read_struct(PNG_LIBPNG_VER_STRING, nullptr, nullptr, nullptr); 20 | if (!png_ptr) { 21 | return 0; 22 | } 23 | 24 | png_infop info_ptr = png_create_info_struct(png_ptr); 25 | if (!info_ptr) { 26 | png_destroy_read_struct(&png_ptr, nullptr, nullptr); 27 | return 0; 28 | } 29 | 30 | png_destroy_read_struct(&png_ptr, &info_ptr, nullptr); 31 | 32 | png_set_mem_fn(png_ptr, nullptr, nullptr, nullptr); 33 | 34 | return 0; 35 | } -------------------------------------------------------------------------------- /examples/c-ares/synthesized/24.c: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library cares, aiming to fuzz the following functions: 2 | // ares_strerror at ares_strerror.c:30:13 in ares.h 3 | // ares_inet_ntop at inet_ntop.c:64:20 in ares.h 4 | // ares_freeaddrinfo at ares_freeaddrinfo.c:57:6 in ares.h 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | 15 | int LLVMFuzzerTestOneInput_24(const uint8_t *Data, size_t Size) { 16 | if (Size < 1) return 0; 17 | 18 | // Initialize variables for ares_inet_ntop 19 | int af = (Data[0] % 2) ? AF_INET : AF_INET6; 20 | char src[16]; 21 | char dst[INET6_ADDRSTRLEN]; 22 | ares_socklen_t size = sizeof(dst); 23 | memcpy(src, Data + 1, Size - 1 < sizeof(src) ? Size - 1 : sizeof(src)); 24 | 25 | // Call ares_strerror 26 | const char *error_msg = ares_strerror((int)Data[0]); 27 | 28 | // Call ares_inet_ntop 29 | const char *result = ares_inet_ntop(af, src, dst, size); 30 | 31 | // Call ares_freeaddrinfo 32 | struct ares_addrinfo *ai = NULL; 33 | ares_freeaddrinfo(ai); 34 | 35 | return 0; 36 | } -------------------------------------------------------------------------------- /examples/c-ares/synthesized/42.c: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library cares, aiming to fuzz the following functions: 2 | // ares_mkquery at ares_create_query.c:74:5 in ares.h 3 | // ares_free_string at ares_free_string.c:30:6 in ares.h 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | 14 | int LLVMFuzzerTestOneInput_42(const uint8_t *Data, size_t Size) { 15 | if (Size < 1) { 16 | return 0; 17 | } 18 | 19 | // Ensure the input is null-terminated 20 | char *name = malloc(Size + 1); 21 | if (name == NULL) { 22 | return 0; 23 | } 24 | memcpy(name, Data, Size); 25 | name[Size] = '\0'; 26 | 27 | int dnsclass = 1; // IN class 28 | int type = 1; // A type 29 | unsigned short id = 1234; 30 | int rd = 1; // recursion desired 31 | unsigned char *buf = NULL; 32 | int buflen = 0; 33 | 34 | int result = ares_mkquery(name, dnsclass, type, id, rd, &buf, &buflen); 35 | if (result == ARES_SUCCESS && buf != NULL) { 36 | ares_free_string(buf); 37 | } 38 | 39 | free(name); 40 | return 0; 41 | } -------------------------------------------------------------------------------- /examples/exiv2/synthesized/687.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library exiv2, aiming to fuzz the following functions: 2 | // Exiv2::l2Data at types.cpp:389:8 in types.hpp 3 | // Exiv2::DataValue::copy at value.cpp:124:19 in value.hpp 4 | // Exiv2::toData at value.hpp:1420:15 in value.hpp 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | extern "C" int LLVMFuzzerTestOneInput_687(const uint8_t *data, size_t size) { 12 | if (size < 4) return 0; 13 | 14 | // Initialize variables from fuzz input 15 | int32_t l = *reinterpret_cast(data); 16 | Exiv2::ByteOrder byteOrder = size % 2 ? Exiv2::littleEndian : Exiv2::bigEndian; 17 | size_t bufSize = size > 8 ? 8 : size; 18 | Exiv2::byte buf[8]; 19 | memcpy(buf, data, bufSize); 20 | 21 | // Test l2Data 22 | Exiv2::byte output[4]; 23 | Exiv2::l2Data(output, l, byteOrder); 24 | 25 | // Test DataValue functions 26 | Exiv2::DataValue dataValue; 27 | 28 | // Test copy 29 | Exiv2::byte copyBuf[128]; 30 | dataValue.copy(copyBuf, byteOrder); 31 | 32 | // Test toData 33 | Exiv2::toData(buf, l, byteOrder); 34 | 35 | return 0; 36 | } -------------------------------------------------------------------------------- /examples/c-ares/synthesized/27.c: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library cares, aiming to fuzz the following functions: 2 | // ares_library_initialized at ares_library_init.c:161:5 in ares.h 3 | // ares_library_init at ares_library_init.c:108:5 in ares.h 4 | // ares_library_initialized at ares_library_init.c:161:5 in ares.h 5 | // ares_library_cleanup at ares_library_init.c:139:6 in ares.h 6 | // ares_library_initialized at ares_library_init.c:161:5 in ares.h 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | 15 | int LLVMFuzzerTestOneInput_27(const uint8_t *Data, size_t Size) { 16 | // Check if the library is initialized 17 | int initialized_status = ares_library_initialized(); 18 | 19 | // Initialize the library 20 | int init_status = ares_library_init(0); 21 | 22 | // Check if the library is initialized again 23 | initialized_status = ares_library_initialized(); 24 | 25 | // Cleanup the library 26 | ares_library_cleanup(); 27 | 28 | // Check if the library is initialized one last time 29 | initialized_status = ares_library_initialized(); 30 | 31 | return 0; 32 | } -------------------------------------------------------------------------------- /src/tests/test_Summarize.py: -------------------------------------------------------------------------------- 1 | from src import vars as global_vars 2 | from src.utils import setup_llm 3 | from src.comprehender.prompter import LibPurposePrompter 4 | from src.generator.llm import Chat 5 | 6 | def get_top_100_lines(readme: str): 7 | lines = readme.split("\n") 8 | if len(lines) <= 100: 9 | return readme 10 | return "\n".join(lines[:100]) 11 | 12 | def run(): 13 | llm_client = setup_llm("llama3_2_remote") 14 | 15 | # ===pugixml=== 16 | prompter = LibPurposePrompter(Chat(llm_client)) 17 | with open("/promefuzz/library/pugixml/README.md") as f: 18 | readme = get_top_100_lines(f.read()) 19 | summary = prompter.prompt("pugixml", readme) 20 | print(summary) 21 | 22 | # ===cJSON=== 23 | prompter = LibPurposePrompter(Chat(llm_client)) 24 | with open("library/cJSON/README.md") as f: 25 | readme = get_top_100_lines(f.read()) 26 | summary = prompter.prompt("cJSON", readme) 27 | print(summary) 28 | 29 | # ===racoon2=== 30 | prompter = LibPurposePrompter(Chat(llm_client)) 31 | with open("/promefuzz/library/racoon/racoon2/README.md") as f: 32 | readme = get_top_100_lines(f.read()) 33 | summary = prompter.prompt("racoon2", readme) 34 | print(summary) -------------------------------------------------------------------------------- /examples/exiv2/synthesized/41.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library exiv2, aiming to fuzz the following functions: 2 | // Exiv2::LogMsg::setLevel at error.cpp:118:14 in error.hpp 3 | // Exiv2::XmpParser::initialize at xmp.cpp:512:17 in xmp_exiv2.hpp 4 | // Exiv2::ImageFactory::open at image.cpp:866:32 in image.hpp 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | 18 | extern "C" int LLVMFuzzerTestOneInput_41(const uint8_t *Data, size_t Size) { 19 | // Set log level to mute to suppress all logs 20 | Exiv2::LogMsg::setLevel(Exiv2::LogMsg::Level::mute); 21 | 22 | // Initialize XMP parser 23 | Exiv2::XmpParser::initialize(); 24 | 25 | try { 26 | // Attempt to open the image using the provided data 27 | Exiv2::Image::UniquePtr image = Exiv2::ImageFactory::open(Data, Size); 28 | if (image.get() != nullptr) { 29 | image->readMetadata(); 30 | } 31 | } catch (const Exiv2::Error&) { 32 | // Ignore all errors 33 | } 34 | 35 | return 0; 36 | } -------------------------------------------------------------------------------- /examples/libpcap/synthesized/21.c: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library libpcap, aiming to fuzz the following functions: 2 | // pcap_open_live at pcap.c:2749:1 in pcap.h 3 | // pcap_set_promisc at pcap.c:2544:1 in pcap.h 4 | // pcap_set_snaplen at pcap.c:2535:1 in pcap.h 5 | // pcap_set_timeout at pcap.c:2562:1 in pcap.h 6 | // pcap_set_rfmon at pcap.c:2553:1 in pcap.h 7 | // pcap_close at pcap.c:4156:1 in pcap.h 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | 15 | int LLVMFuzzerTestOneInput_21(const uint8_t *Data, size_t Size) { 16 | if (Size < 1) return 0; 17 | 18 | char errbuf[PCAP_ERRBUF_SIZE]; 19 | pcap_t *pcap_handle = pcap_open_live("any", 65535, 1, 1000, errbuf); 20 | if (pcap_handle == NULL) return 0; 21 | 22 | int promisc = Data[0] & 1; 23 | int snaplen = (Data[0] >> 1) & 0x7F; 24 | int timeout = (Data[0] >> 8) & 0x7F; 25 | int rfmon = (Data[0] >> 16) & 1; 26 | 27 | pcap_set_promisc(pcap_handle, promisc); 28 | pcap_set_snaplen(pcap_handle, snaplen); 29 | pcap_set_timeout(pcap_handle, timeout); 30 | pcap_set_rfmon(pcap_handle, rfmon); 31 | 32 | pcap_close(pcap_handle); 33 | 34 | return 0; 35 | } -------------------------------------------------------------------------------- /examples/re2/synthesized/27.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library re2, aiming to fuzz the following functions: 2 | // re2::RE2::Hex at re2.h:957:22 in re2.h 3 | // re2::RE2::Hex at re2.h:957:22 in re2.h 4 | // re2::RE2::CRadix at re2.h:950:22 in re2.h 5 | // re2::RE2::CRadix at re2.h:950:22 in re2.h 6 | // re2::RE2::Octal at re2.h:964:22 in re2.h 7 | // re2::RE2::Octal at re2.h:964:22 in re2.h 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include "re2/re2.h" 18 | #include 19 | #include 20 | 21 | extern "C" int LLVMFuzzerTestOneInput_27(const uint8_t *Data, size_t Size) { 22 | if (Size < sizeof(int)) { 23 | return 0; 24 | } 25 | 26 | int value; 27 | memcpy(&value, Data, sizeof(int)); 28 | 29 | // Invoke RE2::Hex overloads 30 | re2::RE2::Hex(&value); 31 | re2::RE2::Hex(&value); 32 | 33 | // Invoke RE2::CRadix overloads 34 | re2::RE2::CRadix(&value); 35 | re2::RE2::CRadix(&value); 36 | 37 | // Invoke RE2::Octal overloads 38 | re2::RE2::Octal(&value); 39 | re2::RE2::Octal(&value); 40 | 41 | return 0; 42 | } -------------------------------------------------------------------------------- /examples/sqlite3/synthesized/111.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library sqlite3, aiming to fuzz the following functions: 2 | // sqlite3_mutex_alloc at sqlite3.c:15684:27 in sqlite3.h 3 | // sqlite3_mutex_try at sqlite3.c:15727:16 in sqlite3.h 4 | // sqlite3_mutex_leave at sqlite3.c:15742:17 in sqlite3.h 5 | // sqlite3_mutex_enter at sqlite3.c:15716:17 in sqlite3.h 6 | // sqlite3_mutex_leave at sqlite3.c:15742:17 in sqlite3.h 7 | // sqlite3_mutex_free at sqlite3.c:15705:17 in sqlite3.h 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | #include 19 | 20 | extern "C" int LLVMFuzzerTestOneInput_111(const uint8_t *Data, size_t Size) { 21 | if (Size < 1) return 0; 22 | 23 | int mutex_type = Data[0] % 15; 24 | sqlite3_mutex *mutex = sqlite3_mutex_alloc(mutex_type); 25 | if (!mutex) return 0; 26 | 27 | if (sqlite3_mutex_try(mutex) == SQLITE_OK) { 28 | sqlite3_mutex_leave(mutex); 29 | } 30 | 31 | sqlite3_mutex_enter(mutex); 32 | sqlite3_mutex_leave(mutex); 33 | 34 | sqlite3_mutex_free(mutex); 35 | 36 | return 0; 37 | } -------------------------------------------------------------------------------- /database/pugixml/in/Project Import.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 1 6 | ZYNK 7 | ZYNK PROJECT 8 | ZYNK PROJECT - INTEGRATION 9 | 2014-01-13T00:00:00 10 | 2014-01-14T00:00:00 11 | ACTIVE 12 | ZYNK0001 13 | SECONDREF 14 | 15 | Mr Chris Hotchkiss 16 | Nelson House, Fleming Business Centre 17 | Jesmond 18 | Newcastle upon Tyne 19 | Tyne & Wear 20 | NE2 3AE 21 | 0845 123 2920 22 | 0845 123 2921 23 | support@zynk.com 24 | GB 25 | 26 | 6778 27 | ANALYSIS1 28 | ANALYSIS2 29 | ANALYSIS3 30 | 31 | 32 | -------------------------------------------------------------------------------- /examples/exiv2/synthesized/362.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library exiv2, aiming to fuzz the following functions: 2 | // Exiv2::FileIo::size at basicio.cpp:506:16 in basicio.hpp 3 | // Exiv2::RemoteIo::path at basicio.cpp:1361:30 in basicio.hpp 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | 17 | extern "C" int LLVMFuzzerTestOneInput_362(const uint8_t *Data, size_t Size) { 18 | if (Size < 1) return 0; 19 | 20 | // Create a dummy file 21 | std::ofstream dummy_file("./dummy_file", std::ios::binary); 22 | dummy_file.write(reinterpret_cast(Data), Size); 23 | dummy_file.close(); 24 | 25 | // Test FileIo 26 | try { 27 | Exiv2::FileIo fileIo("./dummy_file"); 28 | fileIo.size(); // Test size() 29 | } catch (...) {} 30 | 31 | // Test RemoteIo - only test path() since other methods require proper initialization 32 | try { 33 | Exiv2::RemoteIo remoteIo; 34 | remoteIo.path(); // Test path() 35 | } catch (...) {} 36 | 37 | return 0; 38 | } -------------------------------------------------------------------------------- /examples/cjson/build_additional_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | if [ -z "$AFLPP_PATH" ]; then 3 | AFL_CLANG_FAST_PATH=$(command -v afl-clang-fast) 4 | if [ -z "$AFL_CLANG_FAST_PATH" ]; then 5 | echo "Please install AFL++ and set AFLPP_PATH" && exit 1 6 | fi 7 | AFLPP_PATH=$(dirname "$AFL_CLANG_FAST_PATH") 8 | fi 9 | cd /promefuzz 10 | # aflpp 11 | AFL_LLVM_USE_TRACE_PC=1 AFL_USE_ASAN=1 $AFLPP_PATH/afl-clang-fast++ /promefuzz/database/cjson/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/cjson/latest/out/fuzz_driver/aflpp_synthesized_driver -fsanitize=fuzzer -g -I/promefuzz/database/cjson/latest/code database/cjson/latest/bin_aflpp/lib/libcjson.a 12 | # gcov 13 | clang++ /promefuzz/database/cjson/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/cjson/latest/out/fuzz_driver/gcov_synthesized_driver --coverage -fsanitize=fuzzer -g -I/promefuzz/database/cjson/latest/code database/cjson/latest/bin_gcov/lib/libcjson.a 14 | # cov 15 | clang++ /promefuzz/database/cjson/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/cjson/latest/out/fuzz_driver/cov_synthesized_driver -fprofile-instr-generate -fcoverage-mapping -fsanitize=fuzzer -g -I/promefuzz/database/cjson/latest/code database/cjson/latest/bin_cov/lib/libcjson.a -------------------------------------------------------------------------------- /examples/exiv2/synthesized/22.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library exiv2, aiming to fuzz the following functions: 2 | // Exiv2::ExifKey::tagName at tags.cpp:291:22 in tags.hpp 3 | // Exiv2::ExifKey::tag at tags.cpp:313:19 in tags.hpp 4 | // Exiv2::ExifTags::ifdName at tags.cpp:91:23 in tags.hpp 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | 18 | extern "C" int LLVMFuzzerTestOneInput_22(const uint8_t *Data, size_t Size) { 19 | if (Size < 1) return 0; 20 | 21 | try { 22 | // Create a dummy ExifKey 23 | std::string groupName(reinterpret_cast(Data), Size); 24 | Exiv2::ExifKey key(groupName); 25 | 26 | // Invoke functions in specified order 27 | std::string tagName = key.tagName(); 28 | uint16_t tag = key.tag(); 29 | const char* ifdName = Exiv2::ExifTags::ifdName(groupName); 30 | 31 | (void)tagName; 32 | (void)tag; 33 | (void)ifdName; 34 | } catch (...) { 35 | // Ignore exceptions 36 | } 37 | 38 | return 0; 39 | } -------------------------------------------------------------------------------- /examples/exiv2/synthesized/602.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library exiv2, aiming to fuzz the following functions: 2 | // Exiv2::readFile at basicio.cpp:1703:9 in basicio.hpp 3 | // Exiv2::writeFile at basicio.cpp:1715:8 in basicio.hpp 4 | // Exiv2::DataBuf::reset at types.cpp:104:15 in types.hpp 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | 12 | extern "C" int LLVMFuzzerTestOneInput_602(const uint8_t *Data, size_t Size) { 13 | if (Size < 1) return 0; 14 | 15 | const std::string dummy_file = "./dummy_file"; 16 | std::ofstream out(dummy_file, std::ios::binary); 17 | out.write(reinterpret_cast(Data), Size); 18 | out.close(); 19 | 20 | try { 21 | // Test Exiv2::readFile 22 | Exiv2::DataBuf buf1 = Exiv2::readFile(dummy_file); 23 | 24 | // Test Exiv2::writeFile 25 | Exiv2::writeFile(buf1, dummy_file); 26 | 27 | // Test Exiv2::DataBuf::reset 28 | buf1.reset(); 29 | 30 | // Skip ValueType tests to avoid linker errors 31 | // AsfVideo tests would require additional setup 32 | 33 | } catch (...) { 34 | // Ignore exceptions 35 | } 36 | 37 | return 0; 38 | } -------------------------------------------------------------------------------- /examples/exiv2/synthesized/21.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library exiv2, aiming to fuzz the following functions: 2 | // Exiv2::XmpParser::initialize at xmp.cpp:512:17 in xmp_exiv2.hpp 3 | // Exiv2::parseInt64 at types.cpp:534:9 in types.hpp 4 | // Exiv2::parseFloat at types.cpp:568:7 in types.hpp 5 | // Exiv2::parseRational at types.cpp:590:10 in types.hpp 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | #include 19 | 20 | extern "C" int LLVMFuzzerTestOneInput_21(const uint8_t *Data, size_t Size) { 21 | if (Size < 1) return 0; 22 | 23 | // Initialize XMP parser 24 | Exiv2::XmpParser::initialize(); 25 | 26 | // Create input string from fuzzer data 27 | std::string input(reinterpret_cast(Data), Size); 28 | 29 | bool ok = false; 30 | 31 | // Test parseInt64 32 | Exiv2::parseInt64(input, ok); 33 | 34 | // Test parseFloat 35 | Exiv2::parseFloat(input, ok); 36 | 37 | // Test parseRational 38 | Exiv2::parseRational(input, ok); 39 | 40 | return 0; 41 | } -------------------------------------------------------------------------------- /examples/exiv2/synthesized/24.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library exiv2, aiming to fuzz the following functions: 2 | // Exiv2::ExifKey::groupName at tags.cpp:287:22 in tags.hpp 3 | // Exiv2::ExifTags::sectionName at tags.cpp:76:23 in tags.hpp 4 | // Exiv2::ExifKey::familyName at tags.cpp:283:22 in tags.hpp 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | 18 | extern "C" int LLVMFuzzerTestOneInput_24(const uint8_t *Data, size_t Size) { 19 | if (Size < 2) return 0; 20 | 21 | try { 22 | uint16_t tag = (Data[0] << 8) | Data[1]; 23 | std::string groupName(reinterpret_cast(Data + 2), Size - 2); 24 | 25 | Exiv2::ExifKey key(tag, groupName); 26 | 27 | std::string group = key.groupName(); 28 | const char* section = Exiv2::ExifTags::sectionName(key); 29 | const char* family = key.familyName(); 30 | 31 | (void)group; 32 | (void)section; 33 | (void)family; 34 | } catch (...) { 35 | // Ignore exceptions 36 | } 37 | 38 | return 0; 39 | } -------------------------------------------------------------------------------- /examples/exiv2/synthesized/512.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library exiv2, aiming to fuzz the following functions: 2 | // Exiv2::l2Data at types.cpp:389:8 in types.hpp 3 | // Exiv2::toData at value.hpp:1420:15 in value.hpp 4 | // Exiv2::DataValue::read at value.cpp:104:16 in value.hpp 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | 19 | extern "C" int LLVMFuzzerTestOneInput_512(const uint8_t *Data, size_t Size) { 20 | if (Size < 4) return 0; 21 | 22 | // Initialize buffer and variables 23 | Exiv2::byte buf[16]; 24 | int32_t l = *reinterpret_cast(Data); 25 | Exiv2::ByteOrder byteOrder = (Data[0] % 2) ? Exiv2::littleEndian : Exiv2::bigEndian; 26 | 27 | // Test l2Data 28 | Exiv2::l2Data(buf, l, byteOrder); 29 | 30 | // Test DataValue functions 31 | Exiv2::DataValue value; 32 | 33 | // Test toData 34 | Exiv2::toData(buf, l, byteOrder); 35 | 36 | // Test DataValue::read 37 | value.read(Data, Size, byteOrder); 38 | 39 | return 0; 40 | } -------------------------------------------------------------------------------- /examples/lcms/build_additional_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | if [ -z "$AFLPP_PATH" ]; then 3 | AFL_CLANG_FAST_PATH=$(command -v afl-clang-fast) 4 | if [ -z "$AFL_CLANG_FAST_PATH" ]; then 5 | echo "Please install AFL++ and set AFLPP_PATH" && exit 1 6 | fi 7 | AFLPP_PATH=$(dirname "$AFL_CLANG_FAST_PATH") 8 | fi 9 | cd /promefuzz 10 | # aflpp 11 | AFL_LLVM_USE_TRACE_PC=1 AFL_USE_ASAN=1 $AFLPP_PATH/afl-clang-fast++ /promefuzz/database/lcms/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/lcms/latest/out/fuzz_driver/aflpp_synthesized_driver -fsanitize=fuzzer -g -I/promefuzz/database/lcms/latest/code/include database/lcms/latest/bin_aflpp/lib/liblcms2.a 12 | # gcov 13 | clang++ /promefuzz/database/lcms/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/lcms/latest/out/fuzz_driver/gcov_synthesized_driver --coverage -fsanitize=fuzzer -g -I/promefuzz/database/lcms/latest/code/include database/lcms/latest/bin_gcov/lib/liblcms2.a 14 | # cov 15 | clang++ /promefuzz/database/lcms/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/lcms/latest/out/fuzz_driver/cov_synthesized_driver -fprofile-instr-generate -fcoverage-mapping -fsanitize=fuzzer -g -I/promefuzz/database/lcms/latest/code/include database/lcms/latest/bin_cov/lib/liblcms2.a -------------------------------------------------------------------------------- /examples/ffjpeg/build_additional_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | if [ -z "$AFLPP_PATH" ]; then 3 | AFL_CLANG_FAST_PATH=$(command -v afl-clang-fast) 4 | if [ -z "$AFL_CLANG_FAST_PATH" ]; then 5 | echo "Please install AFL++ and set AFLPP_PATH" && exit 1 6 | fi 7 | AFLPP_PATH=$(dirname "$AFL_CLANG_FAST_PATH") 8 | fi 9 | cd /promefuzz 10 | # aflpp 11 | AFL_LLVM_USE_TRACE_PC=1 AFL_USE_ASAN=1 $AFLPP_PATH/afl-clang-fast /promefuzz/database/ffjpeg/latest/out/fuzz_driver/synthesized/*.c -o /promefuzz/database/ffjpeg/latest/out/fuzz_driver/aflpp_synthesized_driver -fsanitize=fuzzer -g -I/promefuzz/database/ffjpeg/latest/code/src database/ffjpeg/latest/bin_aflpp/lib/libffjpeg.a 12 | # gcov 13 | clang /promefuzz/database/ffjpeg/latest/out/fuzz_driver/synthesized/*.c -o /promefuzz/database/ffjpeg/latest/out/fuzz_driver/gcov_synthesized_driver --coverage -fsanitize=fuzzer -g -I/promefuzz/database/ffjpeg/latest/code/src database/ffjpeg/latest/bin_gcov/lib/libffjpeg.a 14 | # cov 15 | clang /promefuzz/database/ffjpeg/latest/out/fuzz_driver/synthesized/*.c -o /promefuzz/database/ffjpeg/latest/out/fuzz_driver/cov_synthesized_driver -fprofile-instr-generate -fcoverage-mapping -fsanitize=fuzzer -g -I/promefuzz/database/ffjpeg/latest/code/src database/ffjpeg/latest/bin_cov/lib/libffjpeg.a -------------------------------------------------------------------------------- /examples/loguru/build_additional_synthesized_driver.sh: -------------------------------------------------------------------------------- 1 | #! /bin/bash 2 | if [ -z "$AFLPP_PATH" ]; then 3 | AFL_CLANG_FAST_PATH=$(command -v afl-clang-fast) 4 | if [ -z "$AFL_CLANG_FAST_PATH" ]; then 5 | echo "Please install AFL++ and set AFLPP_PATH" && exit 1 6 | fi 7 | AFLPP_PATH=$(dirname "$AFL_CLANG_FAST_PATH") 8 | fi 9 | cd /promefuzz 10 | # aflpp 11 | AFL_LLVM_USE_TRACE_PC=1 AFL_USE_ASAN=1 $AFLPP_PATH/afl-clang-fast++ /promefuzz/database/loguru/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/loguru/latest/out/fuzz_driver/aflpp_synthesized_driver -fsanitize=fuzzer -g -I/promefuzz/database/loguru/latest/code database/loguru/latest/bin_aflpp/lib/libloguru.a 12 | # gcov 13 | clang++ /promefuzz/database/loguru/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/loguru/latest/out/fuzz_driver/gcov_synthesized_driver --coverage -fsanitize=fuzzer -g -I/promefuzz/database/loguru/latest/code database/loguru/latest/bin_gcov/lib/libloguru.a 14 | # cov 15 | clang++ /promefuzz/database/loguru/latest/out/fuzz_driver/synthesized/*.cpp -o /promefuzz/database/loguru/latest/out/fuzz_driver/cov_synthesized_driver -fprofile-instr-generate -fcoverage-mapping -fsanitize=fuzzer -g -I/promefuzz/database/loguru/latest/code database/loguru/latest/bin_cov/lib/libloguru.a -------------------------------------------------------------------------------- /examples/re2/synthesized/32.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library re2, aiming to fuzz the following functions: 2 | // re2::RE2::Options::dot_nl at re2.h:717:10 in re2.h 3 | // re2::RE2::Options::set_perl_classes at re2.h:727:10 in re2.h 4 | // re2::RE2::Options::longest_match at re2.h:705:10 in re2.h 5 | // re2::RE2::Options::never_nl at re2.h:714:10 in re2.h 6 | // re2::RE2::Options::posix_syntax at re2.h:702:10 in re2.h 7 | // re2::RE2::Options::set_one_line at re2.h:733:10 in re2.h 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include "re2/re2.h" 18 | 19 | extern "C" int LLVMFuzzerTestOneInput_32(const uint8_t *Data, size_t Size) { 20 | if (Size < 1) return 0; 21 | 22 | re2::RE2::Options options(re2::RE2::DefaultOptions); 23 | 24 | // Use the first byte to determine the value for boolean parameters 25 | bool b = Data[0] & 1; 26 | 27 | // Call the target API functions 28 | options.dot_nl(); 29 | options.set_perl_classes(b); 30 | options.longest_match(); 31 | options.never_nl(); 32 | options.posix_syntax(); 33 | options.set_one_line(b); 34 | 35 | return 0; 36 | } -------------------------------------------------------------------------------- /examples/libpcap/synthesized/72.c: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library libpcap, aiming to fuzz the following functions: 2 | // pcap_nametollc at nametoaddr.c:616:1 in namedb.h 3 | // pcap_nametoeproto at nametoaddr.c:592:1 in namedb.h 4 | // pcap_nametoport at nametoaddr.c:305:1 in namedb.h 5 | // pcap_nametonetaddr at nametoaddr.c:221:1 in namedb.h 6 | // pcap_nametoproto at nametoaddr.c:482:1 in namedb.h 7 | // pcap_nametoportrange at nametoaddr.c:444:1 in namedb.h 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | 18 | int LLVMFuzzerTestOneInput_72(const uint8_t *Data, size_t Size) { 19 | if (Size == 0) return 0; 20 | 21 | char *str = (char *)malloc(Size + 1); 22 | if (!str) return 0; 23 | memcpy(str, Data, Size); 24 | str[Size] = '\0'; 25 | 26 | int port1, port2, proto; 27 | bpf_u_int32 netaddr; 28 | 29 | pcap_nametollc(str); 30 | pcap_nametoeproto(str); 31 | pcap_nametoport(str, &port1, &port2); 32 | pcap_nametonetaddr(str); 33 | pcap_nametoproto(str); 34 | pcap_nametoportrange(str, &port1, &port2, &proto); 35 | 36 | free(str); 37 | return 0; 38 | } -------------------------------------------------------------------------------- /examples/pugixml/synthesized/2.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library pugixml, aiming to fuzz the following functions: 2 | // pugi::xml_text::as_string at pugixml.cpp:6971:39 in pugixml.hpp 3 | // pugi::xml_text::as_int at pugixml.cpp:6979:29 in pugixml.hpp 4 | // pugi::xml_text::as_uint at pugixml.cpp:6987:38 in pugixml.hpp 5 | // pugi::xml_text::as_double at pugixml.cpp:6995:32 in pugixml.hpp 6 | // pugi::xml_text::as_float at pugixml.cpp:7003:31 in pugixml.hpp 7 | // pugi::xml_text::as_bool at pugixml.cpp:7011:30 in pugixml.hpp 8 | // pugi::xml_text::as_llong at pugixml.cpp:7020:35 in pugixml.hpp 9 | // pugi::xml_text::as_ullong at pugixml.cpp:7028:44 in pugixml.hpp 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | #include 19 | #include "pugixml.hpp" 20 | 21 | extern "C" int LLVMFuzzerTestOneInput_2(const uint8_t *Data, size_t Size) { 22 | if (Size == 0) return 0; 23 | 24 | pugi::xml_text text; 25 | text.as_string(); 26 | text.as_int(); 27 | text.as_uint(); 28 | text.as_double(); 29 | text.as_float(); 30 | text.as_bool(); 31 | text.as_llong(); 32 | text.as_ullong(); 33 | 34 | return 0; 35 | } -------------------------------------------------------------------------------- /examples/re2/synthesized/16.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library re2, aiming to fuzz the following functions: 2 | // re2::RE2::Options::set_encoding at re2.h:700:10 in re2.h 3 | // re2::RE2::Options::set_posix_syntax at re2.h:703:10 in re2.h 4 | // re2::RE2::Options::set_longest_match at re2.h:706:10 in re2.h 5 | // re2::RE2::Options::set_log_errors at re2.h:709:10 in re2.h 6 | // re2::RE2::Options::set_max_mem at re2.h:697:10 in re2.h 7 | // re2::RE2::Options::set_literal at re2.h:712:10 in re2.h 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include "re2/re2.h" 18 | 19 | extern "C" int LLVMFuzzerTestOneInput_16(const uint8_t *Data, size_t Size) { 20 | if (Size < 6) return 0; 21 | 22 | re2::RE2::Options options(re2::RE2::DefaultOptions); 23 | 24 | options.set_encoding(static_cast(Data[0] % 2 + 1)); 25 | options.set_posix_syntax(Data[1] % 2); 26 | options.set_longest_match(Data[2] % 2); 27 | options.set_log_errors(Data[3] % 2); 28 | options.set_max_mem(static_cast(Data[4]) * 1024); 29 | options.set_literal(Data[5] % 2); 30 | 31 | return 0; 32 | } -------------------------------------------------------------------------------- /examples/exiv2/synthesized/222.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library exiv2, aiming to fuzz the following functions: 2 | // Exiv2::l2Data at types.cpp:389:8 in types.hpp 3 | // Exiv2::toData at value.hpp:1420:15 in value.hpp 4 | // Exiv2::DataValue::read at value.cpp:104:16 in value.hpp 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | 19 | extern "C" int LLVMFuzzerTestOneInput_222(const uint8_t *Data, size_t Size) { 20 | if (Size < 4) return 0; 21 | 22 | // Initialize buffer and variables 23 | Exiv2::byte buf[16]; 24 | int32_t l = *reinterpret_cast(Data); 25 | Exiv2::ByteOrder byteOrder = (Data[0] % 2) ? Exiv2::littleEndian : Exiv2::bigEndian; 26 | 27 | // Test l2Data 28 | Exiv2::l2Data(buf, l, byteOrder); 29 | 30 | // Test DataValue functions 31 | Exiv2::DataValue dataValue; 32 | 33 | // Test toData 34 | Exiv2::toData(buf, l, byteOrder); 35 | 36 | // Test DataValue::read 37 | dataValue.read(Data, Size % 16, byteOrder); 38 | 39 | return 0; 40 | } -------------------------------------------------------------------------------- /examples/re2/synthesized/11.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library re2, aiming to fuzz the following functions: 2 | // re2::RE2::pattern at re2.h:312:22 in re2.h 3 | // re2::RE2::options at re2.h:758:18 in re2.h 4 | // re2::RE2::Options::encoding at re2.h:699:14 in re2.h 5 | // re2::RE2::pattern at re2.h:312:22 in re2.h 6 | // re2::RE2::options at re2.h:758:18 in re2.h 7 | // re2::RE2::Options::encoding at re2.h:699:14 in re2.h 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include "re2/re2.h" 18 | 19 | extern "C" int LLVMFuzzerTestOneInput_11(const uint8_t *Data, size_t Size) { 20 | if (Size < 1) return 0; 21 | 22 | std::string pattern(reinterpret_cast(Data), Size); 23 | re2::RE2 regex(pattern); 24 | 25 | const std::string& pattern1 = regex.pattern(); 26 | const re2::RE2::Options& options1 = regex.options(); 27 | re2::RE2::Options::Encoding encoding1 = options1.encoding(); 28 | 29 | const std::string& pattern2 = regex.pattern(); 30 | const re2::RE2::Options& options2 = regex.options(); 31 | re2::RE2::Options::Encoding encoding2 = options2.encoding(); 32 | 33 | return 0; 34 | } -------------------------------------------------------------------------------- /examples/zlib/synthesized/28.c: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library zlib, aiming to fuzz the following functions: 2 | // crc32_combine_gen at crc32.c:1042:15 in zlib.h 3 | // adler32_combine at adler32.c:158:15 in zlib.h 4 | // crc32_combine at crc32.c:1029:15 in zlib.h 5 | // crc32_combine_op at crc32.c:1047:15 in zlib.h 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | 15 | int LLVMFuzzerTestOneInput_28(const uint8_t *Data, size_t Size) { 16 | if (Size < 4 * sizeof(uLong) + 2 * sizeof(z_off_t)) { 17 | return 0; 18 | } 19 | 20 | uLong adler1 = *(uLong *)Data; 21 | uLong adler2 = *(uLong *)(Data + sizeof(uLong)); 22 | z_off_t len1 = *(z_off_t *)(Data + 2 * sizeof(uLong)); 23 | 24 | uLong crc1 = *(uLong *)(Data + 2 * sizeof(uLong) + sizeof(z_off_t)); 25 | uLong crc2 = *(uLong *)(Data + 3 * sizeof(uLong) + sizeof(z_off_t)); 26 | z_off_t len2 = *(z_off_t *)(Data + 4 * sizeof(uLong) + sizeof(z_off_t)); 27 | 28 | uLong op = crc32_combine_gen(len2); 29 | 30 | adler32_combine(adler1, adler2, len1); 31 | crc32_combine(crc1, crc2, len2); 32 | crc32_combine_op(crc1, crc2, op); 33 | 34 | return 0; 35 | } -------------------------------------------------------------------------------- /examples/exiv2/synthesized/734.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library exiv2, aiming to fuzz the following functions: 2 | // Exiv2::readFile at basicio.cpp:1703:9 in basicio.hpp 3 | // Exiv2::DataBuf::reset at types.cpp:104:15 in types.hpp 4 | // Exiv2::DataBuf::data at types.cpp:171:23 in types.hpp 5 | // Exiv2::writeFile at basicio.cpp:1715:8 in basicio.hpp 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | 13 | extern "C" int LLVMFuzzerTestOneInput_734(const uint8_t *Data, size_t Size) { 14 | if (Size < 1) return 0; 15 | 16 | const std::string dummy_file = "./dummy_file"; 17 | std::ofstream out(dummy_file, std::ios::binary); 18 | out.write(reinterpret_cast(Data), Size); 19 | out.close(); 20 | 21 | try { 22 | // Test Exiv2::readFile 23 | Exiv2::DataBuf buf1 = Exiv2::readFile(dummy_file); 24 | 25 | // Test Exiv2::DataBuf::reset 26 | buf1.reset(); 27 | 28 | // Test Exiv2::writeFile 29 | Exiv2::DataBuf buf3(Size); 30 | std::memcpy(buf3.data(), Data, Size); 31 | Exiv2::writeFile(buf3, dummy_file); 32 | 33 | } catch (...) { 34 | // Ignore all exceptions 35 | } 36 | 37 | return 0; 38 | } -------------------------------------------------------------------------------- /examples/libaom/synthesized/36.cpp: -------------------------------------------------------------------------------- 1 | // This fuzz driver is generated for library libaom, aiming to fuzz the following functions: 2 | // aom_codec_av1_dx at av1_dx_iface.c:1786:20 in aomdx.h 3 | // aom_codec_dec_init_ver at aom_decoder.c:25:17 in aom_decoder.h 4 | // aom_codec_decode at aom_decoder.c:94:17 in aom_decoder.h 5 | // aom_codec_destroy at aom_codec.c:68:17 in aom_codec.h 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | #include 19 | #include 20 | #include 21 | #include 22 | #include 23 | #include 24 | #include 25 | 26 | extern "C" int LLVMFuzzerTestOneInput_36(const uint8_t *Data, size_t Size) { 27 | if (Size < 1) return 0; 28 | 29 | aom_codec_ctx_t ctx; 30 | aom_codec_iface_t *iface = aom_codec_av1_dx(); 31 | 32 | if (aom_codec_dec_init(&ctx, iface, NULL, 0) != AOM_CODEC_OK) { 33 | return 0; 34 | } 35 | 36 | aom_codec_decode(&ctx, Data, Size, NULL); 37 | 38 | aom_codec_destroy(&ctx); 39 | 40 | return 0; 41 | } -------------------------------------------------------------------------------- /src/tests/test_Deduce.py: -------------------------------------------------------------------------------- 1 | from src.utils import setup_llm 2 | from src.comprehender.prompter import FuncPurposePrompter 3 | from src.generator.llm import Chat 4 | import json 5 | from pathlib import Path 6 | 7 | this_dir = Path(__file__).parent 8 | 9 | def run(): 10 | llm_client = setup_llm("llama3_2_remote") 11 | library_name = "pugixml" 12 | library_purpose = "pugixml is a C++ XML processing library providing DOM-like interface, fast XML parsing and XPath 1.0 implementation for performance and easy data-driven queries." 13 | 14 | def query_purpose(function_name, function_signature): 15 | prompter = FuncPurposePrompter(Chat(llm_client)) 16 | return prompter.prompt(library_name, library_purpose, function_name, function_signature) 17 | 18 | with open("out/pugixml/preprocessor/info.json") as f: 19 | info = json.load(f) 20 | 21 | results = {} 22 | for func_obj in info["function_infos"].values(): 23 | name = func_obj["name"] 24 | signature = func_obj["signature"] 25 | purpose = query_purpose(name, signature) 26 | print(f"{name}:\n{purpose}\n") 27 | results[name] = purpose.strip() + "\n" + signature.strip() 28 | 29 | with open(this_dir / "pugixml_functions.json", "w") as f: 30 | json.dump(results, f, indent=2) --------------------------------------------------------------------------------