commit 54ca2cd59219aab637e7a5e1e6d0f383a36df192
author Paul Wankadia <junyer@google.com> Tue Oct 02 19:42:12 2018 -0700
committer Paul Wankadia <junyer@google.com> Wed Oct 03 02:43:52 2018 +0000
tree 1a94a26f683584402e7cd904ea5418f8fb84b31b
parent f94a5b7f32c25fa96ef11a340e50fef39a58f9a6

Make the fuzzer check size before computing rsize.

Likewise for fanout and rfanout.

Change-Id: I5182fb69bf9c391cce7857519d91b1d00a501f42
Reviewed-on: https://code-review.googlesource.com/c/34010
Reviewed-by: Paul Wankadia <junyer@google.com>

re2/fuzzing/re2_fuzzer.cc

diff --git a/re2/fuzzing/re2_fuzzer.cc b/re2/fuzzing/re2_fuzzer.cc
index cde76e4..2068685 100644
--- a/re2/fuzzing/re2_fuzzer.cc
+++ b/re2/fuzzing/re2_fuzzer.cc
@@ -23,16 +23,20 @@
   // Don't waste time fuzzing high-size programs.
   // (They can cause bug reports due to fuzzer timeouts.)
   int size = re.ProgramSize();
+  if (size > 9999)
+    return;
   int rsize = re.ReverseProgramSize();
-  if (size > 9999 || rsize > 9999)
+  if (rsize > 9999)
     return;
 
   // Don't waste time fuzzing high-fanout programs.
   // (They can also cause bug reports due to fuzzer timeouts.)
   std::map<int, int> histogram;
   int fanout = re.ProgramFanout(&histogram);
+  if (fanout > 9)
+    return;
   int rfanout = re.ReverseProgramFanout(&histogram);
-  if (fanout > 9 || rfanout > 9)
+  if (rfanout > 9)
     return;
 
   StringPiece sp1, sp2, sp3, sp4;