Fuzz the expr command

.github/workflows/CICD.yml

@@ -149,6 +149,13 @@ jobs:
         ## Run it
         cd fuzz
         cargo +nightly fuzz run fuzz_test -- -max_total_time=${{ env.RUN_FOR }} -detect_leaks=0
+    - name: Run fuzz_expr for XX seconds
+      continue-on-error: true
+      shell: bash
+      run: |
+        ## Run it
+        cd fuzz
+        cargo +nightly fuzz run fuzz_expr -- -max_total_time=${{ env.RUN_FOR }} -detect_leaks=0
     - name: Run fuzz_parse_glob for XX seconds
       shell: bash
       run: |

fuzz/Cargo.toml

@@ -15,6 +15,7 @@ rand = { version = "0.8", features = ["small_rng"] }
 uucore = { path = "../src/uucore/" }
 uu_date = { path = "../src/uu/date/" }
 uu_test = { path = "../src/uu/test/" }
+uu_expr = { path = "../src/uu/expr/" }
 
 
 # Prevent this from interfering with workspaces
@@ -27,6 +28,12 @@ path = "fuzz_targets/fuzz_date.rs"
 test = false
 doc = false
 
+[[bin]]
+name = "fuzz_expr"
+path = "fuzz_targets/fuzz_expr.rs"
+test = false
+doc = false
+
 [[bin]]
 name = "fuzz_test"
 path = "fuzz_targets/fuzz_test.rs"

fuzz/fuzz_targets/fuzz_expr.rs

@@ -0,0 +1,170 @@
+// This file is part of the uutils coreutils package.
+//
+// For the full copyright and license information, please view the LICENSE
+// file that was distributed with this source code.
+// spell-checker:ignore parens
+
+#![no_main]
+use libfuzzer_sys::fuzz_target;
+use uu_expr::uumain;
+
+use rand::seq::SliceRandom;
+use rand::Rng;
+use std::ffi::OsString;
+
+use libc::{dup, dup2, STDOUT_FILENO};
+use std::process::Command;
+
+fn run_gnu_expr(args: &[OsString]) -> Result<String, std::io::Error> {
+    let mut command = Command::new("expr");
+    for arg in args {
+        command.arg(arg);
+    }
+    let output = command.output()?;
+    if output.status.success() {
+        Ok(String::from_utf8_lossy(&output.stdout).to_string())
+    } else {
+        Err(std::io::Error::new(
+            std::io::ErrorKind::Other,
+            "GNU expr execution failed",
+        ))
+    }
+}
+
+fn generate_random_string(max_length: usize) -> String {
+    let mut rng = rand::thread_rng();
+    let valid_utf8: Vec<char> = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
+        .chars()
+        .collect();
+    let invalid_utf8 = [0xC3, 0x28]; // Invalid UTF-8 sequence
+    let mut result = String::new();
+
+    for _ in 0..rng.gen_range(1..=max_length) {
+        if rng.gen_bool(0.9) {
+            let ch = valid_utf8.choose(&mut rng).unwrap();
+            result.push(*ch);
+        } else {
+            let ch = invalid_utf8.choose(&mut rng).unwrap();
+            if let Some(c) = char::from_u32(*ch as u32) {
+                result.push(c);
+            }
+        }
+    }
+
+    result
+}
+
+fn generate_expr(max_depth: u32) -> String {
+    let mut rng = rand::thread_rng();
+    let ops = ["+", "-", "*", "/", "%", "<", ">", "=", "&", "|"];
+    let parens = ["(", ")"];
+
+    let mut expr = String::new();
+    let mut depth = 0;
+
+    while depth <= max_depth {
+        let choice = rng.gen_range(0..=1);
+
+        match choice {
+            0 => {
+                expr.push_str(&rng.gen_range(1..=100).to_string());
+                depth += 1;
+            }
+            1 => {
+                if depth > 0 {
+                    let op = *ops.choose(&mut rng).unwrap();
+                    expr.push_str(&format!(" {} {} ", op, rng.gen_range(1..=100).to_string()));
+                    depth += 1;
+                }
+            }
+            2 => {
+                expr.push_str(&format!(
+                    "{}{}{}",
+                    parens[0],
+                    rng.gen_range(1..=100).to_string(),
+                    parens[1]
+                ));
+                depth += 1;
+            }
+            _ => {
+                let random_str = generate_random_string(rng.gen_range(1..=10));
+                expr.push_str(&random_str);
+                depth += 1;
+            }
+        }
+    }
+
+    expr
+}
+
+fuzz_target!(|_data: &[u8]| {
+    let mut rng = rand::thread_rng();
+    let expr = generate_expr(rng.gen_range(0..=20)); // Increase max_depth to generate longer expressions
+    let args = vec![OsString::from("expr"), OsString::from(&expr)];
+
+    // Save the original stdout file descriptor
+    let original_stdout_fd = unsafe { dup(STDOUT_FILENO) };
+
+    // Create a pipe to capture stdout
+    let mut pipe_fds = [-1; 2];
+    unsafe { libc::pipe(pipe_fds.as_mut_ptr()) };
+
+    {
+        // Redirect stdout to the write end of the pipe
+        unsafe { dup2(pipe_fds[1], STDOUT_FILENO) };
+
+        // Run uumain with the provided arguments
+        uumain(args.clone().into_iter());
+
+        // Restore original stdout
+        unsafe { dup2(original_stdout_fd, STDOUT_FILENO) };
+        unsafe { libc::close(original_stdout_fd) };
+    }
+    // Close the write end of the pipe
+    unsafe { libc::close(pipe_fds[1]) };
+
+    // Read captured output from the read end of the pipe
+    let mut captured_output = Vec::new();
+    let mut read_buffer = [0; 1024];
+    loop {
+        let bytes_read = unsafe {
+            libc::read(
+                pipe_fds[0],
+                read_buffer.as_mut_ptr() as *mut libc::c_void,
+                read_buffer.len(),
+            )
+        };
+        if bytes_read <= 0 {
+            break;
+        }
+        captured_output.extend_from_slice(&read_buffer[..bytes_read as usize]);
+    }
+
+    // Close the read end of the pipe
+    unsafe { libc::close(pipe_fds[0]) };
+
+    // Convert captured output to a string
+    let my_output = String::from_utf8_lossy(&captured_output)
+        .to_string()
+        .trim()
+        .to_owned();
+
+    // Run GNU expr with the provided arguments and compare the output
+    match run_gnu_expr(&args[1..]) {
+        Ok(gnu_output) => {
+            let gnu_output = gnu_output.trim().to_owned();
+            if my_output != gnu_output {
+                println!("Discrepancy detected!");
+                println!("Expression: {}", expr);
+                println!("My output: {}", my_output);
+                println!("GNU output: {}", gnu_output);
+                panic!();
+            } else {
+                println!("Outputs matched for expression: {}", expr);
+            }
+        }
+        Err(_) => {
+            println!("GNU expr execution failed for expression: {}", expr);
+        }
+    }
+});