Fix coding style and remove duplicate fuzzer

test/fuzzing/CMakeLists.txt

@@ -15,7 +15,6 @@ set(SOURCES
   chrono_duration.cpp
   named_arg.cpp
   one_arg.cpp
-  sprintf.cpp
   two_args.cpp
 )
 

test/fuzzing/build.sh

@@ -9,7 +9,7 @@
 #
 # Copyright (c) 2019 Paul Dreik
 #
-# License: see LICENSE.rst in the fmt root directory
+# For the license information refer to format.h.
 
 set -e
 me=$(basename $0)
@@ -23,8 +23,8 @@ here=$(pwd)
 CXXFLAGSALL="-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION= -g"
 CMAKEFLAGSALL="$root -GNinja -DCMAKE_BUILD_TYPE=Debug -DFMT_DOC=Off -DFMT_TEST=Off -DFMT_FUZZ=On -DCMAKE_CXX_STANDARD=17"
 
-#builds the fuzzers as one would do if using afl or just making
-#binaries for reproducing.
+# Builds the fuzzers as one would do if using afl or just making
+# binaries for reproducing.
 builddir=$here/build-fuzzers-reproduce
 mkdir -p $builddir
 cd $builddir
@@ -32,7 +32,7 @@ CXX="ccache g++" CXXFLAGS="$CXXFLAGSALL" cmake \
 $CMAKEFLAGSALL
 cmake --build $builddir
 
-#for performance analysis of the fuzzers
+# For performance analysis of the fuzzers.
 builddir=$here/build-fuzzers-perfanalysis
 mkdir -p $builddir
 cd $builddir
@@ -43,7 +43,7 @@ $CMAKEFLAGSALL \
 
 cmake --build $builddir
 
-#builds the fuzzers as oss-fuzz does
+# Builds the fuzzers as oss-fuzz does.
 builddir=$here/build-fuzzers-ossfuzz
 mkdir -p $builddir
 cd $builddir
@@ -56,7 +56,7 @@ cmake $CMAKEFLAGSALL \
 cmake --build $builddir
 
 
-#builds fuzzers for local fuzzing with libfuzzer with asan+usan
+# Builds fuzzers for local fuzzing with libfuzzer with asan+usan.
 builddir=$here/build-fuzzers-libfuzzer
 mkdir -p $builddir
 cd $builddir
@@ -68,7 +68,7 @@ cmake $CMAKEFLAGSALL \
 
 cmake --build $builddir
 
-#builds fuzzers for local fuzzing with libfuzzer with asan only
+# Builds fuzzers for local fuzzing with libfuzzer with asan only.
 builddir=$here/build-fuzzers-libfuzzer-addr
 mkdir -p $builddir
 cd $builddir
@@ -80,7 +80,7 @@ cmake $CMAKEFLAGSALL \
 
 cmake --build $builddir
 
-#builds a fast fuzzer for making coverage fast
+# Builds a fast fuzzer for making coverage fast.
 builddir=$here/build-fuzzers-fast
 mkdir -p $builddir
 cd $builddir
@@ -94,7 +94,7 @@ cmake $CMAKEFLAGSALL \
 cmake --build $builddir
 
 
-#builds fuzzers for local fuzzing with afl
+# Builds fuzzers for local fuzzing with afl.
 builddir=$here/build-fuzzers-afl
 mkdir -p $builddir
 cd $builddir

test/fuzzing/chrono_duration.cpp

 // Copyright (c) 2019, Paul Dreik
-// License: see LICENSE.rst in the fmt root directory
+// For the license information refer to format.h.
 
-#include <fmt/chrono.h>
 #include <cstdint>
-#include <limits>
-#include <stdexcept>
-#include <type_traits>
-#include <vector>
+#include <fmt/chrono.h>
+
 #include "fuzzer_common.h"
 
 template <typename Item, typename Ratio>
-void invoke_inner(fmt::string_view formatstring, const Item item) {
+void invoke_inner(fmt::string_view format_str, const Item item) {
   const std::chrono::duration<Item, Ratio> value(item);
   try {
 #if FMT_FUZZ_FORMAT_TO_STRING
-    std::string message = fmt::format(formatstring, value);
+    std::string message = fmt::format(format_str, value);
 #else
     fmt::memory_buffer buf;
-    fmt::format_to(buf, formatstring, value);
+    fmt::format_to(buf, format_str, value);
 #endif
-  } catch (std::exception& /*e*/) {
+  } catch (std::exception&) {
   }
 }
 
-// Item is the underlying type for duration (int, long etc)
+// Item is the underlying type for duration (int, long, etc.)
 template <typename Item>
-void invoke_outer(const uint8_t* Data, size_t Size, const int scaling) {
-  // always use a fixed location of the data
-  using fmt_fuzzer::Nfixed;
+void invoke_outer(const uint8_t* data, size_t size, int scaling) {
+  // Always use a fixed location of the data.
+  using fmt_fuzzer::nfixed;
 
-  constexpr auto N = sizeof(Item);
-  static_assert(N <= Nfixed, "fixed size is too small");
-  if (Size <= Nfixed + 1) {
-    return;
-  }
+  static_assert(sizeof(Item) <= nfixed, "fixed size is too small");
+  if (size <= nfixed + 1) return;
 
-  const Item item = fmt_fuzzer::assignFromBuf<Item>(Data);
+  const Item item = fmt_fuzzer::assignFromBuf<Item>(data);
 
-  // fast forward
-  Data += Nfixed;
-  Size -= Nfixed;
+  // Fast forward.
+  data += nfixed;
+  size -= nfixed;
 
-  // Data is already allocated separately in libFuzzer so reading past
-  // the end will most likely be detected anyway
-  const auto formatstring = fmt::string_view(fmt_fuzzer::as_chars(Data), Size);
+  // data is already allocated separately in libFuzzer so reading past the end 
+  // will most likely be detected anyway.
+  const auto format_str = fmt::string_view(fmt_fuzzer::as_chars(data), size);
 
-  // doit_impl<Item,std::yocto>(buf.data(),item);
-  // doit_impl<Item,std::zepto>(buf.data(),item);
+  // yocto, zepto, zetta and yotta are not handled.
   switch (scaling) {
   case 1:
-    invoke_inner<Item, std::atto>(formatstring, item);
+    invoke_inner<Item, std::atto>(format_str, item);
     break;
   case 2:
-    invoke_inner<Item, std::femto>(formatstring, item);
+    invoke_inner<Item, std::femto>(format_str, item);
     break;
   case 3:
-    invoke_inner<Item, std::pico>(formatstring, item);
+    invoke_inner<Item, std::pico>(format_str, item);
     break;
   case 4:
-    invoke_inner<Item, std::nano>(formatstring, item);
+    invoke_inner<Item, std::nano>(format_str, item);
     break;
   case 5:
-    invoke_inner<Item, std::micro>(formatstring, item);
+    invoke_inner<Item, std::micro>(format_str, item);
     break;
   case 6:
-    invoke_inner<Item, std::milli>(formatstring, item);
+    invoke_inner<Item, std::milli>(format_str, item);
     break;
   case 7:
-    invoke_inner<Item, std::centi>(formatstring, item);
+    invoke_inner<Item, std::centi>(format_str, item);
     break;
   case 8:
-    invoke_inner<Item, std::deci>(formatstring, item);
+    invoke_inner<Item, std::deci>(format_str, item);
     break;
   case 9:
-    invoke_inner<Item, std::deca>(formatstring, item);
+    invoke_inner<Item, std::deca>(format_str, item);
     break;
   case 10:
-    invoke_inner<Item, std::kilo>(formatstring, item);
+    invoke_inner<Item, std::kilo>(format_str, item);
     break;
   case 11:
-    invoke_inner<Item, std::mega>(formatstring, item);
+    invoke_inner<Item, std::mega>(format_str, item);
     break;
   case 12:
-    invoke_inner<Item, std::giga>(formatstring, item);
+    invoke_inner<Item, std::giga>(format_str, item);
     break;
   case 13:
-    invoke_inner<Item, std::tera>(formatstring, item);
+    invoke_inner<Item, std::tera>(format_str, item);
     break;
   case 14:
-    invoke_inner<Item, std::peta>(formatstring, item);
+    invoke_inner<Item, std::peta>(format_str, item);
     break;
   case 15:
-    invoke_inner<Item, std::exa>(formatstring, item);
+    invoke_inner<Item, std::exa>(format_str, item);
   }
-  // doit_impl<Item,std::zeta>(buf.data(),item);
-  // doit_impl<Item,std::yotta>(buf.data(),item);
 }
 
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t* Data, size_t Size) {
-  if (Size <= 4) {
-    return 0;
-  }
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  if (size <= 4)  return 0;
 
-  const auto representation = Data[0];
-  const auto scaling = Data[1];
-  Data += 2;
-  Size -= 2;
+  const auto representation = data[0];
+  const auto scaling = data[1];
+  data += 2;
+  size -= 2;
 
   switch (representation) {
   case 1:
-    invoke_outer<char>(Data, Size, scaling);
+    invoke_outer<char>(data, size, scaling);
     break;
   case 2:
-    invoke_outer<unsigned char>(Data, Size, scaling);
+    invoke_outer<signed char>(data, size, scaling);
     break;
   case 3:
-    invoke_outer<signed char>(Data, Size, scaling);
+    invoke_outer<unsigned char>(data, size, scaling);
     break;
   case 4:
-    invoke_outer<short>(Data, Size, scaling);
+    invoke_outer<short>(data, size, scaling);
     break;
   case 5:
-    invoke_outer<unsigned short>(Data, Size, scaling);
+    invoke_outer<unsigned short>(data, size, scaling);
     break;
   case 6:
-    invoke_outer<int>(Data, Size, scaling);
+    invoke_outer<int>(data, size, scaling);
     break;
   case 7:
-    invoke_outer<unsigned int>(Data, Size, scaling);
+    invoke_outer<unsigned int>(data, size, scaling);
     break;
   case 8:
-    invoke_outer<long>(Data, Size, scaling);
+    invoke_outer<long>(data, size, scaling);
     break;
   case 9:
-    invoke_outer<unsigned long>(Data, Size, scaling);
+    invoke_outer<unsigned long>(data, size, scaling);
     break;
   case 10:
-    invoke_outer<float>(Data, Size, scaling);
+    invoke_outer<float>(data, size, scaling);
     break;
   case 11:
-    invoke_outer<double>(Data, Size, scaling);
+    invoke_outer<double>(data, size, scaling);
     break;
   case 12:
-    invoke_outer<long double>(Data, Size, scaling);
+    invoke_outer<long double>(data, size, scaling);
     break;
   default:
     break;
   }
-
   return 0;
 }

test/fuzzing/fuzzer_common.h

+// Copyright (c) 2019, Paul Dreik
+// For the license information refer to format.h.
+
 #ifndef FUZZER_COMMON_H
 #define FUZZER_COMMON_H
 
-// Copyright (c) 2019, Paul Dreik
-// License: see LICENSE.rst in the fmt root directory
-
 #include <cstdint>      // std::uint8_t
 #include <cstring>      // memcpy
-#include <type_traits>  // trivially copyable
 
-// one can format to either a string, or a buf. buf is faster,
-// but one may be interested in formatting to a string instead to
-// verify it works as intended. to avoid a combinatoric explosion,
-// select this at compile time instead of dynamically from the fuzz data
+// One can format to either a string, or a buffer. The latter is faster, but
+// one may be interested in formatting to a string instead to verify it works
+// as intended. To avoid a combinatoric explosion, select this at compile time
+// instead of dynamically from the fuzz data.
 #define FMT_FUZZ_FORMAT_TO_STRING 0
 
-// if fmt is given a buffer that is separately allocated,
-// chances that address sanitizer detects out of bound reads is
-// much higher. However, it slows down the fuzzing.
+// If {fmt} is given a buffer that is separately allocated, chances that address
+// sanitizer detects out of bound reads is much higher. However, it slows down
+// the fuzzing.
 #define FMT_FUZZ_SEPARATE_ALLOCATION 1
 
-// To let the the fuzzer mutation be efficient at cross pollinating
-// between different types, use a fixed size format.
-// The same bit pattern, interpreted as another type,
-// is likely interesting.
-// For this, we must know the size of the largest possible type in use.
-
-// There are some problems on travis, claiming Nfixed is not a constant
-// expression which seems to be an issue with older versions of libstdc++
-#if _GLIBCXX_RELEASE >= 7
-#  include <algorithm>
 namespace fmt_fuzzer {
-constexpr auto Nfixed = std::max(sizeof(long double), sizeof(std::intmax_t));
-}
-#else
-namespace fmt_fuzzer {
-constexpr auto Nfixed = 16;
-}
-#endif
 
-namespace fmt_fuzzer {
-// view data as a c char pointer.
+// The size of the largest possible type in use.
+// To let the the fuzzer mutation be efficient at cross pollinating between
+// different types, use a fixed size format. The same bit pattern, interpreted
+// as another type, is likely interesting.
+constexpr auto nfixed = 16;
+
+// Casts data to a char pointer.
 template <typename T> inline const char* as_chars(const T* data) {
-  return static_cast<const char*>(static_cast<const void*>(data));
+  return reinterpret_cast<const char*>(data);
 }
 
-// view data as a byte pointer
+// Casts data to a byte pointer.
 template <typename T> inline const std::uint8_t* as_bytes(const T* data) {
-  return static_cast<const std::uint8_t*>(static_cast<const void*>(data));
+  return reinterpret_cast<const std::uint8_t*>(data);
 }
 
-// blits bytes from Data to form an (assumed trivially constructible) object
-// of type Item
-template <class Item> inline Item assignFromBuf(const std::uint8_t* Data) {
-  Item item{};
-  std::memcpy(&item, Data, sizeof(Item));
+// Blits bytes from data to form an (assumed trivially constructible) object
+// of type Item.
+template <class Item> inline Item assignFromBuf(const std::uint8_t* data) {
+  auto item = Item();
+  std::memcpy(&item, data, sizeof(Item));
   return item;
 }
 
-// reads a boolean value by looking at the first byte from Data
-template <> inline bool assignFromBuf<bool>(const std::uint8_t* Data) {
-  return !!Data[0];
+// Reads a boolean value by looking at the first byte from data.
+template <> inline bool assignFromBuf<bool>(const std::uint8_t* data) {
+  return *data != 0;
 }
 
 }  // namespace fmt_fuzzer

test/fuzzing/main.cpp

 #include <cassert>
 #include <fstream>
-#include <sstream>
 #include <vector>
+
 #include "fuzzer_common.h"
 
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t* Data, size_t Size);
-int main(int argc, char* argv[]) {
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size);
+
+int main(int argc, char** argv) {
   for (int i = 1; i < argc; ++i) {
     std::ifstream in(argv[i]);
     assert(in);
     in.seekg(0, std::ios_base::end);
-    const auto pos = in.tellg();
-    assert(pos >= 0);
+    const auto size = in.tellg();
+    assert(size >= 0);
     in.seekg(0, std::ios_base::beg);
-    std::vector<char> buf(static_cast<size_t>(pos));
-    in.read(buf.data(), static_cast<long>(buf.size()));
-    assert(in.gcount() == pos);
+    std::vector<char> buf(static_cast<size_t>(size));
+    in.read(buf.data(), size);
+    assert(in.gcount() == size);
     LLVMFuzzerTestOneInput(fmt_fuzzer::as_bytes(buf.data()), buf.size());
   }
 }

test/fuzzing/named_arg.cpp

 // Copyright (c) 2019, Paul Dreik
-// License: see LICENSE.rst in the fmt root directory
+// For the license information refer to format.h.
 
-#include <fmt/chrono.h>
-#include <fmt/core.h>
 #include <cstdint>
-#include <stdexcept>
 #include <type_traits>
 #include <vector>
+#include <fmt/chrono.h>
+
 #include "fuzzer_common.h"
 
 template <typename Item1>
-void invoke_fmt(const uint8_t* Data, size_t Size, unsigned int argsize) {
-  constexpr auto N1 = sizeof(Item1);
-  static_assert(N1 <= fmt_fuzzer::Nfixed, "Nfixed too small");
-  if (Size <= fmt_fuzzer::Nfixed) {
-    return;
-  }
-  const Item1 item1 = fmt_fuzzer::assignFromBuf<Item1>(Data);
+void invoke_fmt(const uint8_t* data, size_t size, unsigned int argsize) {
+  static_assert(sizeof(Item1) <= fmt_fuzzer::nfixed, "nfixed too small");
+  if (size <= fmt_fuzzer::nfixed) return;
+  const Item1 item1 = fmt_fuzzer::assignFromBuf<Item1>(data);
 
-  Data += fmt_fuzzer::Nfixed;
-  Size -= fmt_fuzzer::Nfixed;
+  data += fmt_fuzzer::nfixed;
+  size -= fmt_fuzzer::nfixed;
 
-  // how many chars should be used for the argument name?
-  if (argsize <= 0 || argsize >= Size) {
-    return;
-  }
+  // How many chars should be used for the argument name?
+  if (argsize <= 0 || argsize >= size) return;
 
-  // allocating buffers separately is slower, but increases chances
-  // of detecting memory errors
 #if FMT_FUZZ_SEPARATE_ALLOCATION
   std::vector<char> argnamebuffer(argsize + 1);
-  std::memcpy(argnamebuffer.data(), Data, argsize);
+  std::memcpy(argnamebuffer.data(), data, argsize);
   auto argname = argnamebuffer.data();
 #else
-  auto argname = fmt_fuzzer::as_chars(Data);
+  auto argname = fmt_fuzzer::as_chars(data);
 #endif
-  Data += argsize;
-  Size -= argsize;
+  data += argsize;
+  size -= argsize;
 
 #if FMT_FUZZ_SEPARATE_ALLOCATION
-  // allocates as tight as possible, making it easier to catch buffer overruns.
-  std::vector<char> fmtstringbuffer(Size);
-  std::memcpy(fmtstringbuffer.data(), Data, Size);
-  auto fmtstring = fmt::string_view(fmtstringbuffer.data(), Size);
+  std::vector<char> fmtstringbuffer(size);
+  std::memcpy(fmtstringbuffer.data(), data, size);
+  auto format_str = fmt::string_view(fmtstringbuffer.data(), size);
 #else
-  auto fmtstring = fmt::string_view(fmt_fuzzer::as_chars(Data), Size);
+  auto format_str = fmt::string_view(fmt_fuzzer::as_chars(data), size);
 #endif
 
 #if FMT_FUZZ_FORMAT_TO_STRING
-  std::string message = fmt::format(fmtstring, fmt::arg(argname, item1));
+  std::string message = fmt::format(format_str, fmt::arg(argname, item1));
 #else
-  fmt::memory_buffer outbuf;
-  fmt::format_to(outbuf, fmtstring, fmt::arg(argname, item1));
+  fmt::memory_buffer out;
+  fmt::format_to(out, format_str, fmt::arg(argname, item1));
 #endif
 }
 
-// for dynamic dispatching to an explicit instantiation
+// For dynamic dispatching to an explicit instantiation.
 template <typename Callback> void invoke(int index, Callback callback) {
   switch (index) {
   case 0:
-    callback(bool{});
+    callback(bool());
     break;
   case 1:
-    callback(char{});
+    callback(char());
     break;
   case 2:
     using sc = signed char;
-    callback(sc{});
+    callback(sc());
     break;
   case 3:
     using uc = unsigned char;
-    callback(uc{});
+    callback(uc());
     break;
   case 4:
-    callback(short{});
+    callback(short());
     break;
   case 5:
     using us = unsigned short;
-    callback(us{});
+    callback(us());
     break;
   case 6:
-    callback(int{});
+    callback(int());
     break;
   case 7:
-    callback(unsigned{});
+    callback(unsigned());
     break;
   case 8:
-    callback(long{});
+    callback(long());
     break;
   case 9:
     using ul = unsigned long;
-    callback(ul{});
+    callback(ul());
     break;
   case 10:
-    callback(float{});
+    callback(float());
     break;
   case 11:
-    callback(double{});
+    callback(double());
     break;
   case 12:
     using LD = long double;
-    callback(LD{});
+    callback(LD());
     break;
   }
 }
 
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t* Data, size_t Size) {
-  if (Size <= 3) {
-    return 0;
-  }
-
-  // switch types depending on the first byte of the input
-  const auto first = Data[0] & 0x0F;
-  const unsigned int second = (Data[0] & 0xF0) >> 4;
-  Data++;
-  Size--;
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  if (size <= 3) return 0;
 
-  auto outerfcn = [=](auto param1) {
-    invoke_fmt<decltype(param1)>(Data, Size, second);
-  };
+  // Switch types depending on the first byte of the input.
+  const auto first = data[0] & 0x0F;
+  const unsigned second = (data[0] & 0xF0) >> 4;
+  data++;
+  size--;
 
   try {
-    invoke(first, outerfcn);
-  } catch (std::exception& /*e*/) {
+    invoke(first, [=](auto param1) {
+      invoke_fmt<decltype(param1)>(data, size, second);
+    });
+  } catch (std::exception&) {
   }
   return 0;
 }

test/fuzzing/one_arg.cpp

 // Copyright (c) 2019, Paul Dreik
-// License: see LICENSE.rst in the fmt root directory
+// For the license information refer to format.h.
 
-#include <fmt/core.h>
 #include <cstdint>
 #include <stdexcept>
 #include <type_traits>
 #include <vector>
-
 #include <fmt/chrono.h>
+
 #include "fuzzer_common.h"
 
-using fmt_fuzzer::Nfixed;
+using fmt_fuzzer::nfixed;
 
 template <typename Item>
-void invoke_fmt(const uint8_t* Data, size_t Size) {
+void invoke_fmt(const uint8_t* data, size_t size) {
   constexpr auto N = sizeof(Item);
-  static_assert(N <= Nfixed, "Nfixed is too small");
-  if (Size <= Nfixed) {
+  static_assert(N <= nfixed, "Nfixed is too small");
+  if (size <= nfixed) {
     return;
   }
-  const Item item = fmt_fuzzer::assignFromBuf<Item>(Data);
-  Data += Nfixed;
-  Size -= Nfixed;
+  const Item item = fmt_fuzzer::assignFromBuf<Item>(data);
+  data += nfixed;
+  size -= nfixed;
 
 #if FMT_FUZZ_SEPARATE_ALLOCATION
-  // allocates as tight as possible, making it easier to catch buffer overruns.
-  std::vector<char> fmtstringbuffer(Size);
-  std::memcpy(fmtstringbuffer.data(), Data, Size);
-  auto fmtstring = fmt::string_view(fmtstringbuffer.data(), Size);
+  std::vector<char> fmtstringbuffer(size);
+  std::memcpy(fmtstringbuffer.data(), data, size);
+  auto format_str = fmt::string_view(fmtstringbuffer.data(), size);
 #else
-  auto fmtstring = fmt::string_view(fmt_fuzzer::as_chars(Data), Size);
+  auto format_str = fmt::string_view(fmt_fuzzer::as_chars(data), size);
 #endif
 
 #if FMT_FUZZ_FORMAT_TO_STRING
-  std::string message = fmt::format(fmtstring, item);
+  std::string message = fmt::format(format_str, item);
 #else
   fmt::memory_buffer message;
-  fmt::format_to(message, fmtstring, item);
+  fmt::format_to(message, format_str, item);
 #endif
 }
 
-void invoke_fmt_time(const uint8_t* Data, size_t Size) {
+void invoke_fmt_time(const uint8_t* data, size_t size) {
   using Item = std::time_t;
-  constexpr auto N = sizeof(Item);
-  static_assert(N <= Nfixed, "Nfixed too small");
-  if (Size <= Nfixed) {
-    return;
-  }
-  const Item item = fmt_fuzzer::assignFromBuf<Item>(Data);
-  Data += Nfixed;
-  Size -= Nfixed;
+  static_assert(sizeof(Item) <= nfixed, "Nfixed too small");
+  if (size <= nfixed) return;
+  const Item item = fmt_fuzzer::assignFromBuf<Item>(data);
+  data += nfixed;
+  size -= nfixed;
 #if FMT_FUZZ_SEPARATE_ALLOCATION
-  // allocates as tight as possible, making it easier to catch buffer overruns.
-  std::vector<char> fmtstringbuffer(Size);
-  std::memcpy(fmtstringbuffer.data(), Data, Size);
-  auto fmtstring = fmt::string_view(fmtstringbuffer.data(), Size);
+  std::vector<char> fmtstringbuffer(size);
+  std::memcpy(fmtstringbuffer.data(), data, size);
+  auto format_str = fmt::string_view(fmtstringbuffer.data(), size);
 #else
-  auto fmtstring = fmt::string_view(fmt_fuzzer::as_chars(Data), Size);
+  auto format_str = fmt::string_view(fmt_fuzzer::as_chars(data), size);
 #endif
   auto* b = std::localtime(&item);
   if (b) {
 #if FMT_FUZZ_FORMAT_TO_STRING
-    std::string message = fmt::format(fmtstring, *b);
+    std::string message = fmt::format(format_str, *b);
 #else
     fmt::memory_buffer message;
-    fmt::format_to(message, fmtstring, *b);
+    fmt::format_to(message, format_str, *b);
 #endif
   }
 }
 
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t* Data, size_t Size) {
-  if (Size <= 3) {
-    return 0;
-  }
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  if (size <= 3) return 0;
 
-  const auto first = Data[0];
-  Data++;
-  Size--;
+  const auto first = data[0];
+  data++;
+  size--;
 
   try {
     switch (first) {
     case 0:
-      invoke_fmt<bool>(Data, Size);
+      invoke_fmt<bool>(data, size);
       break;
     case 1:
-      invoke_fmt<char>(Data, Size);
+      invoke_fmt<char>(data, size);
       break;
     case 2:
-      invoke_fmt<unsigned char>(Data, Size);
+      invoke_fmt<unsigned char>(data, size);
       break;
     case 3:
-      invoke_fmt<signed char>(Data, Size);
+      invoke_fmt<signed char>(data, size);
       break;
     case 4:
-      invoke_fmt<short>(Data, Size);
+      invoke_fmt<short>(data, size);
       break;
     case 5:
-      invoke_fmt<unsigned short>(Data, Size);
+      invoke_fmt<unsigned short>(data, size);
       break;
     case 6:
-      invoke_fmt<int>(Data, Size);
+      invoke_fmt<int>(data, size);
       break;
     case 7:
-      invoke_fmt<unsigned int>(Data, Size);
+      invoke_fmt<unsigned int>(data, size);
       break;
     case 8:
-      invoke_fmt<long>(Data, Size);
+      invoke_fmt<long>(data, size);
       break;
     case 9:
-      invoke_fmt<unsigned long>(Data, Size);
+      invoke_fmt<unsigned long>(data, size);
       break;
     case 10:
-      invoke_fmt<float>(Data, Size);
+      invoke_fmt<float>(data, size);
       break;
     case 11:
-      invoke_fmt<double>(Data, Size);
+      invoke_fmt<double>(data, size);
       break;
     case 12:
-      invoke_fmt<long double>(Data, Size);
+      invoke_fmt<long double>(data, size);
       break;
     case 13:
-      invoke_fmt_time(Data, Size);
+      invoke_fmt_time(data, size);
       break;
     default:
       break;
     }
-  } catch (std::exception& /*e*/) {
+  } catch (std::exception&) {
   }
   return 0;
 }

test/fuzzing/sprintf.cpp

-// Copyright (c) 2019, Paul Dreik
-// License: see LICENSE.rst in the fmt root directory
-#include <fmt/format.h>
-#include <fmt/printf.h>
-#include <cstdint>
-#include <stdexcept>
-
-#include "fuzzer_common.h"
-
-using fmt_fuzzer::Nfixed;
-
-template <typename Item1, typename Item2>
-void invoke_fmt(const uint8_t* Data, size_t Size) {
-  constexpr auto N1 = sizeof(Item1);
-  constexpr auto N2 = sizeof(Item2);
-  static_assert(N1 <= Nfixed, "size1 exceeded");
-  static_assert(N2 <= Nfixed, "size2 exceeded");
-  if (Size <= Nfixed + Nfixed) {
-    return;
-  }
-  Item1 item1 = fmt_fuzzer::assignFromBuf<Item1>(Data);
-  Data += Nfixed;
-  Size -= Nfixed;
-
-  Item2 item2 = fmt_fuzzer::assignFromBuf<Item2>(Data);
-  Data += Nfixed;
-  Size -= Nfixed;
-
-  auto fmtstring = fmt::string_view(fmt_fuzzer::as_chars(Data), Size);
-
-#if FMT_FUZZ_FORMAT_TO_STRING
-  std::string message = fmt::format(fmtstring, item1, item2);
-#else
-  fmt::memory_buffer message;
-  fmt::format_to(message, fmtstring, item1, item2);
-#endif
-}
-
-// for dynamic dispatching to an explicit instantiation
-template <typename Callback> void invoke(int index, Callback callback) {
-  switch (index) {
-  case 0:
-    callback(bool{});
-    break;
-  case 1:
-    callback(char{});
-    break;
-  case 2:
-    using sc = signed char;
-    callback(sc{});
-    break;
-  case 3:
-    using uc = unsigned char;
-    callback(uc{});
-    break;
-  case 4:
-    callback(short{});
-    break;
-  case 5:
-    using us = unsigned short;
-    callback(us{});
-    break;
-  case 6:
-    callback(int{});
-    break;
-  case 7:
-    callback(unsigned{});
-    break;
-  case 8:
-    callback(long{});
-    break;
-  case 9:
-    using ul = unsigned long;
-    callback(ul{});
-    break;
-  case 10:
-    callback(float{});
-    break;
-  case 11:
-    callback(double{});
-    break;
-  case 12:
-    using LD = long double;
-    callback(LD{});
-    break;
-  case 13:
-    using ptr = void*;
-    callback(ptr{});
-    break;
-  }
-}
-
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t* Data, size_t Size) {
-  if (Size <= 3) {
-    return 0;
-  }
-
-  // switch types depending on the first byte of the input
-  const auto first = Data[0] & 0x0F;
-  const auto second = (Data[0] & 0xF0) >> 4;
-  Data++;
-  Size--;
-
-  auto outer = [=](auto param1) {
-    auto inner = [=](auto param2) {
-      invoke_fmt<decltype(param1), decltype(param2)>(Data, Size);
-    };
-    invoke(second, inner);
-  };
-
-  try {
-    invoke(first, outer);
-  } catch (std::exception& /*e*/) {
-  }
-  return 0;
-}

test/fuzzing/two_args.cpp

 // Copyright (c) 2019, Paul Dreik
-// License: see LICENSE.rst in the fmt root directory
-#include <fmt/format.h>
+// For the license information refer to format.h.
+
 #include <cstdint>
-#include <stdexcept>
-#include <type_traits>
+#include <exception>
+#include <string>
+#include <fmt/format.h>
 
 #include "fuzzer_common.h"
 
-constexpr auto Nfixed = fmt_fuzzer::Nfixed;
+constexpr auto nfixed = fmt_fuzzer::nfixed;
 
 template <typename Item1, typename Item2>
-void invoke_fmt(const uint8_t* Data, size_t Size) {
-  constexpr auto N1 = sizeof(Item1);
-  constexpr auto N2 = sizeof(Item2);
-  static_assert(N1 <= Nfixed, "size1 exceeded");
-  static_assert(N2 <= Nfixed, "size2 exceeded");
-  if (Size <= Nfixed + Nfixed) {
-    return;
-  }
-  const Item1 item1 = fmt_fuzzer::assignFromBuf<Item1>(Data);
-  Data += Nfixed;
-  Size -= Nfixed;
+void invoke_fmt(const uint8_t* data, size_t size) {
+  static_assert(sizeof(Item1) <= nfixed, "size1 exceeded");
+  static_assert(sizeof(Item2) <= nfixed, "size2 exceeded");
+  if (size <= nfixed + nfixed) return;
+
+  const Item1 item1 = fmt_fuzzer::assignFromBuf<Item1>(data);
+  data += nfixed;
+  size -= nfixed;
 
-  const Item2 item2 = fmt_fuzzer::assignFromBuf<Item2>(Data);
-  Data += Nfixed;
-  Size -= Nfixed;
+  const Item2 item2 = fmt_fuzzer::assignFromBuf<Item2>(data);
+  data += nfixed;
+  size -= nfixed;
 
-  auto fmtstring = fmt::string_view(fmt_fuzzer::as_chars(Data), Size);
+  auto format_str = fmt::string_view(fmt_fuzzer::as_chars(data), size);
 
 #if FMT_FUZZ_FORMAT_TO_STRING
-  std::string message = fmt::format(fmtstring, item1, item2);
+  std::string message = fmt::format(format_str, item1, item2);
 #else
   fmt::memory_buffer message;
-  fmt::format_to(message, fmtstring, item1, item2);
+  fmt::format_to(message, format_str, item1, item2);
 #endif
 }
 
-// for dynamic dispatching to an explicit instantiation
+// For dynamic dispatching to an explicit instantiation.
 template <typename Callback> void invoke(int index, Callback callback) {
   switch (index) {
   case 0:
-    callback(bool{});
+    callback(bool());
     break;
   case 1:
-    callback(char{});
+    callback(char());
     break;
   case 2:
     using sc = signed char;
-    callback(sc{});
+    callback(sc());
     break;
   case 3:
     using uc = unsigned char;
-    callback(uc{});
+    callback(uc());
     break;
   case 4:
-    callback(short{});
+    callback(short());
     break;
   case 5:
     using us = unsigned short;
-    callback(us{});
+    callback(us());
     break;
   case 6:
-    callback(int{});
+    callback(int());
     break;
   case 7:
-    callback(unsigned{});
+    callback(unsigned());
     break;
   case 8:
-    callback(long{});
+    callback(long());
     break;
   case 9:
     using ul = unsigned long;
-    callback(ul{});
+    callback(ul());
     break;
   case 10:
-    callback(float{});
+    callback(float());
     break;
   case 11:
-    callback(double{});
+    callback(double());
     break;
   case 12:
     using LD = long double;
-    callback(LD{});
+    callback(LD());
+    break;
+  case 13:
+    using ptr = void*;
+    callback(ptr());
     break;
   }
 }
 
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t* Data, size_t Size) {
-  if (Size <= 3) {
-    return 0;
-  }
-
-  // switch types depending on the first byte of the input
-  const auto first = Data[0] & 0x0F;
-  const auto second = (Data[0] & 0xF0) >> 4;
-  Data++;
-  Size--;
-
-  auto outer = [=](auto param1) {
-    auto inner = [=](auto param2) {
-      invoke_fmt<decltype(param1), decltype(param2)>(Data, Size);
-    };
-    invoke(second, inner);
-  };
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  if (size <= 3) return 0;
 
+  // Switch types depending on the first byte of the input.
+  const auto first = data[0] & 0x0F;
+  const auto second = (data[0] & 0xF0) >> 4;
+  data++;
+  size--;
   try {
-    invoke(first, outer);
-  } catch (std::exception& /*e*/) {
+    invoke(first, [=](auto param1) {
+      invoke(second, [=](auto param2) {
+        invoke_fmt<decltype(param1), decltype(param2)>(data, size);
+      });
+    });
+  } catch (std::exception&) {
   }
   return 0;
 }