ruff/fuzz/fuzz_targets/ruff_parse_simple.rs

//! Fuzzer harness which merely explores the parse/unparse coverage space and tries to make it
//! crash. On its own, this fuzzer is (hopefully) not going to find a crash.

#![no_main]

use libfuzzer_sys::{fuzz_target, Corpus};
use ruff_python_codegen::{Generator, Stylist};
use ruff_python_parser::{lexer, parse_suite, Mode, ParseError};
use ruff_source_file::Locator;

fn do_fuzz(case: &[u8]) -> Corpus {
    let Ok(code) = std::str::from_utf8(case) else {
        return Corpus::Reject;
    };

    // just round-trip it once to trigger both parse and unparse
    let locator = Locator::new(code);
    let python_ast = match parse_suite(code) {
        Ok(stmts) => stmts,
        Err(ParseError { location, .. }) => {
            let offset = location.start().to_usize();
            assert!(
                code.is_char_boundary(offset),
                "Invalid error location {} (not at char boundary)",
                offset
            );
            return Corpus::Keep;
        }
    };

    let tokens: Vec<_> = lexer::lex(code, Mode::Module).collect();

    for maybe_token in tokens.iter() {
        match maybe_token.as_ref() {
            Ok((_, range)) => {
                let start = range.start().to_usize();
                let end = range.end().to_usize();
                assert!(
                    code.is_char_boundary(start),
                    "Invalid start position {} (not at char boundary)",
                    start
                );
                assert!(
                    code.is_char_boundary(end),
                    "Invalid end position {} (not at char boundary)",
                    end
                );
            }
            Err(err) => {
                let offset = err.location().start().to_usize();
                assert!(
                    code.is_char_boundary(offset),
                    "Invalid error location {} (not at char boundary)",
                    offset
                );
            }
        }
    }

    let stylist = Stylist::from_tokens(&tokens, &locator);
    let mut generator: Generator = (&stylist).into();
    generator.unparse_suite(&python_ast);

    Corpus::Keep
}

fuzz_target!(|case: &[u8]| -> Corpus { do_fuzz(case) });