ruff/fuzz/fuzz_targets/ruff_parse_simple.rs

//! Fuzzer harness which merely explores the parse/unparse coverage space and tries to make it
//! crash. On its own, this fuzzer is (hopefully) not going to find a crash.

#![no_main]

use libfuzzer_sys::{fuzz_target, Corpus};
use ruff_python_codegen::{Generator, Stylist};
use ruff_python_parser::{parse_module, ParseError};
use ruff_text_size::Ranged;

fn do_fuzz(case: &[u8]) -> Corpus {
    let Ok(code) = std::str::from_utf8(case) else {
        return Corpus::Reject;
    };

    // just round-trip it once to trigger both parse and unparse
    let parsed = match parse_module(code) {
        Ok(parsed) => parsed,
        Err(ParseError { location, .. }) => {
            let offset = location.start().to_usize();
            assert!(
                code.is_char_boundary(offset),
                "Invalid error location {} (not at char boundary)",
                offset
            );
            return Corpus::Keep;
        }
    };

    for token in parsed.tokens() {
        let start = token.start().to_usize();
        let end = token.end().to_usize();
        assert!(
            code.is_char_boundary(start),
            "Invalid start position {} (not at char boundary)",
            start
        );
        assert!(
            code.is_char_boundary(end),
            "Invalid end position {} (not at char boundary)",
            end
        );
    }

    let stylist = Stylist::from_tokens(parsed.tokens(), code);
    let mut generator: Generator = (&stylist).into();
    generator.unparse_suite(parsed.suite());

    Corpus::Keep
}

fuzz_target!(|case: &[u8]| -> Corpus { do_fuzz(case) });