Re: [PATCH v3] fuzz: add new oss-fuzz fuzzer for date.c / date.h

From: Junio C Hamano <gitster@pobox.com>
Date: Nov 14, 2023, 17:03 UTC
Message-ID: <xmqqv8a4xo6g.fsf@gitster.g>
In-Reply-To: <pull.1612.v3.git.1699959186146.gitgitgadget@gmail.com>

"Arthur Chan via GitGitGadget" <gitgitgadget@gmail.com> writes:

>      ++	tmp_data = (int8_t*)data;
>      ++	tz = *tmp_data++;
>      ++	tz = (tz << 8) | *tmp_data++;
>      ++	tz = (tz << 8) | *tmp_data++;

This has a funny skew towards negative number. Any time MSB of the one of the three bytes is set, tz becomes negative. Worse, a byte taken from *tmp_data that has its MSB on will _wipe_ what was read in tz so far, because its higher order bits above 8th bit are sign extended. If the incoming data is evenly distributed, 7/8 of the time, you'd end up with a negative number in tz, no?

I think you can and should pick bytes with uint8_t pointer to avoid sign extending individual bytes and sign extend the resulting number at the end. Or if it is too cumbersome to do so, using "int16_t tz" and filling it with two bytes from *data will sign extend itself when we pass it to show_date() as a parameter of type "int", which may be the easiest to code, I suspect.

Thanks.