From 81dcf271fcea2f1a6138e50d87457d2174dbb704 Mon Sep 17 00:00:00 2001 From: Xinhao Yuan Date: Tue, 1 Sep 2026 12:58:55 -0700 Subject: [PATCH] Move input size limit enforcement to LegacyRunnerCallbacks. Truncating on the non-legacy, i.e. FuzzTest runners does not make sense because FuzzTest deserialization would almost always fall back to random init data if the input is truncated. Not sure if we really need this cap at all given the max_len hint. But keeping it for now. PiperOrigin-RevId: 974659406 --- centipede/runner.cc | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/centipede/runner.cc b/centipede/runner.cc index 88a4ce90d..2dd91add5 100644 --- a/centipede/runner.cc +++ b/centipede/runner.cc @@ -279,9 +279,6 @@ extern "C" size_t LLVMFuzzerMutate(uint8_t* data, size_t size, return CentipedeLLVMFuzzerMutateCallback(data, size, max_size); } -// An arbitrary large size for input data. -static const size_t kMaxDataSize = 1 << 20; - static void WriteFeaturesToFile(FILE* file, const feature_t* features, size_t size) { if (!size) return; @@ -510,9 +507,7 @@ static int ExecuteInputsFromShmem(BlobSequence& inputs_blobseq, if (!blob.IsValid()) break; // no more blobs to read. if (!IsDataInput(blob)) return EXIT_FAILURE; - // TODO(kcc): [impl] handle sizes larger than kMaxDataSize. - size_t size = std::min(kMaxDataSize, blob.size); - inputs.push_back(callbacks.DeserializeInput({blob.data, size})); + inputs.push_back(callbacks.DeserializeInput({blob.data, blob.size})); } CentipedeBeginExecutionBatch(); @@ -717,8 +712,11 @@ void LegacyRunnerCallbacks::SerializeInput( } void* LegacyRunnerCallbacks::DeserializeInput(ByteSpan input_bytes) { + // An arbitrary large size for input data. + static const size_t kMaxDataSize = 1 << 20; + const size_t size = std::min(input_bytes.size(), kMaxDataSize); return reinterpret_cast( - new ByteArray{input_bytes.begin(), input_bytes.end()}); + new ByteArray{input_bytes.data(), input_bytes.data() + size}); } void LegacyRunnerCallbacks::FreeInput(void* input) {