fuzzing dtc with AFL

[Anton Blanchard <anton-eUNUBHrolfbYtjvyW6yDsg@public.gmane.org>]

[-- Attachment #1: Type: text/plain, Size: 560 bytes --]

Hi David,

I wanted something to test AFL with, and since dtc is simple, self
contained and checked out on my laptop, I attacked it. It found a
number of interesting testcases:

A divide by zero issue:

# ./dtc test1.dts 
Floating point exception

An issue parsing octals:

# ./dtc test2.dts 
dtc: dtc-lexer.l:156: yylex: Assertion `!(*e) || !e[strspn(e, "UL")]'
failed.
Aborted

An issue with null escape characters:

# ./dtc test3.dts 
dtc: util.c:155: get_escape_char: Assertion `c' failed.
Aborted

and a SEGV:

# ./dtc test4.dts 
Segmentation fault

Anton

[-- Attachment #2: test1.dts --]
[-- Type: audio/vnd.dts, Size: 31 bytes --]

[-- Attachment #3: test2.dts --]
[-- Type: audio/vnd.dts, Size: 29 bytes --]

[-- Attachment #4: test3.dts --]
[-- Type: audio/vnd.dts, Size: 36 bytes --]

[-- Attachment #5: test4.dts --]
[-- Type: audio/vnd.dts, Size: 8 bytes --]