2020-04-17 09:49:10 +08:00
|
|
|
option(ENABLE_FUZZING "enable building the fuzzers" ON)
|
|
|
|
|
|
|
|
if(ENABLE_FUZZING)
|
|
|
|
|
|
|
|
# First attempt at a fuzzer, using libFuzzer.
|
|
|
|
#
|
|
|
|
# compile like this:
|
|
|
|
# mkdir build-fuzzer
|
|
|
|
# cd build-fuzzer
|
|
|
|
# export LDFLAGS="-fsanitize=address,undefined"
|
|
|
|
# export CXXFLAGS="-fsanitize=fuzzer-no-link,address,undefined"
|
|
|
|
# export CFLAGS="-fsanitize=fuzzer-no-link,address,undefined"
|
|
|
|
# export CXX=clang++
|
|
|
|
# export CC=clang++
|
|
|
|
# cmake .. -GNinja -DCMAKE_BUILD_TYPE=Debug -DENABLE_FUZZING=On -DSIMDJSON_FUZZ_LINKMAIN=Off -DSIMDJSON_FUZZ_LDFLAGS=-fsanitize=fuzzer
|
|
|
|
# ninja
|
|
|
|
|
|
|
|
# settings this links in a main. useful for reproducing,
|
|
|
|
# kcov, gdb, afl, valgrind.
|
|
|
|
# (note that libFuzzer can also reproduce, just pass it the files)
|
|
|
|
#
|
|
|
|
# Using this by default, means the fuzzers will be built as a part of the normal
|
|
|
|
# workflow, meaning they wont bitrot and will participate in refactoring etc.
|
|
|
|
#
|
|
|
|
option(SIMDJSON_FUZZ_LINKMAIN "links a main into fuzz targets for building reproducers" On)
|
|
|
|
|
|
|
|
# For oss-fuzz - insert $LIB_FUZZING_ENGINE into the link flags, but only for
|
|
|
|
# the fuzz targets, otherwise the cmake configuration step fails.
|
|
|
|
set(SIMDJSON_FUZZ_LDFLAGS "" CACHE STRING "LDFLAGS for the fuzz targets")
|
|
|
|
|
|
|
|
# Fuzzer build flags and libraries
|
|
|
|
add_library(simdjson-fuzzer INTERFACE)
|
2019-11-08 23:32:43 +08:00
|
|
|
if (SIMDJSON_FUZZ_LINKMAIN)
|
2020-05-02 10:21:57 +08:00
|
|
|
target_link_libraries(simdjson-fuzzer INTERFACE simdjson-source)
|
2020-04-17 09:49:10 +08:00
|
|
|
target_sources(simdjson-fuzzer INTERFACE $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}>/main.cpp)
|
2020-05-02 10:21:57 +08:00
|
|
|
else ()
|
|
|
|
target_link_libraries(simdjson-fuzzer INTERFACE simdjson)
|
2019-11-08 23:32:43 +08:00
|
|
|
endif ()
|
2020-05-03 07:48:29 +08:00
|
|
|
target_link_libraries(simdjson-fuzzer INTERFACE simdjson-internal-flags)
|
2020-04-17 09:49:10 +08:00
|
|
|
target_link_libraries(simdjson-fuzzer INTERFACE ${SIMDJSON_FUZZ_LDFLAGS})
|
2020-04-28 04:02:19 +08:00
|
|
|
|
|
|
|
# Define the fuzzers
|
|
|
|
add_custom_target(all_fuzzers)
|
|
|
|
|
2020-09-26 20:25:00 +08:00
|
|
|
set(fuzzernames)
|
2020-04-17 09:49:10 +08:00
|
|
|
function(implement_fuzzer name)
|
|
|
|
add_executable(${name} ${name}.cpp)
|
|
|
|
target_link_libraries(${name} PRIVATE simdjson-fuzzer)
|
2020-04-28 04:02:19 +08:00
|
|
|
add_dependencies(all_fuzzers ${name})
|
2020-09-26 20:25:00 +08:00
|
|
|
set(fuzzernames ${fuzzernames} ${name} PARENT_SCOPE)
|
2020-04-17 09:49:10 +08:00
|
|
|
endfunction()
|
|
|
|
|
2020-09-17 03:17:43 +08:00
|
|
|
implement_fuzzer(fuzz_atpointer)
|
2020-04-17 09:49:10 +08:00
|
|
|
implement_fuzzer(fuzz_dump)
|
|
|
|
implement_fuzzer(fuzz_dump_raw_tape)
|
2020-09-26 20:25:00 +08:00
|
|
|
implement_fuzzer(fuzz_implementations) # parses and serializes again, compares across implementations
|
|
|
|
implement_fuzzer(fuzz_minify) # minify *with* parsing
|
|
|
|
implement_fuzzer(fuzz_minifyimpl) # minify *without* parsing, plus compare implementations
|
add multi implementation fuzzer (#1162)
This adds a fuzzer which parses the same input using all the available implementations (haswell, westmere, fallback on x64).
This should get the otherwise uncovered sourcefiles (mostly fallback) to show up in the fuzz coverage.
For instance, the fallback directory has only one line covered.
As of the 20200909 report, 1866 lines are covered out of 4478.
Also, it will detect if the implementations behave differently:
by making sure they all succeed, or all error
turning the parsed data into text again, should produce equal results
While at it, I corrected some minor things:
clean up building too many variants, run with forced implementation (closes #815 )
always store crashes as artefacts, good in case the fuzzer finds something
return value of the fuzzer function should always be 0
reduce log spam
introduce max size for the seed corpus and the CI fuzzer
2020-09-12 05:46:22 +08:00
|
|
|
implement_fuzzer(fuzz_parser)
|
|
|
|
implement_fuzzer(fuzz_print_json)
|
2020-09-28 03:11:13 +08:00
|
|
|
implement_fuzzer(fuzz_utf8) # utf8 verification, compares across implementations
|
2020-09-26 20:25:00 +08:00
|
|
|
|
|
|
|
# to be able to get a list of all fuzzers from within a script
|
|
|
|
add_custom_target(print_all_fuzzernames
|
|
|
|
COMMAND ${CMAKE_COMMAND} -E echo ${fuzzernames})
|
2020-04-17 09:49:10 +08:00
|
|
|
|
|
|
|
endif()
|