tools/oss-fuzz.sh

   1 #!/usr/bin/env bash
   2 # SPDX-License-Identifier: LGPL-2.1-or-later
   3
   4 set -ex
   5
   6 export LC_CTYPE=C.UTF-8
   7
   8 export CC=${CC:-clang}
   9 export CXX=${CXX:-clang++}
  10 clang_version="$($CC --version | sed -nr 's/.*version ([^ ]+?) .*/\1/p' | sed -r 's/-$//')"
  11
  12 SANITIZER=${SANITIZER:-address -fsanitize-address-use-after-scope}
  13 flags="-O1 -fno-omit-frame-pointer -g -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=$SANITIZER"
  14
  15 clang_lib="/usr/lib64/clang/${clang_version}/lib/linux"
  16 [ -d "$clang_lib" ] || clang_lib="/usr/lib/clang/${clang_version}/lib/linux"
  17
  18 export CFLAGS=${CFLAGS:-$flags}
  19 export CXXFLAGS=${CXXFLAGS:-$flags}
  20 export LDFLAGS=${LDFLAGS:--L${clang_lib}}
  21
  22 export WORK=${WORK:-$(pwd)}
  23 export OUT=${OUT:-$(pwd)/out}
  24 mkdir -p "$OUT"
  25
  26 build="$WORK/build"
  27 rm -rf "$build"
  28 mkdir -p "$build"
  29
  30 if [ -z "$FUZZING_ENGINE" ]; then
  31     fuzzflag="llvm-fuzz=true"
  32 else
  33     fuzzflag="oss-fuzz=true"
  34
  35     apt-get update
  36     apt-get install -y gperf m4 gettext python3-pip \
  37         libcap-dev libmount-dev libkmod-dev \
  38         pkg-config wget python3-jinja2
  39
  40     # gnu-efi is installed here to enable -Dgnu-efi behind which fuzz-bcd
  41     # is hidden. It isn't linked against efi. It doesn't
  42     # even include "efi.h" because "bcd.c" can work in "unit test" mode
  43     # where it isn't necessary.
  44     apt-get install -y gnu-efi zstd
  45
  46     pip3 install -r .github/workflows/requirements.txt --require-hashes
  47
  48     # https://github.com/google/oss-fuzz/issues/6868
  49     ORIG_PYTHONPATH=$(python3 -c 'import sys;print(":".join(sys.path[1:]))')
  50     export PYTHONPATH="$ORIG_PYTHONPATH:/usr/lib/python3/dist-packages/"
  51
  52     if [[ "$SANITIZER" == undefined ]]; then
  53         additional_ubsan_checks=pointer-overflow,alignment
  54         UBSAN_FLAGS="-fsanitize=$additional_ubsan_checks -fno-sanitize-recover=$additional_ubsan_checks"
  55         CFLAGS="$CFLAGS $UBSAN_FLAGS"
  56         CXXFLAGS="$CXXFLAGS $UBSAN_FLAGS"
  57     fi
  58 fi
  59
  60 if ! meson "$build" "-D$fuzzflag" -Db_lundef=false; then
  61     cat "$build/meson-logs/meson-log.txt"
  62     exit 1
  63 fi
  64
  65 ninja -v -C "$build" fuzzers
  66
  67 # Compressed BCD files are kept in test/test-bcd so let's unpack them
  68 # and put them all in the seed corpus.
  69 bcd=$(mktemp -d)
  70 for i in test/test-bcd/*.zst; do
  71      unzstd "$i" -o "$bcd/$(basename "${i%.zst}")";
  72 done
  73 zip -jqr "$OUT/fuzz-bcd_seed_corpus.zip" "$bcd"
  74 rm -rf "$bcd"
  75
  76 # The seed corpus is a separate flat archive for each fuzzer,
  77 # with a fixed name ${fuzzer}_seed_corpus.zip.
  78 for d in "$(dirname "$0")/../test/fuzz/fuzz-"*; do
  79     zip -jqr "$OUT/$(basename "$d")_seed_corpus.zip" "$d"
  80 done
  81
  82 # get fuzz-dns-packet corpus
  83 df="$build/dns-fuzzing"
  84 git clone --depth 1 https://github.com/CZ-NIC/dns-fuzzing "$df"
  85 zip -jqr "$OUT/fuzz-dns-packet_seed_corpus.zip" "$df/packet"
  86
  87 install -Dt "$OUT/src/shared/" \
  88         "$build"/src/shared/libsystemd-shared-*.so \
  89         "$build"/src/core/libsystemd-core-*.so
  90
  91 wget -O "$OUT/fuzz-json.dict" https://raw.githubusercontent.com/rc0r/afl-fuzz/master/dictionaries/json.dict
  92
  93 find "$build" -maxdepth 1 -type f -executable -name "fuzz-*" -exec mv {} "$OUT" \;
  94 find src -type f -name "fuzz-*.dict" -exec cp {} "$OUT" \;
  95 cp src/fuzz/*.options "$OUT"