[thirdparty/systemd.git] / tools / oss-fuzz.sh

#!/bin/bash
# SPDX-License-Identifier: LGPL-2.1+

set -ex

export LC_CTYPE=C.UTF-8

export CC=${CC:-clang}
export CXX=${CXX:-clang++}
clang_version="$($CC --version | sed -nr 's/.*version ([^ ]+?) .*/\1/p' | sed -r 's/-$//')"

SANITIZER=${SANITIZER:-address -fsanitize-address-use-after-scope}
flags="-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=$SANITIZER"

clang_lib="/usr/lib64/clang/${clang_version}/lib/linux"
[ -d "$clang_lib" ] || clang_lib="/usr/lib/clang/${clang_version}/lib/linux"

export CFLAGS=${CFLAGS:-$flags}
export CXXFLAGS=${CXXFLAGS:-$flags}
export LDFLAGS=${LDFLAGS:--L${clang_lib}}

export WORK=${WORK:-$(pwd)}
export OUT=${OUT:-$(pwd)/out}
mkdir -p $OUT

build=$WORK/build
rm -rf $build
mkdir -p $build

fuzzflag="oss-fuzz=true"
if [ -z "$FUZZING_ENGINE" ]; then
    fuzzflag="llvm-fuzz=true"
fi

meson $build -D$fuzzflag -Db_lundef=false
ninja -v -C $build fuzzers

# The seed corpus is a separate flat archive for each fuzzer,
# with a fixed name ${fuzzer}_seed_corpus.zip.
for d in "$(dirname "$0")/../test/fuzz/fuzz-"*; do
    zip -jqr $OUT/$(basename "$d")_seed_corpus.zip "$d"
done

# get fuzz-dns-packet corpus
df=$build/dns-fuzzing
git clone --depth 1 https://github.com/CZ-NIC/dns-fuzzing $df
zip -jqr $OUT/fuzz-dns-packet_seed_corpus.zip $df/packet

install -Dt $OUT/src/shared/ $build/src/shared/libsystemd-shared-*.so

wget -O $OUT/fuzz-json_seed_corpus.zip https://storage.googleapis.com/skia-fuzzer/oss-fuzz/skjson_seed_corpus.zip
wget -O $OUT/fuzz-json.dict https://raw.githubusercontent.com/rc0r/afl-fuzz/master/dictionaries/json.dict

find $build -maxdepth 1 -type f -executable -name "fuzz-*" -exec mv {} $OUT \;
find src -type f -name "fuzz-*.dict" -exec cp {} $OUT \;
cp src/fuzz/*.options $OUT
Commit	Line	Data
	1	#!/bin/bash
	2	# SPDX-License-Identifier: LGPL-2.1+
	3
	4	set -ex
	5
	6	export LC_CTYPE=C.UTF-8
	7
	8	export CC=${CC:-clang}
	9	export CXX=${CXX:-clang++}
	10	clang_version="$($CC --version \| sed -nr 's/.version ([^ ]+?) ./\1/p' \| sed -r 's/-$//')"
	11
	12	SANITIZER=${SANITIZER:-address -fsanitize-address-use-after-scope}
	13	flags="-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=$SANITIZER"
	14
	15	clang_lib="/usr/lib64/clang/${clang_version}/lib/linux"
	16	[ -d "$clang_lib" ] \|\| clang_lib="/usr/lib/clang/${clang_version}/lib/linux"
	17
	18	export CFLAGS=${CFLAGS:-$flags}
	19	export CXXFLAGS=${CXXFLAGS:-$flags}
	20	export LDFLAGS=${LDFLAGS:--L${clang_lib}}
	21
	22	export WORK=${WORK:-$(pwd)}
	23	export OUT=${OUT:-$(pwd)/out}
	24	mkdir -p $OUT
	25
	26	build=$WORK/build
	27	rm -rf $build
	28	mkdir -p $build
	29
	30	fuzzflag="oss-fuzz=true"
	31	if [ -z "$FUZZING_ENGINE" ]; then
	32	fuzzflag="llvm-fuzz=true"
	33	fi
	34
	35	meson $build -D$fuzzflag -Db_lundef=false
	36	ninja -v -C $build fuzzers
	37
	38	# The seed corpus is a separate flat archive for each fuzzer,
	39	# with a fixed name ${fuzzer}_seed_corpus.zip.
	40	for d in "$(dirname "$0")/../test/fuzz/fuzz-"*; do
	41	zip -jqr $OUT/$(basename "$d")_seed_corpus.zip "$d"
	42	done
	43
	44	# get fuzz-dns-packet corpus
	45	df=$build/dns-fuzzing
	46	git clone --depth 1 https://github.com/CZ-NIC/dns-fuzzing $df
	47	zip -jqr $OUT/fuzz-dns-packet_seed_corpus.zip $df/packet
	48
	49	install -Dt $OUT/src/shared/ $build/src/shared/libsystemd-shared-*.so
	50
	51	wget -O $OUT/fuzz-json_seed_corpus.zip https://storage.googleapis.com/skia-fuzzer/oss-fuzz/skjson_seed_corpus.zip
	52	wget -O $OUT/fuzz-json.dict https://raw.githubusercontent.com/rc0r/afl-fuzz/master/dictionaries/json.dict
	53
	54	find $build -maxdepth 1 -type f -executable -name "fuzz-*" -exec mv {} $OUT \;
	55	find src -type f -name "fuzz-*.dict" -exec cp {} $OUT \;
	56	cp src/fuzz/*.options $OUT