tools/oss-fuzz.sh

   1 #!/usr/bin/env bash
   2 # SPDX-License-Identifier: LGPL-2.1+
   3
   4 set -ex
   5
   6 export LC_CTYPE=C.UTF-8
   7
   8 export CC=${CC:-clang}
   9 export CXX=${CXX:-clang++}
  10 clang_version="$($CC --version | sed -nr 's/.*version ([^ ]+?) .*/\1/p' | sed -r 's/-$//')"
  11
  12 SANITIZER=${SANITIZER:-address -fsanitize-address-use-after-scope}
  13 flags="-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=$SANITIZER"
  14
  15 clang_lib="/usr/lib64/clang/${clang_version}/lib/linux"
  16 [ -d "$clang_lib" ] || clang_lib="/usr/lib/clang/${clang_version}/lib/linux"
  17
  18 export CFLAGS=${CFLAGS:-$flags}
  19 export CXXFLAGS=${CXXFLAGS:-$flags}
  20 export LDFLAGS=${LDFLAGS:--L${clang_lib}}
  21
  22 export WORK=${WORK:-$(pwd)}
  23 export OUT=${OUT:-$(pwd)/out}
  24 mkdir -p $OUT
  25
  26 build=$WORK/build
  27 rm -rf $build
  28 mkdir -p $build
  29
  30 if [ -z "$FUZZING_ENGINE" ]; then
  31     fuzzflag="llvm-fuzz=true"
  32 else
  33     fuzzflag="oss-fuzz=true"
  34     if [[ "$SANITIZER" == undefined ]]; then
  35         UBSAN_FLAGS="-fsanitize=pointer-overflow -fno-sanitize-recover=pointer-overflow"
  36         CFLAGS="$CFLAGS $UBSAN_FLAGS"
  37         CXXFLAGS="$CXXFLAGS $UBSAN_FLAGS"
  38     fi
  39 fi
  40
  41 meson $build -D$fuzzflag -Db_lundef=false
  42 ninja -v -C $build fuzzers
  43
  44 # The seed corpus is a separate flat archive for each fuzzer,
  45 # with a fixed name ${fuzzer}_seed_corpus.zip.
  46 for d in "$(dirname "$0")/../test/fuzz/fuzz-"*; do
  47     zip -jqr $OUT/$(basename "$d")_seed_corpus.zip "$d"
  48 done
  49
  50 # get fuzz-dns-packet corpus
  51 df=$build/dns-fuzzing
  52 git clone --depth 1 https://github.com/CZ-NIC/dns-fuzzing $df
  53 zip -jqr $OUT/fuzz-dns-packet_seed_corpus.zip $df/packet
  54
  55 install -Dt $OUT/src/shared/ $build/src/shared/libsystemd-shared-*.so
  56
  57 wget -O $OUT/fuzz-json.dict https://raw.githubusercontent.com/rc0r/afl-fuzz/master/dictionaries/json.dict
  58
  59 find $build -maxdepth 1 -type f -executable -name "fuzz-*" -exec mv {} $OUT \;
  60 find src -type f -name "fuzz-*.dict" -exec cp {} $OUT \;
  61 cp src/fuzz/*.options $OUT