From: Alan T. DeKok <aland@freeradius.org>
Date: Mon, 28 Oct 2019 12:32:16 +0000 (-0400)
Subject: create protocol-specific fuzzers
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4f3977db3701e0842554a2bcdf2c6fd3067e03cc;p=thirdparty%2Ffreeradius-server.git

create protocol-specific fuzzers
---

diff --git a/src/bin/.gitignore b/src/bin/.gitignore
index 65f5051f470..78bb33ea700 100644
--- a/src/bin/.gitignore
+++ b/src/bin/.gitignore
@@ -1,3 +1,4 @@
 checkrad
 radlast
 radtest
+fuzzer_radius.mk
diff --git a/src/bin/all.mk b/src/bin/all.mk
index 13515a3371e..b13bd40bb94 100644
--- a/src/bin/all.mk
+++ b/src/bin/all.mk
@@ -17,5 +17,24 @@ SUBMAKEFILES := \
 #  Add the fuzzer only if everything was built with the fuzzing flags.
 #
 ifneq "$(findstring -fsanitize=fuzzer,${CFLAGS})" ""
-SUBMAKEFILES += fuzzer.mk
+
+#
+#  Define a function to do all of the same thing.
+#
+define FUZZ_PROTOCOL
+src/bin/fuzzer_${1}.mk: src/bin/fuzzer.mk
+	$${Q}echo "PROTOCOL=${1}" > $$@
+	$${Q}cat $$^ >> $$@
+
+SUBMAKEFILES += fuzzer_${1}.mk
+endef
+
+#
+#  Add the list of protocols to be fuzzed here Each protocol needs to
+#  have a test point for packet decoding.  See
+#  src/protocols/radius/decode.c for an example.
+#
+PROTOCOLS = radius
+
+$(foreach X,${PROTOCOLS},$(eval $(call FUZZ_PROTOCOL,${X})))
 endif
diff --git a/src/bin/fuzzer.mk b/src/bin/fuzzer.mk
index a2fe4481eee..f5d7fdd3cd5 100644
--- a/src/bin/fuzzer.mk
+++ b/src/bin/fuzzer.mk
@@ -9,12 +9,22 @@
 #
 #  FR_LIBRARY_PATH=./build/lib/ FR_LIBRARY_FUZZ_PROTOCOL=radius FR_DICTIONARY_DIR=./share/dictionary/ ./build/make/jlibtool --mode=execute ./build/bin/local/fuzzer /path/to/corpus/directory/
 #
-#  Command-line option parsing will be added later.
+
+#
+#  The libraries to be fuzzed MUST be explicitly linked to the protocol libraries.
+#  Dynamic loading will NOT work.  In order to simplify the process, the protocol
+#  libraries export a common test point.  We have one source / make file, which
+#  then magically turns into different fuzzers.
 #
-TARGET		:= fuzzer
+#  However, because the *test point* functions are loaded dynamically,
+#  you still have to tell the fuzzer which library it's supposed to
+#  load.
+#
+
+TARGET		:= fuzzer_$(PROTOCOL)
 SOURCES		:= fuzzer.c
 
-TGT_PREREQS	:= libfreeradius-util.a libfreeradius-radius.a
+TGT_PREREQS	:= libfreeradius-util.a libfreeradius-$(PROTOCOL).a
 
 SRC_CFLAGS	:= -fsanitize=fuzzer
 TGT_LDFLAGS	:= -fsanitize=fuzzer