some fixes

allow output directory to be set with FUZZER_ARTIFACTS.
The default is $(BUILD_DIR)/fuzzer/$(PROTOCOL)

change -timeout=x to -max_total_time=$(FUZZER_TIMEOUT)

allow FUZZER_TIMEOUT to be set, too.  Default is 10s
for "test.fuzzer".  For "make fuzzer.radius", there's no
timeout.  Perhaps we could unify that.

Add FUZZER_ARGUMENTS for extra arguments which may be needed
by some process.

diff --git a/src/bin/all.mk b/src/bin/all.mk
index 01e0fb18877bfafd6187a1ed94b72187a2a20b61..e7fb104908db7eeb40441d587a6ed639030dde6e 100644 (file)
--- a/src/bin/all.mk
+++ b/src/bin/all.mk
@@ -28,6 +28,17 @@ FUZZER_PROTOCOLS = radius dhcpv4 dhcpv6 tacacs vmps
 #
 ifneq "$(findstring fuzzer,${CFLAGS})" ""
 
+#
+#  Put the output artifacts into the build directory, but only if the
+#  variable is not already set by the environment or make filesx
+#
+FUZZER_ARTIFACTS ?= ${BUILD_DIR}/fuzzer
+
+#
+#  Time out "test.fuzzer.foo" after this number of seconds
+#
+FUZZER_TIMEOUT   ?= 10
+
 #
 #  Define a function to do all of the same thing.
 #

diff --git a/src/bin/fuzzer.mk b/src/bin/fuzzer.mk
index 1825421310cab32c0ecc038af7d14f2a080cef51..a3d8b5a45cd18e0d86deaefb4a01462ce9001e96 100644 (file)
--- a/src/bin/fuzzer.mk
+++ b/src/bin/fuzzer.mk
@@ -36,7 +36,11 @@ src/tests/fuzzer-corpus/$(PROTOCOL):
                tar -xf $(PROTOCOL).tar; \
        fi
 
-$(TEST_BIN_DIR)/fuzzer_$(PROTOCOL): $(BUILD_DIR)/lib/local/libfreeradius-$(PROTOCOL).la
+.PHONY: $(FUZZER_ARTIFACTS)/$(PROTOCOL)
+$(FUZZER_ARTIFACTS)/$(PROTOCOL):
+       @mkdir -p $@
+
+$(TEST_BIN_DIR)/fuzzer_$(PROTOCOL): $(BUILD_DIR)/lib/local/libfreeradius-$(PROTOCOL).la | $(FUZZER_ARTIFACTS)/$(PROTOCOL)
 
 #
 #  Run the fuzzer binary against the fuzzer corpus data files.
@@ -51,10 +55,20 @@ $(TEST_BIN_DIR)/fuzzer_$(PROTOCOL): $(BUILD_DIR)/lib/local/libfreeradius-$(PROTO
 #  increase the size of the corpus by several times.
 #
 fuzzer.$(PROTOCOL): $(TEST_BIN_DIR)/fuzzer_$(PROTOCOL) | src/tests/fuzzer-corpus/$(PROTOCOL)
-       ${Q}$(TEST_BIN)/fuzzer_$(PROTOCOL) -max_len=512 -D share/dictionary src/tests/fuzzer-corpus/$(PROTOCOL)
+       ${Q}$(TEST_BIN)/fuzzer_$(PROTOCOL) \
+               -artifact_prefix="$(FUZZER_ARTIFACTS)/$(PROTOCOL)" \
+               -max_len=512 $(FUZZER_ARGUMENTS) \
+               -D share/dictionary \
+               src/tests/fuzzer-corpus/$(PROTOCOL)
 
 #
 #  tests add a 10s timeout.  This is so that we can see if the fuzzers run _at all_.
 #
 test.fuzzer.$(PROTOCOL): $(TEST_BIN_DIR)/fuzzer_$(PROTOCOL) | src/tests/fuzzer-corpus/$(PROTOCOL)
-       ${Q}$(TEST_BIN)/fuzzer_$(PROTOCOL) -max_len=512 -timeout=10 -D share/dictionary src/tests/fuzzer-corpus/$(PROTOCOL)
+       @echo TEST-FUZZER $(PROTOCOL) for $(FUZZER_TIMEOUT)s
+       ${Q}$(TEST_BIN)/fuzzer_$(PROTOCOL) \
+               -artifact_prefix="$(FUZZER_ARTIFACTS)/$(PROTOCOL)" \
+               -max_len=512 $(FUZZER_ARGUMENTS) \
+               -max_total_time=$(FUZZER_TIMEOUT) \
+               -D share/dictionary \
+               src/tests/fuzzer-corpus/$(PROTOCOL)