diff --git a/.gitignore b/.gitignore index 1f13761eb78..8afdc9611b9 100644 --- a/.gitignore +++ b/.gitignore @@ -129,3 +129,8 @@ compile_commands.json #vs code /.vscode + +# fuzzing output +/oss-fuzz/corpus +/oss-fuzz/corpus_ +/oss-fuzz/samples diff --git a/oss-fuzz/Makefile b/oss-fuzz/Makefile index 22c0a527023..72ce6c43581 100644 --- a/oss-fuzz/Makefile +++ b/oss-fuzz/Makefile @@ -1,6 +1,6 @@ # This file is generated by dmake, do not edit. -# CXX=clang++ MATCHCOMPILER=yes CXXFLAGS="-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=address -fsanitize-address-use-after-scope -DHAVE_BOOST" LIB_FUZZING_ENGINE="-fsanitize=fuzzer" oss-fuzz-client +# make CXX=clang++ MATCHCOMPILER=yes CXXFLAGS="-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=address -fsanitize-address-use-after-scope -DHAVE_BOOST" LIB_FUZZING_ENGINE="-fsanitize=fuzzer" oss-fuzz-client MATCHCOMPILER=yes ifndef MATCHCOMPILER @@ -112,6 +112,27 @@ translate: translate.o type2.o clean: rm -f *.o build/*.o oss-fuzz-client no-fuzz translate +preprare-samples: + rm -rf samples + mkdir -p samples + cp -R ../samples . + find ./samples -type f -name '*.txt' -exec rm -vf {} \; + +do-fuzz: oss-fuzz-client preprare-samples + mkdir -p corpus + ./oss-fuzz-client -only_ascii=1 -timeout=3 -detect_leaks=0 corpus samples ../test/cli/fuzz-crash ../test/cli/fuzz-timeout + +dedup-corpus: oss-fuzz-client preprare-samples + mv corpus corpus_ + mkdir -p corpus + ./oss-fuzz-client -only_ascii=1 -timeout=3 -detect_leaks=0 corpus corpus_ samples ../test/cli/fuzz-crash ../test/cli/fuzz-timeout -merge=1 + +# jobs: +# ./oss-fuzz-client -only_ascii=1 -timeout=3 -detect_leaks=0 corpus samples ../test/cli/fuzz-crash ../test/cli/fuzz-timeout -workers=12 -jobs=9 + +# minimize: +# ./oss-fuzz-client -only_ascii=1 -timeout=3 -detect_leaks=0 -minimize_crash=1 crash-0123456789abcdef + simplecpp.o: ../externals/simplecpp/simplecpp.cpp ../externals/simplecpp/simplecpp.h $(CXX) ${LIB_FUZZING_ENGINE} $(CPPFLAGS) $(CXXFLAGS) -w -c -o $@ ../externals/simplecpp/simplecpp.cpp diff --git a/tools/dmake/dmake.cpp b/tools/dmake/dmake.cpp index 6d8c9a5cab5..c74eeac69ef 100644 --- a/tools/dmake/dmake.cpp +++ b/tools/dmake/dmake.cpp @@ -343,7 +343,7 @@ static void write_ossfuzz_makefile(std::vector libfiles_prio, std:: fout << "# This file is generated by dmake, do not edit.\n"; fout << '\n'; - fout << "# CXX=clang++ MATCHCOMPILER=yes CXXFLAGS=\"-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=address -fsanitize-address-use-after-scope -DHAVE_BOOST\" LIB_FUZZING_ENGINE=\"-fsanitize=fuzzer\" oss-fuzz-client\n"; + fout << "# make CXX=clang++ MATCHCOMPILER=yes CXXFLAGS=\"-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=address -fsanitize-address-use-after-scope -DHAVE_BOOST\" LIB_FUZZING_ENGINE=\"-fsanitize=fuzzer\" oss-fuzz-client\n"; fout << '\n'; fout << "MATCHCOMPILER=yes\n"; // always need to enable the matchcompiler so the library files are being copied makeMatchcompiler(fout, "../", "--read-dir ../lib"); @@ -367,6 +367,27 @@ static void write_ossfuzz_makefile(std::vector libfiles_prio, std:: fout << "clean:\n"; fout << "\trm -f *.o build/*.o oss-fuzz-client no-fuzz translate\n"; fout << '\n'; + fout << "preprare-samples:\n"; + fout << "\trm -rf samples\n"; + fout << "\tmkdir -p samples\n"; + fout << "\tcp -R ../samples .\n"; + fout << "\tfind ./samples -type f -name '*.txt' -exec rm -vf {} \\;\n"; + fout << '\n'; + fout << "do-fuzz: oss-fuzz-client preprare-samples\n"; + fout << "\tmkdir -p corpus\n"; + fout << "\t./oss-fuzz-client -only_ascii=1 -timeout=3 -detect_leaks=0 corpus samples ../test/cli/fuzz-crash ../test/cli/fuzz-timeout\n"; + fout << '\n'; + fout << "dedup-corpus: oss-fuzz-client preprare-samples\n"; + fout << "\tmv corpus corpus_\n"; + fout << "\tmkdir -p corpus\n"; + fout << "\t./oss-fuzz-client -only_ascii=1 -timeout=3 -detect_leaks=0 corpus corpus_ samples ../test/cli/fuzz-crash ../test/cli/fuzz-timeout -merge=1\n"; + fout << '\n'; + fout << "# jobs:\n"; + fout << "# ./oss-fuzz-client -only_ascii=1 -timeout=3 -detect_leaks=0 corpus samples ../test/cli/fuzz-crash ../test/cli/fuzz-timeout -workers=12 -jobs=9\n"; + fout << '\n'; + fout << "# minimize:\n"; + fout << "# ./oss-fuzz-client -only_ascii=1 -timeout=3 -detect_leaks=0 -minimize_crash=1 crash-0123456789abcdef\n"; + fout << '\n'; compilefiles(fout, extfiles, "${LIB_FUZZING_ENGINE}"); compilefiles(fout, libfiles_prio, "${LIB_FUZZING_ENGINE}");