fuzz: add basic fuzz testing target.

fuzz-pack-headers.c provides a fuzzing entry point compatible with libFuzzer (and possibly other fuzzing engines). Signed-off-by: Josh Steadmon <steadmon@google.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Josh Steadmon committed Oct 12, 2018 at 17:58 UTC 5e47215080018b7eea2054ec70f5d686715d66ee
3 files changed +48
.gitignore
+2
@@ -1,3 +1,5 @@
1 +/fuzz_corpora
2 +/fuzz-pack-headers
3 /GIT-BUILD-OPTIONS
4 /GIT-CFLAGS
5 /GIT-LDFLAGS
Makefile
+32
@@ -590,6 +590,8 @@ XDIFF_OBJS =
590 VCSSVN_OBJS =
591 GENERATED_H =
592 EXTRA_CPPFLAGS =
593 +FUZZ_OBJS =
594 +FUZZ_PROGRAMS =
595 LIB_OBJS =
596 PROGRAM_OBJS =
597 PROGRAMS =
@@ -682,6 +684,13 @@ SCRIPTS = $(SCRIPT_SH_INS) \
684
685 ETAGS_TARGET = TAGS
686
687 +FUZZ_OBJS += fuzz-pack-headers.o
688 +
689 +# Always build fuzz objects even if not testing, to prevent bit-rot.
690 +all:: $(FUZZ_OBJS)
691 +
692 +FUZZ_PROGRAMS += $(patsubst %.o,%,$(FUZZ_OBJS))
693 +
694 # Empty...
695 EXTRA_PROGRAMS =
696
@@ -2250,6 +2259,7 @@ TEST_OBJS := $(patsubst %$X,%.o,$(TEST_PROGRAMS)) $(patsubst %,t/helper/%,$(TEST
2259 OBJECTS := $(LIB_OBJS) $(BUILTIN_OBJS) $(PROGRAM_OBJS) $(TEST_OBJS) \
2260 $(XDIFF_OBJS) \
2261 $(VCSSVN_OBJS) \
2262 + $(FUZZ_OBJS) \
2263 common-main.o \
2264 git.o
2265 ifndef NO_CURL
@@ -2937,6 +2947,7 @@ clean: profile-clean coverage-clean cocciclean
2947 $(RM) $(LIB_FILE) $(XDIFF_LIB) $(VCSSVN_LIB)
2948 $(RM) $(ALL_PROGRAMS) $(SCRIPT_LIB) $(BUILT_INS) git$X
2949 $(RM) $(TEST_PROGRAMS) $(NO_INSTALL)
2950 + $(RM) $(FUZZ_PROGRAMS)
2951 $(RM) -r bin-wrappers $(dep_dirs)
2952 $(RM) -r po/build/
2953 $(RM) *.pyc *.pyo */*.pyc */*.pyo command-list.h $(ETAGS_TARGET) tags cscope*
@@ -3061,3 +3072,24 @@ cover_db: coverage-report
3072 cover_db_html: cover_db
3073 cover -report html -outputdir cover_db_html cover_db
3074
3075 +
3076 +### Fuzz testing
3077 +#
3078 +# Building fuzz targets generally requires a special set of compiler flags that
3079 +# are not necessarily appropriate for general builds, and that vary greatly
3080 +# depending on the compiler version used.
3081 +#
3082 +# An example command to build against libFuzzer from LLVM 4.0.0:
3083 +#
3084 +# make CC=clang CXX=clang++ \
3085 +# CFLAGS="-fsanitize-coverage=trace-pc-guard -fsanitize=address" \
3086 +# LIB_FUZZING_ENGINE=/usr/lib/llvm-4.0/lib/libFuzzer.a \
3087 +# fuzz-all
3088 +#
3089 +.PHONY: fuzz-all
3090 +
3091 +$(FUZZ_PROGRAMS): all
3092 + $(QUIET_LINK)$(CXX) $(CFLAGS) $(LIB_OBJS) $(BUILTIN_OBJS) \
3093 + $(XDIFF_OBJS) $(EXTLIBS) git.o $@.o $(LIB_FUZZING_ENGINE) -o $@
3094 +
3095 +fuzz-all: $(FUZZ_PROGRAMS)
fuzz-pack-headers.c new
+14
@@ -0,0 +1,14 @@
1 +#include "packfile.h"
2 +
3 +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
4 +
5 +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
6 +{
7 + enum object_type type;
8 + unsigned long len;
9 +
10 + unpack_object_header_buffer((const unsigned char *)data,
11 + (unsigned long)size, &type, &len);
12 +
13 + return 0;
14 +}