fuzz: add basic fuzz testing target.
fuzz-pack-headers.c provides a fuzzing entry point compatible with libFuzzer (and possibly other fuzzing engines). Signed-off-by: Josh Steadmon <steadmon@google.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Josh Steadmon committed
Oct 12, 2018 at 17:58 UTC
5e47215080018b7eea2054ec70f5d686715d66ee
3 files changed
+48
.gitignore
+2
@@ -1,3 +1,5 @@
1
+/fuzz_corpora
2
+/fuzz-pack-headers
3
/GIT-BUILD-OPTIONS
4
/GIT-CFLAGS
5
/GIT-LDFLAGS
Makefile
+32
@@ -590,6 +590,8 @@ XDIFF_OBJS =
590
VCSSVN_OBJS =
591
GENERATED_H =
592
EXTRA_CPPFLAGS =
593
+FUZZ_OBJS =
594
+FUZZ_PROGRAMS =
595
LIB_OBJS =
596
PROGRAM_OBJS =
597
PROGRAMS =
@@ -682,6 +684,13 @@ SCRIPTS = $(SCRIPT_SH_INS) \
684
685
ETAGS_TARGET = TAGS
686
687
+FUZZ_OBJS += fuzz-pack-headers.o
688
+
689
+# Always build fuzz objects even if not testing, to prevent bit-rot.
690
+all:: $(FUZZ_OBJS)
691
+
692
+FUZZ_PROGRAMS += $(patsubst %.o,%,$(FUZZ_OBJS))
693
+
694
# Empty...
695
EXTRA_PROGRAMS =
696
@@ -2250,6 +2259,7 @@ TEST_OBJS := $(patsubst %$X,%.o,$(TEST_PROGRAMS)) $(patsubst %,t/helper/%,$(TEST
2259
OBJECTS := $(LIB_OBJS) $(BUILTIN_OBJS) $(PROGRAM_OBJS) $(TEST_OBJS) \
2260
$(XDIFF_OBJS) \
2261
$(VCSSVN_OBJS) \
2262
+ $(FUZZ_OBJS) \
2263
common-main.o \
2264
git.o
2265
ifndef NO_CURL
@@ -2937,6 +2947,7 @@ clean: profile-clean coverage-clean cocciclean
2947
$(RM) $(LIB_FILE) $(XDIFF_LIB) $(VCSSVN_LIB)
2948
$(RM) $(ALL_PROGRAMS) $(SCRIPT_LIB) $(BUILT_INS) git$X
2949
$(RM) $(TEST_PROGRAMS) $(NO_INSTALL)
2950
+ $(RM) $(FUZZ_PROGRAMS)
2951
$(RM) -r bin-wrappers $(dep_dirs)
2952
$(RM) -r po/build/
2953
$(RM) *.pyc *.pyo */*.pyc */*.pyo command-list.h $(ETAGS_TARGET) tags cscope*
@@ -3061,3 +3072,24 @@ cover_db: coverage-report
3072
cover_db_html: cover_db
3073
cover -report html -outputdir cover_db_html cover_db
3074
3075
+
3076
+### Fuzz testing
3077
+#
3078
+# Building fuzz targets generally requires a special set of compiler flags that
3079
+# are not necessarily appropriate for general builds, and that vary greatly
3080
+# depending on the compiler version used.
3081
+#
3082
+# An example command to build against libFuzzer from LLVM 4.0.0:
3083
+#
3084
+# make CC=clang CXX=clang++ \
3085
+# CFLAGS="-fsanitize-coverage=trace-pc-guard -fsanitize=address" \
3086
+# LIB_FUZZING_ENGINE=/usr/lib/llvm-4.0/lib/libFuzzer.a \
3087
+# fuzz-all
3088
+#
3089
+.PHONY: fuzz-all
3090
+
3091
+$(FUZZ_PROGRAMS): all
3092
+ $(QUIET_LINK)$(CXX) $(CFLAGS) $(LIB_OBJS) $(BUILTIN_OBJS) \
3093
+ $(XDIFF_OBJS) $(EXTLIBS) git.o $@.o $(LIB_FUZZING_ENGINE) -o $@
3094
+
3095
+fuzz-all: $(FUZZ_PROGRAMS)
fuzz-pack-headers.c
new
+14
@@ -0,0 +1,14 @@
1
+#include "packfile.h"
2
+
3
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
4
+
5
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
6
+{
7
+ enum object_type type;
8
+ unsigned long len;
9
+
10
+ unpack_object_header_buffer((const unsigned char *)data,
11
+ (unsigned long)size, &type, &len);
12
+
13
+ return 0;
14
+}