Closed
Description
This in an umbrella issue for setting up regular fuzzing for harfbuzz and fixing the bugs that we find with fuzzing.
The starting point is the target function below used with libFuzzer.
#include "src/hb.h"
#include "src/hb-ot.h"
#include "Fuzzer/FuzzerInterface.h"
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
const char text[] = "ABCDEXYZ123@_%&)*$!";
hb_blob_t *blob = hb_blob_create((const char *)data, size,
HB_MEMORY_MODE_READONLY, NULL, NULL);
hb_face_t *face = hb_face_create(blob, 0);
hb_font_t *font = hb_font_create(face);
hb_ot_font_set_funcs(font);
hb_font_set_scale(font, 12, 12);
hb_buffer_t *buffer = hb_buffer_create();
hb_buffer_add_utf8(buffer, text, -1, 0, -1);
hb_buffer_guess_segment_properties(buffer);
hb_shape(font, buffer, NULL, 0);
hb_buffer_destroy(buffer);
hb_font_destroy(font);
hb_face_destroy(face);
hb_blob_destroy(blob);
return 0;
}Eventually we'll need to submit this function to harfbuzz repo and extend it to cover more code.
Currently, this is my workflow to build the fuzzer:
(
cd harfbuzz
make distclean
SAN=-fsanitize=address
COV=-fsanitize-coverage=edge,8bit-counters,trace-cmp
CXX="clang++ $SAN $COV" CC="clang $SAN $COV" CCLD="clang++ $SAN $COV" ../harfbuzz/configure --enable-static --disable-shared
make -j
)
clang++ -std=c++11 harfbuzz_fuzzer.cc -fsanitize=address -fsanitize-coverage=edge -I harfbuzz -I. ./harfbuzz/src/.libs/libharfbuzz.a -lglib-2.0 Fuzzer*.o -o harfbuzz_fuzzerMetadata
Assignees
Labels
No labels