Skip to content

Commit

Permalink
fuzzers: add build support and instructions
Browse files Browse the repository at this point in the history
This change adds support for building a fuzz target for exercising the
packfile parser, as well as documentation. It also runs the fuzzers in
Travis to avoid regressions.
  • Loading branch information
lhchavez authored and pks-t committed Aug 3, 2018
1 parent 0cf7546 commit 60e610a
Show file tree
Hide file tree
Showing 322 changed files with 380 additions and 1 deletion.
2 changes: 2 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -31,3 +31,5 @@ msvc/Release/
.*.swp
tags
mkmf.log
*.profdata
*.profraw
33 changes: 33 additions & 0 deletions CMakeLists.txt
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ OPTION( BUILD_SHARED_LIBS "Build Shared Library (OFF for Static)" ON )
OPTION( THREADSAFE "Build libgit2 as threadsafe" ON )
OPTION( BUILD_CLAR "Build Tests using the Clar suite" ON )
OPTION( BUILD_EXAMPLES "Build library usage example apps" OFF )
OPTION( BUILD_FUZZERS "Build the fuzz targets" OFF)
OPTION( TAGS "Generate tags" OFF )
OPTION( PROFILE "Generate profiling information" OFF )
OPTION( ENABLE_TRACE "Enables tracing support" OFF )
Expand All @@ -52,6 +53,9 @@ SET(SHA1_BACKEND "CollisionDetection" CACHE STRING "Backend to use for SHA1. One
OPTION( USE_SSH "Link with libssh to enable SSH support" ON )
OPTION( USE_HTTPS "Enable HTTPS support. Can be set to a specific backend" ON )
OPTION( USE_GSSAPI "Link with libgssapi for SPNEGO auth" OFF )
OPTION( USE_SANITIZER "Enable one of the Sanitizers (requires clang)" OFF )
OPTION( USE_COVERAGE "Enable clang's coverage report (requires clang)" OFF )
OPTION( USE_STANDALONE_FUZZERS "Enable standalone fuzzers (compatible with gcc)" OFF )
OPTION( VALGRIND "Configure build for valgrind" OFF )
OPTION( CURL "Use curl for HTTP if available" ON)
OPTION( USE_EXT_HTTP_PARSER "Use system HTTP_Parser if available" ON)
Expand Down Expand Up @@ -245,6 +249,23 @@ ELSE()
# that uses CMAKE_CONFIGURATION_TYPES and not CMAKE_BUILD_TYPE
ENDIF()

IF(NOT USE_SANITIZER STREQUAL "OFF")
SET(CMAKE_C_FLAGS "-fsanitize=${USE_SANITIZER} ${CMAKE_C_FLAGS}")
SET(CMAKE_C_FLAGS "-fno-omit-frame-pointer ${CMAKE_C_FLAGS}")
SET(CMAKE_C_FLAGS "-fno-optimize-sibling-calls ${CMAKE_C_FLAGS}")
ENDIF()

IF(USE_COVERAGE)
SET(CMAKE_C_FLAGS "-fcoverage-mapping ${CMAKE_C_FLAGS}")
SET(CMAKE_C_FLAGS "-fprofile-instr-generate ${CMAKE_C_FLAGS}")
ENDIF()

IF(BUILD_FUZZERS AND NOT USE_STANDALONE_FUZZERS)
# The actual sanitizer link target will be added when linking the fuzz
# targets.
SET(CMAKE_C_FLAGS "-fsanitize=fuzzer-no-link ${CMAKE_C_FLAGS}")
ENDIF ()

ADD_SUBDIRECTORY(src)

# Tests
Expand Down Expand Up @@ -282,6 +303,18 @@ IF (BUILD_EXAMPLES)
ADD_SUBDIRECTORY(examples)
ENDIF ()

IF(BUILD_FUZZERS)
IF(NOT USE_STANDALONE_FUZZERS)
IF(BUILD_EXAMPLES)
MESSAGE(FATAL_ERROR "Cannot build the fuzzer targets and the examples together")
ENDIF()
IF(BUILD_CLAR)
MESSAGE(FATAL_ERROR "Cannot build the fuzzer targets and the tests together")
ENDIF()
ENDIF()
ADD_SUBDIRECTORY(fuzz)
ENDIF()

IF(CMAKE_VERSION VERSION_GREATER 3)
FEATURE_SUMMARY(WHAT ENABLED_FEATURES DESCRIPTION "Enabled features:")
FEATURE_SUMMARY(WHAT DISABLED_FEATURES DESCRIPTION "Disabled features:")
Expand Down
2 changes: 1 addition & 1 deletion ci/build.sh
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ echo "## Configuring build environment"
echo "##############################################################################"

echo cmake ${SOURCE_DIR} -DBUILD_EXAMPLES=ON ${CMAKE_OPTIONS}
cmake ${SOURCE_DIR} -DBUILD_EXAMPLES=ON ${CMAKE_OPTIONS}
cmake ${SOURCE_DIR} -DBUILD_EXAMPLES=ON -DBUILD_FUZZERS=ON -DUSE_STANDALONE_FUZZERS=ON ${CMAKE_OPTIONS}

echo ""
echo "##############################################################################"
Expand Down
12 changes: 12 additions & 0 deletions ci/test.sh
Original file line number Diff line number Diff line change
Expand Up @@ -184,6 +184,18 @@ if [ -z "$SKIP_SSH_TESTS" ]; then
unset GITTEST_REMOTE_SSH_FINGERPRINT
fi

if [ -z "$SKIP_FUZZERS" ]; then
echo ""
echo "##############################################################################"
echo "## Running fuzzers"
echo "##############################################################################"

for fuzzer in $(find ./fuzz/ -type f -executable); do
fuzzer_name=$(basename "${fuzzer}")
"${fuzzer}" "../fuzz/corpora/${fuzzer_name}" || die $?
done
fi

echo "Success."
cleanup
exit 0
13 changes: 13 additions & 0 deletions fuzz/CMakeLists.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
LINK_DIRECTORIES(${LIBGIT2_LIBDIRS})
INCLUDE_DIRECTORIES(${LIBGIT2_INCLUDES})

FILE(GLOB SRC_FUZZ RELATIVE ${CMAKE_CURRENT_SOURCE_DIR} fuzz_*.c)
FOREACH(fuzz_target_src ${SRC_FUZZ})
STRING(REPLACE ".c" "" fuzz_target_name ${fuzz_target_src})
SET(${fuzz_target_name}_SOURCES ${fuzz_target_src} ${LIBGIT2_OBJECTS})
IF(USE_STANDALONE_FUZZERS)
LIST(APPEND ${fuzz_target_name}_SOURCES "standalone_driver.c")
ENDIF()
ADD_EXECUTABLE(${fuzz_target_name} ${${fuzz_target_name}_SOURCES})
TARGET_LINK_LIBRARIES(${fuzz_target_name} ${LIBGIT2_LIBS})
ENDFOREACH()
73 changes: 73 additions & 0 deletions fuzz/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,73 @@
# Fuzzing

libgit2 is currently using [libFuzzer](https://libfuzzer.info) to perform
automated fuzz testing. libFuzzer only works with clang.

## Prerequisites** for building fuzz targets:

1. All the prerequisites for [building libgit2](https://github.com/libgit2/libgit2).
2. A recent version of clang. 6.0 is preferred. [pre-build Debian/Ubuntu
packages](https://github.com/libgit2/libgit2)

## Build

1. Create a build directory beneath the libgit2 source directory, and change
into it: `mkdir build && cd build`
2. Choose one sanitizers to add. The currently supported sanitizers are
[`address`](https://clang.llvm.org/docs/AddressSanitizer.html),
[`undefined`](https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html),
and [`leak`/`address,leak`](https://clang.llvm.org/docs/LeakSanitizer.html).
3. Create the cmake build environment and configure the build with the
sanitizer chosen: `CC=/usr/bin/clang-6.0 cmake
-DBUILD_CLAR=OFF -DBUILD_FUZZERS=ON -DUSE_SANIZER=address
-DCMAKE_EXE_LINKER_FLAGS="-fsanitize=fuzzer"
-DCMAKE_BUILD_TYPE=RelWithDebInfo ..`. Note that building the fuzzer targets
is incompatible with the tests and examples.
4. Build libgit2: `cmake --build .`
5. Exit the cmake build environment: `cd ..`

## Run the fuzz targets

1. `ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolize-6.0
LSAN_OPTIONS=allocator_may_return_null=1
ASAN_OPTIONS=allocator_may_return_null=1 ./build/fuzz/fuzz_packfile_raw
fuzz/corpora/fuzz_packfile_raw/`

The `LSAN_OPTIONS` and `ASAN_OPTIONS` are there to allow `malloc(3)` to return
`NULL`. The `LLVM_PROFILE_FILE` is there to override the path where libFuzzer
will write the coverage report.

## Get coverage

In order to get coverage information, you also need to add the
`-DUSE_COVERAGE=ON` flag to `cmake`, and then run the fuzz target with
`-runs=0`. That will produce a file called `default.profraw` (this behavior can
be overridden by setting the `LLVM_PROFILE_FILE="yourfile.profraw"` environment
variable).

1. `llvm-profdata-6.0 merge -sparse default.profraw -o
fuzz_packfile_raw.profdata` transforms the data from a sparse representation
into a format that can be used by the other tools.
2. `llvm-cov-6.0 report ./build/fuzz/fuzz_packfile_raw
-instr-profile=fuzz_packfile_raw.profdata` shows a high-level per-file
coverage report.
3. `llvm-cov-6.0 show ./build/fuzz/fuzz_packfile_raw
-instr-profile=fuzz_packfile_raw.profdata [source file]` shows a line-by-line
coverage analysis of all the codebase (or a single source file).

## Standalone mode

In order to ensure that there are no regresions, each fuzzer target can be run
in a standalone mode. This can be done by passing `-DUSE_STANDALONE_FUZZERS=ON`
to `cmake` without setting `-DCMAKE_EXE_LINKER_FLAGS`. This makes it compatible
with gcc. This does not use the fuzzing engine, but just invokes every file in
the chosen corpus.

In order to get full coverage, though, you might want to also enable one of the
sanitizers. You might need a recent version of clang to get full support.

## References

* [libFuzzer](https://llvm.org/docs/LibFuzzer.html) documentation.
* [Source-based Code
Coverage](https://clang.llvm.org/docs/SourceBasedCodeCoverage.html).
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
�PACK
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
i
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
R
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
\
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
�
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
9
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
�PACK����
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
x
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
h
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Pw
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
���@
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
1
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
z
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
/
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
%
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
P
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
��
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
?
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
j
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
��
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
m
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
�
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
�o
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
o
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
H
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
c
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
�P��������
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
�PACK��
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
K
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@

Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
w
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@

Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@

Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
n
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
E
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
!
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
F
Binary file not shown.
Binary file not shown.
Loading

0 comments on commit 60e610a

Please sign in to comment.