add cxa_demangle_fuzzer
authorKostya Serebryany <kcc@google.com>
Wed, 28 Dec 2016 03:28:29 +0000 (03:28 +0000)
committerKostya Serebryany <kcc@google.com>
Wed, 28 Dec 2016 03:28:29 +0000 (03:28 +0000)
Summary:
All easy-to-find bugs in cxa_demangle where fixed now
(https://bugs.chromium.org/p/chromium/issues/detail?id=606626)
except for one (https://llvm.org/bugs/show_bug.cgi?id=31031).
Now I'd like to properly integrate this fuzzer with the source tree
and then run the fuzzer continuously on https://github.com/google/oss-fuzz

Reviewers: compnerd, mclow.lists, mehdi_amini

Subscribers: cfe-commits, mgorny

Differential Revision: https://reviews.llvm.org/D28133

llvm-svn: 290650

libcxxabi/CMakeLists.txt
libcxxabi/fuzz/CMakeLists.txt [new file with mode: 0644]
libcxxabi/fuzz/cxa_demangle_fuzzer.cpp [new file with mode: 0644]

index 5eb0109..dbb3602 100644 (file)
@@ -432,4 +432,5 @@ if (LIBCXXABI_STANDALONE_BUILD AND NOT LIBCXXABI_ENABLE_SHARED)
                   "available!")
 else()
   add_subdirectory(test)
+  add_subdirectory(fuzz)
 endif()
diff --git a/libcxxabi/fuzz/CMakeLists.txt b/libcxxabi/fuzz/CMakeLists.txt
new file mode 100644 (file)
index 0000000..017427e
--- /dev/null
@@ -0,0 +1,11 @@
+# See http://llvm.org/docs/LibFuzzer.html
+if( LLVM_USE_SANITIZE_COVERAGE )
+  add_executable(cxa_demangle_fuzzer
+    cxa_demangle_fuzzer.cpp
+    ../src/cxa_demangle.cpp
+    )
+
+  target_link_libraries(cxa_demangle_fuzzer
+    LLVMFuzzer
+    )
+endif()
diff --git a/libcxxabi/fuzz/cxa_demangle_fuzzer.cpp b/libcxxabi/fuzz/cxa_demangle_fuzzer.cpp
new file mode 100644 (file)
index 0000000..cc9b193
--- /dev/null
@@ -0,0 +1,15 @@
+#include <stdint.h>
+#include <stddef.h>
+#include <string.h>
+#include <stdlib.h>
+extern "C" char *
+__cxa_demangle(const char *mangled_name, char *buf, size_t *n, int *status);
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  char *str = new char[size+1];
+  memcpy(str, data, size);
+  str[size] = 0;
+  free(__cxa_demangle(str, 0, 0, 0));
+  delete [] str;
+  return 0;
+}