| indygreg |
| hg-reviewers |
It's been failing on my workstation for a while, since I have a new enough
LLVM that I had the fuzzer goo, but not so new that I actually had
FuzzedDataProvider. This is a better solution all around in my opinion.
I _believe_ this should let us run these tests on most systems, even
those using GCC instead of clang. That said, my one attempt to test
this on my macOS laptop failed miserably, and I don't feel like doing
more work on this right now.
| Lint Skipped |
| Unit Tests Skipped |
| Path | Packages | |||
|---|---|---|---|---|
| M | contrib/fuzz/Makefile (2 lines) | |||
| M | tests/test-fuzz-targets.t (30 lines) |
| Commit | Parents | Author | Summary | Date |
|---|---|---|---|---|
| 955eba63d15d | 3aa865419520 | Augie Fackler | Dec 6 2019, 3:08 PM |
| CC = clang | CC = clang | ||||
| CXX = clang++ | CXX = clang++ | ||||
| # By default, use our own standalone_fuzz_target_runner. | # By default, use our own standalone_fuzz_target_runner. | ||||
| # This runner does no fuzzing, but simply executes the inputs | # This runner does no fuzzing, but simply executes the inputs | ||||
| # provided via parameters. | # provided via parameters. | ||||
| # Run e.g. "make all LIB_FUZZING_ENGINE=/path/to/libFuzzer.a" | # Run e.g. "make all LIB_FUZZING_ENGINE=/path/to/libFuzzer.a" | ||||
| # to link the fuzzer(s) against a real fuzzing engine. | # to link the fuzzer(s) against a real fuzzing engine. | ||||
| # | # | ||||
| # OSS-Fuzz will define its own value for LIB_FUZZING_ENGINE. | # OSS-Fuzz will define its own value for LIB_FUZZING_ENGINE. | ||||
| LIB_FUZZING_ENGINE ?= standalone_fuzz_target_runner.o | LIB_FUZZING_ENGINE ?= standalone_fuzz_target_runner.o | ||||
| PYTHON_CONFIG ?= $$OUT/sanpy/bin/python-config | PYTHON_CONFIG ?= $$OUT/sanpy/bin/python-config | ||||
| CXXFLAGS += -Wno-deprecated-register | CXXFLAGS += -Wno-deprecated-register | ||||
| all: bdiff mpatch xdiff | all: standalone_fuzz_target_runner.o oss-fuzz | ||||
| standalone_fuzz_target_runner.o: standalone_fuzz_target_runner.cc | standalone_fuzz_target_runner.o: standalone_fuzz_target_runner.cc | ||||
| pyutil.o: pyutil.cc pyutil.h | pyutil.o: pyutil.cc pyutil.h | ||||
| $(CXX) $(CXXFLAGS) -g -O1 \ | $(CXX) $(CXXFLAGS) -g -O1 \ | ||||
| `$(PYTHON_CONFIG) --cflags` \ | `$(PYTHON_CONFIG) --cflags` \ | ||||
| -I../../mercurial -c -o pyutil.o pyutil.cc | -I../../mercurial -c -o pyutil.o pyutil.cc | ||||
| #require test-repo | #require test-repo | ||||
| $ cd $TESTDIR/../contrib/fuzz | $ cd $TESTDIR/../contrib/fuzz | ||||
| $ OUT=$TESTTMP ; export OUT | |||||
| which(1) could exit nonzero, but that's fine because we'll still end | which(1) could exit nonzero, but that's fine because we'll still end | ||||
| up without a valid executable, so we don't need to check $? here. | up without a valid executable, so we don't need to check $? here. | ||||
| $ if which gmake >/dev/null 2>&1; then | $ if which gmake >/dev/null 2>&1; then | ||||
| > MAKE=gmake | > MAKE=gmake | ||||
| > else | > else | ||||
| > MAKE=make | > MAKE=make | ||||
| > } | > } | ||||
| > EOF | > EOF | ||||
| > $CXX $TESTTMP/dummy.cc -o $TESTTMP/dummy \ | > $CXX $TESTTMP/dummy.cc -o $TESTTMP/dummy \ | ||||
| > -fsanitize=fuzzer-no-link,address || return 1 | > -fsanitize=fuzzer-no-link,address || return 1 | ||||
| > } | > } | ||||
| #if clang-libfuzzer | #if clang-libfuzzer | ||||
| $ CXX=clang++ havefuzz || exit 80 | $ CXX=clang++ havefuzz || exit 80 | ||||
| $ $MAKE -s clean all | $ $MAKE -s clean all PYTHON_CONFIG=`which python-config` | ||||
| #endif | #endif | ||||
| #if no-clang-libfuzzer clang-6.0 | #if no-clang-libfuzzer clang-6.0 | ||||
| $ CXX=clang++-6.0 havefuzz || exit 80 | $ CXX=clang++-6.0 havefuzz || exit 80 | ||||
| $ $MAKE -s clean all CC=clang-6.0 CXX=clang++-6.0 | $ $MAKE -s clean all CC=clang-6.0 CXX=clang++-6.0 PYTHON_CONFIG=`which python-config` | ||||
| #endif | #endif | ||||
| #if no-clang-libfuzzer no-clang-6.0 | #if no-clang-libfuzzer no-clang-6.0 | ||||
| $ exit 80 | $ exit 80 | ||||
| #endif | #endif | ||||
| Just run the fuzzers for five seconds each to verify it works at all. | $ cd $TESTTMP | ||||
| $ ./bdiff -max_total_time 5 | |||||
| $ ./mpatch -max_total_time 5 | Run each fuzzer using dummy.cc as a fake input, to make sure it runs | ||||
| $ ./xdiff -max_total_time 5 | at all. In the future we should instead unpack the corpus for each | ||||
| fuzzer and use that instead. | |||||
| $ for fuzzer in `ls *_fuzzer | sort` ; do | |||||
| > echo run $fuzzer... | |||||
| > ./$fuzzer dummy.cc > /dev/null 2>&1 | |||||
| > done | |||||
| run bdiff_fuzzer... | |||||
| run dirs_fuzzer... | |||||
| run dirstate_fuzzer... | |||||
| run fm1readmarkers_fuzzer... | |||||
| run fncache_fuzzer... | |||||
| run jsonescapeu8fast_fuzzer... | |||||
| run manifest_fuzzer... | |||||
| run mpatch_fuzzer... | |||||
| run revlog_fuzzer... | |||||
| run xdiff_fuzzer... | |||||
| Clean up. | Clean up. | ||||
| $ cd $TESTDIR/../contrib/fuzz | |||||
| $ $MAKE -s clean | $ $MAKE -s clean | ||||