apply libFuzzer for expr

plusun · Jun 14, 2018 · 237d95e · 237d95e
1 parent ce38c39
commit 237d95e
Show file tree

Hide file tree

Showing 4 changed files with 63 additions and 1 deletion.
diff --git a/bin/expr/expr.y b/bin/expr/expr.y
@@ -46,10 +46,18 @@ __RCSID("$NetBSD: expr.y,v 1.39 2016/09/05 01:00:07 sevan Exp $");
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#if ENABLE_FUZZER
+#include <stdint.h>
+#include <stddef.h>
+#endif
 
 static const char * const *av;
 
-static void yyerror(const char *, ...) __dead;
+#if !ENABLE_FUZZER
+static void yyerror(const char *, ...); __dead;
+#else
+#define yyerror(...) return 2;
+#endif
 static int yylex(void);
 static int is_zero_or_null(const char *);
 static int is_integer(const char *);
@@ -428,6 +436,7 @@ yylex(void)
 /*
  * Print error message and exit with error 2 (syntax error).
  */
+#if !ENABLE_FUZZER
 static __printflike(1, 2) void
 yyerror(const char *fmt, ...)
 {
@@ -437,6 +446,45 @@ yyerror(const char *fmt, ...)
 	verrx(2, fmt, arg);
 	va_end(arg);
 }
+#endif
+
+#if ENABLE_FUZZER
+int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
+int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+  char *str = (char *)malloc(Size + 1);
+  char *pre = (char *)malloc(Size + 1);
+  memcpy(str, Data, Size);
+  str[Size] = '\0';
+  memcpy(pre, Data, Size);
+  pre[Size] = '\0';
+
+  // scan Data to get count of words
+  const char *delim = " \t\n";
+  char *word = strtok(pre, delim);
+  size_t count = 0;
+  while (word) {
+    count++;
+    word = strtok(NULL, delim);
+  }
+  free(pre);
+
+  // generate argv
+  const char **argv = malloc(sizeof(const char *) * count + 1);
+  word = strtok(str, delim);
+  count = 0;
+  while (word) {
+    argv[count++] = word;
+    word = strtok(NULL, delim);
+  }
+  free(str);
+  argv[count] = NULL;
+
+  av = argv;
+  yyparse();
+  free(argv);
+  return 0;
+}
+#else
 
 int
 main(int argc, const char * const *argv)
@@ -455,3 +503,4 @@ main(int argc, const char * const *argv)
 	exit(yyparse());
 	/* NOTREACHED */
 }
+#endif
diff --git a/share/mk/bsd.fuzzer.mk b/share/mk/bsd.fuzzer.mk
@@ -0,0 +1,11 @@
+#	$NetBSD$
+
+.if !defined(_BSD_FUZZER_MK)
+_BSD_FUZZER_MK=1
+
+CFLAGS+=	-DENABLE_FUZZER -fsanitize=fuzzer-no-link -g -O0
+CXXFLAGS+=	-DENABLE_FUZZER -fsanitize=fuzzer-no-link -g -O0
+LDFLAGS+=	-DENABLE_FUZZER -fsanitize=fuzzer -g -O0
+
+.endif
+
diff --git a/share/mk/bsd.lib.mk b/share/mk/bsd.lib.mk
@@ -873,5 +873,6 @@ LINKSMODE?= ${LIBMODE}
 .include <bsd.dep.mk>
 .include <bsd.clang-analyze.mk>
 .include <bsd.clean.mk>
+.include <bsd.fuzzer.mk>
 
 ${TARGETS}:	# ensure existence
diff --git a/share/mk/bsd.prog.mk b/share/mk/bsd.prog.mk
@@ -696,6 +696,7 @@ LINKSMODE?= ${BINMODE}
 .include <bsd.dep.mk>
 .include <bsd.clang-analyze.mk>
 .include <bsd.clean.mk>
+.include <bsd.fuzzer.mk>
 
 ${TARGETS}:	# ensure existence