[Bitcode] Add fuzzer for bitcode reading

[nikic]

Summary

Inspired by the discussion on D118694, this adds a straightforward fuzzer for bitcode reading.

[nikic]

After fixing some issues in the bitstream reader to report errors using the right mechanism, this now quickly runs into OOM, because we do unconditional vector reservations. Can be fixed (a standard approach is to reject reservations larger than the input size for example), just not sure if making bitcode parsing more resilient is something I should invest time in.

[dblaikie]

If we check this in, does it start failing buildbots or anything if it's not clean? Do we have to address the OOMs for this to be clean, or are OOMs not considered failures by any buildbots/don't produce failmail?

[nikic]

In D119000#3297487, @dblaikie wrote:

If we check this in, does it start failing buildbots or anything if it's not clean? Do we have to address the OOMs for this to be clean, or are OOMs not considered failures by any buildbots/don't produce failmail?

Nothing should use the fuzzer by default, it needs to be added to oss-fuzz to run. So just adding it is not problematic.

[dblaikie]

In D119000#3297608, @nikic wrote:

In D119000#3297487, @dblaikie wrote:

If we check this in, does it start failing buildbots or anything if it's not clean? Do we have to address the OOMs for this to be clean, or are OOMs not considered failures by any buildbots/don't produce failmail?

Nothing should use the fuzzer by default, it needs to be added to oss-fuzz to run. So just adding it is not problematic.

Hmm, seems unfortunate to checkin dead code, though? But I guess if this is the normal way fuzzers are added/adopted/eventually integrated into oss-fuzz, fair enough.

[nikic]

Landed as https://github.com/llvm/llvm-project/commit/82ef888fbf3a19c80b042c483fe939d93d187f1d, forgot to add the differential revision tag.

llvm/tools/llvm-dis-fuzzer/CMakeLists.txt

+set(LLVM_LINK_COMPONENTS
+  BitReader
+)
+add_llvm_fuzzer(llvm-dis-fuzzer
+  llvm-dis-fuzzer.cpp
+  )

llvm/tools/llvm-dis-fuzzer/llvm-dis-fuzzer.cpp

+//===-- llvm-dis-fuzzer.cpp - Fuzzer for llvm-dis using lib/Fuzzer --------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// Fuzzer for LLVM bitcode reading.
+//
+//===----------------------------------------------------------------------===//
+
+#include "llvm/Bitcode/BitcodeReader.h"
+#include "llvm/Support/MemoryBuffer.h"
+
+using namespace llvm;
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+  LLVMContext Context;
+  auto Buffer = MemoryBuffer::getMemBuffer(
+      StringRef(reinterpret_cast<const char *>(Data), Size), "Fuzzer input",
+      /*RequiresNullTerminator=*/false);
+  consumeError(parseBitcodeFile(Buffer->getMemBufferRef(), Context).takeError());
+  return 0;
+}