add cxa_demangle_fuzzer

[kcc]

Summary

All easy-to-find bugs in cxa_demangle where fixed now
(https://bugs.chromium.org/p/chromium/issues/detail?id=606626)
except for one (https://llvm.org/bugs/show_bug.cgi?id=31031).
Now I'd like to properly integrate this fuzzer with the source tree
and then run the fuzzer continuously on https://github.com/google/oss-fuzz

[mehdi_amini]

fuzz/CMakeLists.txt

4

This is a dependency on libLLVMSupport right? Why is this needed?

[kcc]

remove unneeded set(LLVM_LINK_COMPONENTS support)

[kcc]

yes, removed.

[mehdi_amini]

LGTM.

(I can't test because LLVM_USE_SANITIZE_COVERAGE seems broken on Darwin)

CMakeLists.txt

if (LIBCXXABI_STANDALONE_BUILD AND NOT LIBCXXABI_ENABLE_SHARED)
   message(WARNING "The libc++abi tests aren't valid when libc++abi is built "
                   "standalone (i.e. outside of llvm/projects/libcxxabi ) and "
                   "is built without a shared library.  Either build a shared "
                   "library, build libc++abi at the same time as you build "
                   "libc++, or do without testing.  No check target will be "
                   "available!")
 else()
   add_subdirectory(test)
+  add_subdirectory(fuzz)
 endif()

fuzz/CMakeLists.txt

+# See http://llvm.org/docs/LibFuzzer.html
+if( LLVM_USE_SANITIZE_COVERAGE )
+  add_executable(cxa_demangle_fuzzer
+    cxa_demangle_fuzzer.cpp
+    ../src/cxa_demangle.cpp
+    )
+
+  target_link_libraries(cxa_demangle_fuzzer
+    LLVMFuzzer
+    )
+endif()

fuzz/cxa_demangle_fuzzer.cpp

+#include <stdint.h>
+#include <stddef.h>
+#include <string.h>
+#include <stdlib.h>
+extern "C" char *
+__cxa_demangle(const char *mangled_name, char *buf, size_t *n, int *status);
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  char *str = new char[size+1];
+  memcpy(str, data, size);
+  str[size] = 0;
+  free(__cxa_demangle(str, 0, 0, 0));
+  delete [] str;
+  return 0;
+}