Add a fuzz target for llvm's ItaniumDemangler.
ClosedPublic

Authored by hctim on Oct 12 2017, 10:47 AM.

Diff Detail

Repository
rL LLVM
hctim created this revision.Oct 12 2017, 10:47 AM
hctim updated this revision to Diff 118810.Oct 12 2017, 10:52 AM
  • Null-terminated the string (oops).
hctim updated this revision to Diff 118811.Oct 12 2017, 10:53 AM
  • Fixed line length
kcc added a comment.Oct 12 2017, 11:01 AM

Code LG, wait for Matt with cmake.

tools/llvm-demangle-fuzzer/llvm-demangle-fuzzer.cpp
19 ↗(On Diff #118811)

style nit: llvm prefers this style:
if (char *demangle = foo())

free(demangle);

To add this to OSS-Fuzz, you will need to link with LIB_FUZZING_ENGINE.

bogner added a subscriber: bogner.Oct 12 2017, 11:18 AM

This is pretty straightforward, but if you'd like to add a test for it you can do so by implementing a main function that doesn't link to libfuzzer. It would probably just be something like this:

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
int main(int argc, char *argv[]) {
  return llvm::runFuzzerOnInputs(argc, argv, LLVMFuzzerTestOneInput);
}

Then you'd add the file you added as a DUMMY_MAIN argument to add_llvm_fuzzer. See llvm-isel-fuzzer for details.

Also, please add a description of this fuzzer to docs/FuzzingLLVM.rst

hctim updated this revision to Diff 118814.Oct 12 2017, 11:23 AM
  • kcc's comments
hctim marked an inline comment as done.Oct 12 2017, 11:28 AM
morehouse added a comment.EditedOct 12 2017, 11:49 AM

To add this to OSS-Fuzz, you will need to link with LIB_FUZZING_ENGINE.

Actually, I'm working on a change to AddLLVM.cmake that should do this automatically. So don't worry about it.

hctim updated this revision to Diff 118832.Oct 12 2017, 1:10 PM
  • Fuzzer updates with dummy main.
  • Added main() for dummy target.
  • Remove LIB_FUZZING_ENGINE target (morehouse@)
  • Added to fuzzer doc.
hctim added a comment.Oct 12 2017, 1:11 PM

Note, I've already found some bugs running this locally, but would love to get it up and running in oss-fuzz.

SUMMARY: AddressSanitizer: stack-overflow /usr/local/google/home/mitchp/llvm-src/git/lib/Demangle/ItaniumDemangle.cpp:1654 in _ZL10parse_typeIN12_GLOBAL__N_12DbEEPKcS3_S3_RT_
==151934==ABORTING
MS: 0 ; base unit: 0000000000000000000000000000000000000000
artifact_prefix='./'; Test unit written to ./crash-c935b5dded9a3c7373cdf899be10c03897c7c2c7

Test:

bogner accepted this revision.Oct 12 2017, 5:00 PM

LGTM

This revision is now accepted and ready to land.Oct 12 2017, 5:00 PM
This revision was automatically updated to reflect the committed changes.