Add a fuzz target for llvm's ItaniumDemangler.

[hctim]

• Null-terminated the string (oops).

[hctim]

• Fixed line length

[kcc]

Code LG, wait for Matt with cmake.

tools/llvm-demangle-fuzzer/llvm-demangle-fuzzer.cpp

20

style nit: llvm prefers this style:
if (char *demangle = foo())

free(demangle);

[morehouse]

To add this to OSS-Fuzz, you will need to link with LIB_FUZZING_ENGINE.

[bogner]

This is pretty straightforward, but if you'd like to add a test for it you can do so by implementing a main function that doesn't link to libfuzzer. It would probably just be something like this:

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
int main(int argc, char *argv[]) {
  return llvm::runFuzzerOnInputs(argc, argv, LLVMFuzzerTestOneInput);
}

Then you'd add the file you added as a DUMMY_MAIN argument to add_llvm_fuzzer. See llvm-isel-fuzzer for details.

[bogner]

Also, please add a description of this fuzzer to docs/FuzzingLLVM.rst

[hctim]

• kcc's comments

[morehouse]

In D38855#896105, @morehouse wrote:

To add this to OSS-Fuzz, you will need to link with LIB_FUZZING_ENGINE.

Actually, I'm working on a change to AddLLVM.cmake that should do this automatically. So don't worry about it.

[hctim]

• Fuzzer updates with dummy main.
• Added main() for dummy target.
• Remove LIB_FUZZING_ENGINE target (morehouse@)
• Added to fuzzer doc.

[hctim]

Note, I've already found some bugs running this locally, but would love to get it up and running in oss-fuzz.

SUMMARY: AddressSanitizer: stack-overflow /usr/local/google/home/mitchp/llvm-src/git/lib/Demangle/ItaniumDemangle.cpp:1654 in _ZL10parse_typeIN12_GLOBAL__N_12DbEEPKcS3_S3_RT_
==151934==ABORTING
MS: 0 ; base unit: 0000000000000000000000000000000000000000
artifact_prefix='./'; Test unit written to ./crash-c935b5dded9a3c7373cdf899be10c03897c7c2c7

Test:

crash-c935b5dded9a3c7373cdf899be10c03897c7c2c72 KBDownload

[bogner]

LGTM

tools/llvm-demangle-fuzzer/CMakeLists.txt

+set(LLVM_LINK_COMPONENTS
+  Demangle
+)
+add_llvm_fuzzer(llvm-demangle-fuzzer
+  EXCLUDE_FROM_ALL
+  llvm-demangle-fuzzer.cpp)

tools/llvm-demangle-fuzzer/llvm-demangle-fuzzer.cpp

+//===--- llvm-demangle-fuzzer.cpp - Fuzzer for the Itanium Demangler ------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+
+#include "llvm/Demangle/Demangle.h"
+
+#include <cstdint>
+#include <cstdlib>
+#include <string>
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+  std::string NullTerminatedString((const char *) Data, Size);
+  int status = 0;
+  char *demangle =
+      llvm::itaniumDemangle(NullTerminatedString.c_str(), nullptr, nullptr, &status);
+
+  if (demangle)
+    free(demangle);
+
+  return 0;
+}