[llvm-demangle-fuzzer] Also fuzz microsoftDemangle().

[morehouse]

Summary

Use first byte of input to determine whether to call itaniumDemangle()
or microsoftDemangle().

Addresses https://bugs.llvm.org/show_bug.cgi?id=39582.

[morehouse]

• Formatting.

[morehouse]

microsoftDemangle crashes in 1 second with buffer overflows or ASSERT failures when I run locally.

[morehouse]

@kcc Ping

[erik.pilkington]

Hi, thanks for working on this! Fuzzing in the itanium demangler has caught *a lot* of bugs, so this seems pretty useful. Whats the argument for testing the two demanglers in the same path? There isn't really any shared code, so I think it makes more sense to separate these out.

@kcc: is there any oss-fuzz testing for llvm-demangle-fuzzer.cpp? I thought it was just for libcxxabi. Also, will reinterpreting the first char in Data break the existing itanium corpuses?

[thakis]

I believe this runs on oss-fuzz already: https://github.com/google/oss-fuzz/blob/master/projects/llvm/build.sh#L37

Having one or two fuzzer binaries seems like a toss-up (true it's a mostly independent branch, but we don't create a new fuzzer binary for each independent branch), and having just binary saves the work of hooking a new binary up on oss-fuzz.

Re corpus: I'd be very surprised if oss-fuzzer assumed that fuzzers never change. So I don't think (but don't know for sure) that this is a concern.

[erik.pilkington]

In D54780#1331426, @thakis wrote:

I believe this runs on oss-fuzz already: https://github.com/google/oss-fuzz/blob/master/projects/llvm/build.sh#L37

Oh, okay nice. Thanks for checking.

Having one or two fuzzer binaries seems like a toss-up (true it's a mostly independent branch, but we don't create a new fuzzer binary for each independent branch), and having just binary saves the work of hooking a new binary up on oss-fuzz.

I would probably prefer always calling microsoftDemangle() in llvm-demangler-fuzzer. The Itanium demanglers are identical, so we're just wasting cycles fuzzing them both independently.

Re corpus: I'd be very surprised if oss-fuzzer assumed that fuzzers never change. So I don't think (but don't know for sure) that this is a concern.

[thakis]

I would probably prefer always calling microsoftDemangle() in llvm-demangler-fuzzer. The Itanium demanglers are identical, so we're just wasting cycles fuzzing them both independently.

That makes sense to me (with a comment explaining this).

[kcc]

I would prefer to have two separate targets.

[morehouse]

• Separate fuzz targets.

[kcc]

LGTM
Don't forget to add the new fuzz target to oss-fuzz

llvm/tools/llvm-demangle-fuzzer/DummyDemanglerFuzzer.cpp

-//===--- DummyDemanglerMain.cpp - Entry point to sanity check the fuzzer --===//
-//
-//                     The LLVM Compiler Infrastructure
-//
-// This file is distributed under the University of Illinois Open Source
-// License. See LICENSE.TXT for details.
-//
-//===----------------------------------------------------------------------===//
-//
-// Implementation of main so we can build and test without linking libFuzzer.
-//
-//===----------------------------------------------------------------------===//
-
-#include "llvm/FuzzMutate/FuzzerCLI.h"
-
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
-int main(int argc, char *argv[]) {
-  return llvm::runFuzzerOnInputs(argc, argv, LLVMFuzzerTestOneInput);
-}

llvm/tools/llvm-itanium-demangle-fuzzer/CMakeLists.txt

 set(LLVM_LINK_COMPONENTS
   Demangle
   FuzzMutate
   Support
 )
 
-add_llvm_fuzzer(llvm-demangle-fuzzer
-  llvm-demangle-fuzzer.cpp
+add_llvm_fuzzer(llvm-itanium-demangle-fuzzer
+  llvm-itanium-demangle-fuzzer.cpp
   DUMMY_MAIN DummyDemanglerFuzzer.cpp
   )

llvm/tools/llvm-itanium-demangle-fuzzer/DummyDemanglerFuzzer.cpp

 //===--- DummyDemanglerMain.cpp - Entry point to sanity check the fuzzer --===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 // Implementation of main so we can build and test without linking libFuzzer.
 //
 //===----------------------------------------------------------------------===//
 
 #include "llvm/FuzzMutate/FuzzerCLI.h"
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
 int main(int argc, char *argv[]) {
   return llvm::runFuzzerOnInputs(argc, argv, LLVMFuzzerTestOneInput);
 }

llvm/tools/llvm-itanium-demangle-fuzzer/llvm-itanium-demangle-fuzzer.cpp

 //===--- llvm-demangle-fuzzer.cpp - Fuzzer for the Itanium Demangler ------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 
 #include "llvm/Demangle/Demangle.h"
 
 #include <cstdint>
 #include <cstdlib>
 #include <string>
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
   std::string NullTerminatedString((const char *)Data, Size);
   int status = 0;
   if (char *demangle = llvm::itaniumDemangle(NullTerminatedString.c_str(), nullptr,
                                          nullptr, &status))
     free(demangle);
 
   return 0;
 }

llvm/tools/llvm-microsoft-demangle-fuzzer/CMakeLists.txt

 set(LLVM_LINK_COMPONENTS
   Demangle
   FuzzMutate
   Support
 )
 
-add_llvm_fuzzer(llvm-demangle-fuzzer
-  llvm-demangle-fuzzer.cpp
+add_llvm_fuzzer(llvm-microsoft-demangle-fuzzer
+  llvm-microsoft-demangle-fuzzer.cpp
   DUMMY_MAIN DummyDemanglerFuzzer.cpp
   )

llvm/tools/llvm-microsoft-demangle-fuzzer/DummyDemanglerFuzzer.cpp

 //===--- DummyDemanglerMain.cpp - Entry point to sanity check the fuzzer --===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 // Implementation of main so we can build and test without linking libFuzzer.
 //
 //===----------------------------------------------------------------------===//
 
 #include "llvm/FuzzMutate/FuzzerCLI.h"
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
 int main(int argc, char *argv[]) {
   return llvm::runFuzzerOnInputs(argc, argv, LLVMFuzzerTestOneInput);
 }

llvm/tools/llvm-microsoft-demangle-fuzzer/llvm-microsoft-demangle-fuzzer.cpp

 #include "llvm/Demangle/Demangle.h"
 
 #include <cstdint>
 #include <cstdlib>
 #include <string>
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
   std::string NullTerminatedString((const char *)Data, Size);
-  int status = 0;
-  if (char *demangle = llvm::itaniumDemangle(NullTerminatedString.c_str(), nullptr,
-                                         nullptr, &status))
-    free(demangle);
-
+  free(llvm::microsoftDemangle(NullTerminatedString.c_str(), nullptr, nullptr,
+                               nullptr));
   return 0;
 }