Skip to content

G
git2
Commit 60e610a2 by lhchavez Committed by Patrick Steinhardt
Options

fuzzers: add build support and instructions 

This change adds support for building a fuzz target for exercising the
packfile parser, as well as documentation. It also runs the fuzzers in
Travis to avoid regressions.
parent 0cf75467
Showing with 174 additions and 1 deletions
.gitignore
......@@ -31,3 +31,5 @@ msvc/Release/
.*.swp
tags
mkmf.log
*.profdata
*.profraw
CMakeLists.txt
......@@ -43,6 +43,7 @@ OPTION( BUILD_SHARED_LIBS "Build Shared Library (OFF for Static)" ON )
OPTION( THREADSAFE "Build libgit2 as threadsafe" ON )
OPTION( BUILD_CLAR "Build Tests using the Clar suite" ON )
OPTION( BUILD_EXAMPLES "Build library usage example apps" OFF )
OPTION( BUILD_FUZZERS "Build the fuzz targets" OFF)
OPTION( TAGS "Generate tags" OFF )
OPTION( PROFILE "Generate profiling information" OFF )
OPTION( ENABLE_TRACE "Enables tracing support" OFF )
......@@ -52,6 +53,9 @@ SET(SHA1_BACKEND "CollisionDetection" CACHE STRING "Backend to use for SHA1. One
OPTION( USE_SSH "Link with libssh to enable SSH support" ON )
OPTION( USE_HTTPS "Enable HTTPS support. Can be set to a specific backend" ON )
OPTION( USE_GSSAPI "Link with libgssapi for SPNEGO auth" OFF )
OPTION( USE_SANITIZER "Enable one of the Sanitizers (requires clang)" OFF )
OPTION( USE_COVERAGE "Enable clang's coverage report (requires clang)" OFF )
OPTION( USE_STANDALONE_FUZZERS "Enable standalone fuzzers (compatible with gcc)" OFF )
OPTION( VALGRIND "Configure build for valgrind" OFF )
OPTION( CURL "Use curl for HTTP if available" ON)
OPTION( USE_EXT_HTTP_PARSER "Use system HTTP_Parser if available" ON)
......@@ -245,6 +249,23 @@ ELSE()
# that uses CMAKE_CONFIGURATION_TYPES and not CMAKE_BUILD_TYPE
ENDIF()
IF(NOT USE_SANITIZER STREQUAL "OFF")
SET(CMAKE_C_FLAGS "-fsanitize=${USE_SANITIZER} ${CMAKE_C_FLAGS}")
SET(CMAKE_C_FLAGS "-fno-omit-frame-pointer ${CMAKE_C_FLAGS}")
SET(CMAKE_C_FLAGS "-fno-optimize-sibling-calls ${CMAKE_C_FLAGS}")
ENDIF()
IF(USE_COVERAGE)
SET(CMAKE_C_FLAGS "-fcoverage-mapping ${CMAKE_C_FLAGS}")
SET(CMAKE_C_FLAGS "-fprofile-instr-generate ${CMAKE_C_FLAGS}")
ENDIF()
IF(BUILD_FUZZERS AND NOT USE_STANDALONE_FUZZERS)
# The actual sanitizer link target will be added when linking the fuzz
# targets.
SET(CMAKE_C_FLAGS "-fsanitize=fuzzer-no-link ${CMAKE_C_FLAGS}")
ENDIF ()
ADD_SUBDIRECTORY(src)
# Tests
......@@ -282,6 +303,18 @@ IF (BUILD_EXAMPLES)
ADD_SUBDIRECTORY(examples)
ENDIF ()
IF(BUILD_FUZZERS)
IF(NOT USE_STANDALONE_FUZZERS)
IF(BUILD_EXAMPLES)
MESSAGE(FATAL_ERROR "Cannot build the fuzzer targets and the examples together")
ENDIF()
IF(BUILD_CLAR)
MESSAGE(FATAL_ERROR "Cannot build the fuzzer targets and the tests together")
ENDIF()
ENDIF()
ADD_SUBDIRECTORY(fuzz)
ENDIF()
IF(CMAKE_VERSION VERSION_GREATER 3)
FEATURE_SUMMARY(WHAT ENABLED_FEATURES DESCRIPTION "Enabled features:")
FEATURE_SUMMARY(WHAT DISABLED_FEATURES DESCRIPTION "Disabled features:")
......
ci/build.sh
......@@ -29,7 +29,7 @@ echo "## Configuring build environment"
echo "##############################################################################"
echo cmake ${SOURCE_DIR} -DBUILD_EXAMPLES=ON ${CMAKE_OPTIONS}
cmake ${SOURCE_DIR} -DBUILD_EXAMPLES=ON ${CMAKE_OPTIONS}
cmake ${SOURCE_DIR} -DBUILD_EXAMPLES=ON -DBUILD_FUZZERS=ON -DUSE_STANDALONE_FUZZERS=ON ${CMAKE_OPTIONS}
echo ""
echo "##############################################################################"
......
ci/test.sh
......@@ -184,6 +184,18 @@ if [ -z "$SKIP_SSH_TESTS" ]; then
unset GITTEST_REMOTE_SSH_FINGERPRINT
fi
if [ -z "$SKIP_FUZZERS" ]; then
echo ""
echo "##############################################################################"
echo "## Running fuzzers"
echo "##############################################################################"
for fuzzer in $(find ./fuzz/ -type f -executable); do
fuzzer_name=$(basename "${fuzzer}")
"${fuzzer}" "../fuzz/corpora/${fuzzer_name}" || die $?
done
fi
echo "Success."
cleanup
exit 0
fuzz/CMakeLists.txt 0 → 100644
LINK_DIRECTORIES(${LIBGIT2_LIBDIRS})
INCLUDE_DIRECTORIES(${LIBGIT2_INCLUDES})
FILE(GLOB SRC_FUZZ RELATIVE ${CMAKE_CURRENT_SOURCE_DIR} fuzz_*.c)
FOREACH(fuzz_target_src ${SRC_FUZZ})
STRING(REPLACE ".c" "" fuzz_target_name ${fuzz_target_src})
SET(${fuzz_target_name}_SOURCES ${fuzz_target_src} ${LIBGIT2_OBJECTS})
IF(USE_STANDALONE_FUZZERS)
LIST(APPEND ${fuzz_target_name}_SOURCES "standalone_driver.c")
ENDIF()
ADD_EXECUTABLE(${fuzz_target_name} ${${fuzz_target_name}_SOURCES})
TARGET_LINK_LIBRARIES(${fuzz_target_name} ${LIBGIT2_LIBS})
ENDFOREACH()
fuzz/README.md 0 → 100644
# Fuzzing
libgit2 is currently using [libFuzzer](https://libfuzzer.info) to perform
automated fuzz testing. libFuzzer only works with clang.
## Prerequisites** for building fuzz targets:
1. All the prerequisites for [building libgit2](https://github.com/libgit2/libgit2).
2. A recent version of clang. 6.0 is preferred. [pre-build Debian/Ubuntu
packages](https://github.com/libgit2/libgit2)
## Build
1. Create a build directory beneath the libgit2 source directory, and change
into it: `mkdir build && cd build`
2. Choose one sanitizers to add. The currently supported sanitizers are
[`address`](https://clang.llvm.org/docs/AddressSanitizer.html),
[`undefined`](https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html),
and [`leak`/`address,leak`](https://clang.llvm.org/docs/LeakSanitizer.html).
3. Create the cmake build environment and configure the build with the
sanitizer chosen: `CC=/usr/bin/clang-6.0 cmake
-DBUILD_CLAR=OFF -DBUILD_FUZZERS=ON -DUSE_SANIZER=address
-DCMAKE_EXE_LINKER_FLAGS="-fsanitize=fuzzer"
-DCMAKE_BUILD_TYPE=RelWithDebInfo ..`. Note that building the fuzzer targets
is incompatible with the tests and examples.
4. Build libgit2: `cmake --build .`
5. Exit the cmake build environment: `cd ..`
## Run the fuzz targets
1. `ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolize-6.0
LSAN_OPTIONS=allocator_may_return_null=1
ASAN_OPTIONS=allocator_may_return_null=1 ./build/fuzz/fuzz_packfile_raw
fuzz/corpora/fuzz_packfile_raw/`
The `LSAN_OPTIONS` and `ASAN_OPTIONS` are there to allow `malloc(3)` to return
`NULL`. The `LLVM_PROFILE_FILE` is there to override the path where libFuzzer
will write the coverage report.
## Get coverage
In order to get coverage information, you also need to add the
`-DUSE_COVERAGE=ON` flag to `cmake`, and then run the fuzz target with
`-runs=0`. That will produce a file called `default.profraw` (this behavior can
be overridden by setting the `LLVM_PROFILE_FILE="yourfile.profraw"` environment
variable).
1. `llvm-profdata-6.0 merge -sparse default.profraw -o
fuzz_packfile_raw.profdata` transforms the data from a sparse representation
into a format that can be used by the other tools.
2. `llvm-cov-6.0 report ./build/fuzz/fuzz_packfile_raw
-instr-profile=fuzz_packfile_raw.profdata` shows a high-level per-file
coverage report.
3. `llvm-cov-6.0 show ./build/fuzz/fuzz_packfile_raw
-instr-profile=fuzz_packfile_raw.profdata [source file]` shows a line-by-line
coverage analysis of all the codebase (or a single source file).
## Standalone mode
In order to ensure that there are no regresions, each fuzzer target can be run
in a standalone mode. This can be done by passing `-DUSE_STANDALONE_FUZZERS=ON`
to `cmake` without setting `-DCMAKE_EXE_LINKER_FLAGS`. This makes it compatible
with gcc. This does not use the fuzzing engine, but just invokes every file in
the chosen corpus.
In order to get full coverage, though, you might want to also enable one of the
sanitizers. You might need a recent version of clang to get full support.
## References
* [libFuzzer](https://llvm.org/docs/LibFuzzer.html) documentation.
* [Source-based Code
Coverage](https://clang.llvm.org/docs/SourceBasedCodeCoverage.html).
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment