forked from mirrors/gecko-dev
8e72e4cc2f
This patch adjusts tools/fuzzing/ in such a way that the relevant parts can be reused in the JS engine. Changes in detail include: * Various JS_STANDALONE checks to exclude parts that cannot be included in those builds. * Turn LibFuzzerRegistry and LibFuzzerRunner into generic FuzzerRegistry and FuzzerRunner classes and use them for AFL as well. Previously, AFL was piggy-backing on gtests which was kind of an ugly solution anyway (besides that it can't work in JS). Now more code like registry and harness is shared between the two and they follow almost the same call paths and entry points. AFL macros in FuzzingInterface have been rewritten accordingly. This also required name changes in various places. Furthermore, this unifies the way, the fuzzing target is selected, using the FUZZER environment variable rather than LIBFUZZER (using LIBFUZZER in browser builds will give you a deprecation warning because I know some people are using this already and need time to switch). Previously, AFL target had to be selected using GTEST_FILTER, so this is also much better now. * I had to split up FuzzingInterface* such that the STREAM parts are in a separate set of files FuzzingInterfaceStream* because they use nsStringStream which is not allowed to be included into the JS engine even in a full browser build (error: "Using XPCOM strings is limited to code linked into libxul."). I also had to pull FuzzingInterface.cpp (the RAW part only) into the header and make it static because otherwise, would have to make not only separate files but also separate libraries to statically link to the JS engine, which seemed overkill for a single small function. The streaming equivalent of the function is still in a cpp file. * LibFuzzerRegister functions are now unique by appending the module name to avoid redefinition errors. MozReview-Commit-ID: 44zWCdglnHr --HG-- extra : rebase_source : fe07c557032fd33257eb701190becfaf85ab79d0
85 lines
3.7 KiB
C++
85 lines
3.7 KiB
C++
/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
|
|
/* This Source Code Form is subject to the terms of the Mozilla Public
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
|
|
/*
|
|
* Interface definitions for the unified fuzzing interface with streaming support
|
|
*/
|
|
|
|
#ifndef FuzzingInterfaceStream_h__
|
|
#define FuzzingInterfaceStream_h__
|
|
|
|
#ifdef JS_STANDALONE
|
|
#error "FuzzingInterfaceStream.h cannot be used in JS standalone builds."
|
|
#endif
|
|
|
|
#include "gtest/gtest.h"
|
|
#include "nsComponentManagerUtils.h"
|
|
#include "nsCOMPtr.h"
|
|
#include "nsIInputStream.h"
|
|
|
|
#include "nsDirectoryServiceDefs.h"
|
|
#include "nsIDirectoryService.h"
|
|
#include "nsIFile.h"
|
|
#include "nsStreamUtils.h"
|
|
#include "nsStringStream.h"
|
|
|
|
#include <fstream>
|
|
|
|
#include "FuzzingInterface.h"
|
|
|
|
namespace mozilla {
|
|
|
|
typedef int(*FuzzingTestFuncStream)(nsCOMPtr<nsIInputStream>);
|
|
|
|
#ifdef __AFL_COMPILER
|
|
void afl_interface_stream(const char* testFile, FuzzingTestFuncStream testFunc);
|
|
|
|
#define MOZ_AFL_INTERFACE_COMMON(initFunc) \
|
|
if (initFunc) initFunc(NULL, NULL); \
|
|
char* testFilePtr = getenv("MOZ_FUZZ_TESTFILE"); \
|
|
if (!testFilePtr) { \
|
|
fprintf(stderr, "Must specify testfile in MOZ_FUZZ_TESTFILE environment variable.\n"); \
|
|
return; \
|
|
} \
|
|
/* Make a copy of testFilePtr so the testing function can safely call getenv */ \
|
|
std::string testFile(testFilePtr);
|
|
|
|
#define MOZ_AFL_INTERFACE_STREAM(initFunc, testFunc, moduleName) \
|
|
TEST(AFL, moduleName) { \
|
|
MOZ_AFL_INTERFACE_COMMON(initFunc); \
|
|
::mozilla::afl_interface_stream(testFile.c_str(), testFunc); \
|
|
}
|
|
#else
|
|
#define MOZ_AFL_INTERFACE_STREAM(initFunc, testFunc, moduleName) /* Nothing */
|
|
#endif
|
|
|
|
#ifdef LIBFUZZER
|
|
#define MOZ_LIBFUZZER_INTERFACE_STREAM(initFunc, testFunc, moduleName) \
|
|
static int LibFuzzerTest##moduleName (const uint8_t *data, size_t size) { \
|
|
if (size > INT32_MAX) \
|
|
return 0; \
|
|
nsCOMPtr<nsIInputStream> stream; \
|
|
nsresult rv = NS_NewByteInputStream(getter_AddRefs(stream), \
|
|
(const char*)data, size, NS_ASSIGNMENT_DEPEND); \
|
|
MOZ_RELEASE_ASSERT(NS_SUCCEEDED(rv)); \
|
|
testFunc(stream.forget()); \
|
|
return 0; \
|
|
} \
|
|
static void __attribute__ ((constructor)) LibFuzzerRegister() { \
|
|
::mozilla::FuzzerRegistry::getInstance().registerModule( \
|
|
#moduleName, initFunc, LibFuzzerTest##moduleName \
|
|
); \
|
|
}
|
|
#else
|
|
#define MOZ_LIBFUZZER_INTERFACE_STREAM(initFunc, testFunc, moduleName) /* Nothing */
|
|
#endif
|
|
|
|
#define MOZ_FUZZING_INTERFACE_STREAM(initFunc, testFunc, moduleName) \
|
|
MOZ_LIBFUZZER_INTERFACE_STREAM(initFunc, testFunc, moduleName); \
|
|
MOZ_AFL_INTERFACE_STREAM(initFunc, testFunc, moduleName);
|
|
|
|
} // namespace mozilla
|
|
|
|
#endif // FuzzingInterfaceStream_h__
|