tools/oss-fuzz.sh

   1 #!/usr/bin/env bash
   2 # SPDX-License-Identifier: LGPL-2.1-or-later
   3
   4 set -ex
   5
   6 export LC_CTYPE=C.UTF-8
   7
   8 export CC=${CC:-clang}
   9 export CXX=${CXX:-clang++}
  10 clang_version="$($CC --version | sed -nr 's/.*version ([^ ]+?) .*/\1/p' | sed -r 's/-$//')"
  11
  12 SANITIZER=${SANITIZER:-address -fsanitize-address-use-after-scope}
  13 flags="-O1 -fno-omit-frame-pointer -g -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=$SANITIZER"
  14
  15 clang_lib="/usr/lib64/clang/${clang_version}/lib/linux"
  16 [ -d "$clang_lib" ] || clang_lib="/usr/lib/clang/${clang_version}/lib/linux"
  17
  18 export CFLAGS=${CFLAGS:-$flags}
  19 export CXXFLAGS=${CXXFLAGS:-$flags}
  20 export LDFLAGS=${LDFLAGS:--L${clang_lib}}
  21
  22 export WORK=${WORK:-$(pwd)}
  23 export OUT=${OUT:-$(pwd)/out}
  24 mkdir -p "$OUT"
  25
  26 build="$WORK/build"
  27 rm -rf "$build"
  28 mkdir -p "$build"
  29
  30 meson_args=("-Db_lundef=false")
  31
  32 if [ -z "$FUZZING_ENGINE" ]; then
  33     meson_args+=("-Dllvm-fuzz=true")
  34 else
  35     meson_args+=("-Doss-fuzz=true" "--auto-features=disabled")
  36
  37     apt-get update
  38     apt-get install -y gperf m4 gettext python3-pip \
  39         libcap-dev libmount-dev \
  40         pkg-config wget python3-jinja2 zipmerge zstd
  41
  42     if [[ "$ARCHITECTURE" == i386 ]]; then
  43         apt-get install -y pkg-config:i386 libcap-dev:i386 libmount-dev:i386
  44     fi
  45
  46     pip3 install -r .github/workflows/requirements.txt --require-hashes
  47
  48     # https://github.com/google/oss-fuzz/issues/6868
  49     ORIG_PYTHONPATH=$(python3 -c 'import sys;print(":".join(sys.path[1:]))')
  50     export PYTHONPATH="$ORIG_PYTHONPATH:/usr/lib/python3/dist-packages/"
  51
  52     if [[ "$SANITIZER" == undefined ]]; then
  53         additional_ubsan_checks=pointer-overflow,alignment
  54         UBSAN_FLAGS="-fsanitize=$additional_ubsan_checks -fno-sanitize-recover=$additional_ubsan_checks"
  55         CFLAGS="$CFLAGS $UBSAN_FLAGS"
  56         CXXFLAGS="$CXXFLAGS $UBSAN_FLAGS"
  57     fi
  58
  59     if [[ "$SANITIZER" == introspector ]]; then
  60         # fuzz-introspector passes -fuse-ld=gold and -flto using CFLAGS/LDFLAGS and due to
  61         # https://github.com/mesonbuild/meson/issues/6377#issuecomment-575977919 and
  62         # https://github.com/mesonbuild/meson/issues/6377 it doesn't mix well with meson.
  63         # It's possible to build systemd with duct tape there using something like
  64         # https://github.com/google/oss-fuzz/pull/7583#issuecomment-1104011067 but
  65         # apparently even with gold and lto some parts of systemd are missing from
  66         # reports (presumably due to https://github.com/google/oss-fuzz/issues/7598).
  67         # Let's just fail here for now to make it clear that fuzz-introspector isn't supported.
  68         exit 1
  69     fi
  70 fi
  71
  72 if ! meson setup "$build" "${meson_args[@]}"; then
  73     cat "$build/meson-logs/meson-log.txt"
  74     exit 1
  75 fi
  76
  77 ninja -v -C "$build" fuzzers
  78
  79 # Compressed BCD files are kept in test/test-bcd so let's unpack them
  80 # and put them all in the seed corpus.
  81 bcd=$(mktemp -d)
  82 for i in test/test-bcd/*.zst; do
  83      unzstd "$i" -o "$bcd/$(basename "${i%.zst}")";
  84 done
  85 zip -jqr "$OUT/fuzz-bcd_seed_corpus.zip" "$bcd"
  86 rm -rf "$bcd"
  87
  88 hosts=$(mktemp)
  89 wget -O "$hosts" https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
  90 zip -jq "$OUT/fuzz-etc-hosts_seed_corpus.zip" "$hosts"
  91 rm -rf "$hosts"
  92
  93 # The seed corpus is a separate flat archive for each fuzzer,
  94 # with a fixed name ${fuzzer}_seed_corpus.zip.
  95 for d in test/fuzz/fuzz-*; do
  96     fuzzer="$(basename "$d")"
  97     # Include the build-generated corpora if any as well
  98     readarray -t generated < <(find "$build/test/fuzz" -maxdepth 1 -name "${fuzzer}*" -type f)
  99     zip -jqr "$OUT/${fuzzer}_seed_corpus.zip" "$d" "${generated[@]}"
 100 done
 101
 102 # get fuzz-dns-packet corpus
 103 df="$build/dns-fuzzing"
 104 git clone --depth 1 https://github.com/CZ-NIC/dns-fuzzing "$df"
 105 zip -jqr "$OUT/fuzz-dns-packet_seed_corpus.zip" "$df/packet"
 106
 107 install -Dt "$OUT/src/shared/" \
 108         "$build"/src/shared/libsystemd-shared-*.so \
 109         "$build"/src/core/libsystemd-core-*.so
 110
 111 # Most i386 libraries have to be brought to the runtime environment somehow. Ideally they
 112 # should be linked statically but since it isn't possible another way to keep them close
 113 # to the fuzz targets is used here. The dependencies are copied to "$OUT/src/shared" and
 114 # then 'rpath' is tweaked to make it possible for the linker to find them there. "$OUT/src/shared"
 115 # is chosen because the runtime search path of all the fuzz targets already points to it
 116 # to load "libsystemd-shared" and "libsystemd-core". Stuff like that should be avoided on
 117 # x86_64 because it tends to break coverage reports, fuzz-introspector, CIFuzz and so on.
 118 if [[ "$ARCHITECTURE" == i386 ]]; then
 119     for lib_path in $(ldd "$OUT"/src/shared/libsystemd-shared-*.so | awk '/=> \/lib/ { print $3 }'); do
 120         lib_name=$(basename "$lib_path")
 121         cp "$lib_path" "$OUT/src/shared"
 122         patchelf --set-rpath \$ORIGIN "$OUT/src/shared/$lib_name"
 123     done
 124     patchelf --set-rpath \$ORIGIN "$OUT"/src/shared/libsystemd-shared-*.so
 125 fi
 126
 127 wget -O "$OUT/fuzz-json.dict" https://raw.githubusercontent.com/rc0r/afl-fuzz/master/dictionaries/json.dict
 128
 129 find "$build" -maxdepth 1 -type f -executable -name "fuzz-*" -exec mv {} "$OUT" \;
 130 find src -type f -name "fuzz-*.dict" -exec cp {} "$OUT" \;
 131 cp src/fuzz/*.options "$OUT"
 132
 133 if [[ "$MERGE_WITH_OSS_FUZZ_CORPORA" == "yes" ]]; then
 134     for f in "$OUT/"fuzz-*; do
 135         [[ -x "$f" ]] || continue
 136         fuzzer=$(basename "$f")
 137         t=$(mktemp)
 138         if wget -O "$t" "https://storage.googleapis.com/systemd-backup.clusterfuzz-external.appspot.com/corpus/libFuzzer/systemd_${fuzzer}/public.zip"; then
 139             zipmerge "$OUT/${fuzzer}_seed_corpus.zip" "$t"
 140         fi
 141         rm -rf "$t"
 142     done
 143 fi