build: introduce a fuzzing mode

This adds a new configuration, --enable-fuzzing (which is more than
welcome to be coupled with --enable-address-sanitizer), to pass the
fuzzer sanitizer argument when compiling objects. This allows libfuzzer
to actually be able "to fuzz" by detecting coverage and be smart when
mutating inputs.

As libfuzzer brings its own ~~fees~~ main(), we compile objects with
fsanitize=fuzzer-no-link, and special-case the linkage of the fuzz
targets.

A "lib" is added to abstract out the interface to the fuzzing tool used.
This allow us to use the same targets to fuzz using AFL, hongfuzz or w/e
by adding their entrypoints into libfuzz. (h/t to practicalswift who
introduced this for bitcoin-core, which i mimiced)

Signed-off-by: Antoine Poinsot <darosior@protonmail.com>
This commit is contained in:
Antoine Poinsot
2020-09-07 17:32:19 +02:00
committed by Christian Decker
parent ede5f5be3c
commit 62b54d0125
6 changed files with 127 additions and 6 deletions

16
tests/fuzz/libfuzz.c Normal file
View File

@@ -0,0 +1,16 @@
#include <tests/fuzz/libfuzz.h>
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
int LLVMFuzzerInitialize(int *argc, char ***argv);
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
run(data, size);
return 0;
}
int LLVMFuzzerInitialize(int *argc, char ***argv) {
init(argc, argv);
return 0;
}