Add in-tree fuzz target proof-of-concept (#158)

solidpixel · web-flow · commit d38f6a509d6c · 2020-09-25T23:33:31.000+01:00
Add in-tree fuzz target proof-of-concept for oss-fuzz
diff --git a/.gitattributes b/.gitattributes
@@ -3,15 +3,18 @@
 
 # Explicitly declare text file types for this repo
 *.c text
-*.pp text
+*.cpp text
 *.h text
 *.md text
 Jenkinsfile text
 
-# VS solution always use Windows line endings
+# VS solutions always use Windows line endings
 *.sln text eol=crlf
 *.vcxproj text eol=crlf
 
+# Bash scripts always use *nux line endings
+*.sh text eol=lf
+
 # Denote all files that are truly binary and should not be modified.
 *.png binary
 *.hdr binary
diff --git a/Source/Fuzzers/build.sh b/Source/Fuzzers/build.sh
@@ -0,0 +1,33 @@
+#!/bin/bash -eu
+
+#  SPDX-License-Identifier: Apache-2.0
+#  ----------------------------------------------------------------------------
+#  Copyright 2020 Arm Limited
+#  Copyright 2020 Google Inc.
+#
+#  Licensed under the Apache License, Version 2.0 (the "License"); you may not
+#  use this file except in compliance with the License. You may obtain a copy
+#  of the License at:
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#  License for the specific language governing permissions and limitations
+#  under the License.
+#  ----------------------------------------------------------------------------
+
+# Build the core project
+make -j$(nproc) BUILD=debug VEC=sse2
+
+# Package up a library for fuzzers to link against
+ar -qc libastcenc.a  *.o
+
+# Build project local fuzzers
+for fuzzer in $SRC/astc-encoder/Source/Fuzzers/fuzz_*.cpp; do
+  $CXX $CXXFLAGS \
+      -DASTCENC_SSE=0 -DASTCENC_AVX=0 -DASTCENC_POPCNT=0 -DASTCENC_VECALIGN=16 \
+      -I. -std=c++14 $fuzzer $LIB_FUZZING_ENGINE $SRC/astc-encoder/Source/libastcenc.a \
+      -o $OUT/$(basename -s .cpp $fuzzer)
+done
diff --git a/Source/Fuzzers/fuzz_astc_physical_to_symbolic.cpp b/Source/Fuzzers/fuzz_astc_physical_to_symbolic.cpp
@@ -0,0 +1,103 @@
+// SPDX-License-Identifier: Apache-2.0
+// ----------------------------------------------------------------------------
+// Copyright 2020 Arm Limited
+//
+// Licensed under the Apache License, Version 2.0 (the "License"); you may not
+// use this file except in compliance with the License. You may obtain a copy
+// of the License at:
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+// WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+// License for the specific language governing permissions and limitations
+// under the License.
+// ----------------------------------------------------------------------------
+
+/**
+ * @brief Fuzz target for physical_to_symbolic().
+ *
+ * This function is the first entrypoint for decompressing a 16 byte block of
+ * input ASTC data from disk. The 16 bytes can contain arbitrary data; they
+ * are read from an external source, but the block size used must be a valid
+ * ASTC block footprint.
+ */
+
+
+#include "astcenc_internal.h"
+
+#include <fuzzer/FuzzedDataProvider.h>
+#include <array>
+#include <vector>
+
+struct BlockSizes {
+	int x;
+	int y;
+	int z;
+};
+
+std::array<BlockSizes, 3> testSz {{
+	{ 4,  4, 1}, // Highest bitrate
+	{12, 12, 1}, // Largest 2D block
+	{6,  6,  6}  // Largest 3D block
+}};
+
+std::array<block_size_descriptor, 3> testBSD;
+
+/**
+ * @brief Utility function to create all of the block size descriptors needed.
+ *
+ * This is triggered once via a static initializer.
+ *
+ * Triggering once is important so that we only create a single BSD per block
+ * size we need, rather than one per fuzzer iteration (it's expensive). This
+ * improves fuzzer throughput by ~ 1000x!
+ *
+ * Triggering via a static initializer, rather than a lazy init in the fuzzer
+ * function, is important because is means that the BSD is allocated before
+ * fuzzing starts. This means that leaksanitizer will ignore the fact that we
+ * "leak" the dynamic allocations inside the BSD (we never call term()).
+ */
+bool bsd_initializer()
+{
+	for (int i = 0; i < testSz.size(); i++)
+	{
+		init_block_size_descriptor(
+		    testSz[i].x,
+		    testSz[i].y,
+		    testSz[i].z,
+		    &(testBSD[i]));
+	}
+
+	return true;
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+	// Preinitialize the block size descriptors we need
+	static bool init = bsd_initializer();
+
+	// Must have 4 (select block size) and 16 (payload) bytes
+	if (size < 4 + 16)
+	{
+		return 0;
+	}
+
+	FuzzedDataProvider stream(data, size);
+
+	// Select a block size to test
+	int i = stream.ConsumeIntegralInRange<int>(0, testSz.size() - 1);
+	block_size_descriptor* bsd = &(testBSD[i]);
+
+	// Populate the physical block
+	physical_compressed_block pcb;
+	std::vector<uint8_t> buffer = stream.ConsumeBytes<uint8_t>(16);
+	std::memcpy(&pcb, buffer.data(), 16);
+
+	// Call the function under test
+	symbolic_compressed_block scb;
+	physical_to_symbolic(bsd, pcb, &scb);
+
+	return 0;
+}
