1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
|
CMake Fuzzing Suite
===================
This directory contains fuzz targets for testing CMake with coverage-guided
fuzzing. These fuzzers are integrated with `OSS-Fuzz`_ for continuous fuzzing.
All fuzzers are implemented using the `libFuzzer engine`_.
.. _`OSS-Fuzz`: https://github.com/google/oss-fuzz
.. _`libFuzzer engine`: https://llvm.org/docs/LibFuzzer.html
Building Locally
----------------
See `reproducing OSS-Fuzz bugs locally`_ for official instructions from
OSS-Fuzz on reproducing using Docker.
Unofficially, to build the fuzzers locally with Clang and libFuzzer:
mkdir build && cd build
cmake -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ \
-DCMake_BUILD_FUZZING=ON \
-DCMAKE_C_FLAGS="-fsanitize=fuzzer-no-link,address" \
-DCMAKE_CXX_FLAGS="-fsanitize=fuzzer-no-link,address" \
..
cmake --build .
The above command runs the fuzzers using address sanitizer (ASAN). Fuzzing can
also be performed using memory (MSAN) or undefined behavior (UBSAN) sanitizers.
Adjust the ``CMAKE_(C|CXX)_FLAGS`` accordingly using
``-fsanitizer=fuzzer-no-link,memory`` or
``-fsanitizer=fuzzer-no-link,undefined``, respectively.
.. _`reproducing OSS-Fuzz bugs locally`: https://google.github.io/oss-fuzz/getting-started/reproducing-bugs-locally/
Seed Corpora
------------
Each fuzzer has a corresponding seed corpus in ``corpus/<fuzzer_name>/``.
Dictionaries
------------
Fuzzer dictionaries are provided to improve coverage. Each fuzzer has a
corresponding ``.dict`` file with format-specific tokens.
Security Considerations
-----------------------
These fuzzers specifically target security-sensitive code paths:
- **Path traversal**: Archive extraction with ``../`` sequences
- **Symlink attacks**: File handling with symlinks
- **Memory safety**: Buffer handling in parsers
- **Integer overflows**: Size calculations in binary parsers
Bug Reports
-----------
Security bugs found by OSS-Fuzz are reported to CMake maintainers via the
OSS-Fuzz security disclosure process. Non-security bugs are filed as public
issues after a 90-day disclosure window.
|
