mirror of
https://gitlab.kitware.com/cmake/cmake.git
synced 2026-09-29 04:09:35 +03:00
63 lines
2.0 KiB
ReStructuredText
63 lines
2.0 KiB
ReStructuredText
CMake Fuzzing Suite
|
|
===================
|
|
|
|
This directory contains fuzz targets for testing CMake with coverage-guided
|
|
fuzzing. These fuzzers are integrated with `OSS-Fuzz`_ for continuous fuzzing.
|
|
|
|
All fuzzers are implemented using the `libFuzzer engine`_.
|
|
|
|
.. _`OSS-Fuzz`: https://github.com/google/oss-fuzz
|
|
.. _`libFuzzer engine`: https://llvm.org/docs/LibFuzzer.html
|
|
|
|
Building Locally
|
|
----------------
|
|
|
|
See `reproducing OSS-Fuzz bugs locally`_ for official instructions from
|
|
OSS-Fuzz on reproducing using Docker.
|
|
|
|
Unofficially, to build the fuzzers locally with Clang and libFuzzer::
|
|
|
|
mkdir build && cd build
|
|
cmake -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ \
|
|
-DCMake_BUILD_FUZZING=ON \
|
|
-DCMAKE_C_FLAGS="-fsanitize=fuzzer-no-link,address" \
|
|
-DCMAKE_CXX_FLAGS="-fsanitize=fuzzer-no-link,address" \
|
|
..
|
|
cmake --build .
|
|
|
|
The above command runs the fuzzers using address sanitizer (ASAN). Fuzzing can
|
|
also be performed using memory (MSAN) or undefined behavior (UBSAN) sanitizers.
|
|
Adjust the ``CMAKE_(C|CXX)_FLAGS`` accordingly using
|
|
``-fsanitizer=fuzzer-no-link,memory`` or
|
|
``-fsanitizer=fuzzer-no-link,undefined``, respectively.
|
|
|
|
.. _`reproducing OSS-Fuzz bugs locally`: https://google.github.io/oss-fuzz/advanced-topics/reproducing/
|
|
|
|
Seed Corpora
|
|
------------
|
|
|
|
Each fuzzer has a corresponding seed corpus in ``corpus/<fuzzer_name>/``.
|
|
|
|
Dictionaries
|
|
------------
|
|
|
|
Fuzzer dictionaries are provided to improve coverage. Each fuzzer has a
|
|
corresponding ``.dict`` file with format-specific tokens.
|
|
|
|
Security Considerations
|
|
-----------------------
|
|
|
|
These fuzzers specifically target security-sensitive code paths:
|
|
|
|
- **Path traversal**: Archive extraction with ``../`` sequences
|
|
- **Symlink attacks**: File handling with symlinks
|
|
- **Memory safety**: Buffer handling in parsers
|
|
- **Integer overflows**: Size calculations in binary parsers
|
|
|
|
Bug Reports
|
|
-----------
|
|
|
|
Security bugs found by OSS-Fuzz are reported to CMake maintainers via the
|
|
OSS-Fuzz security disclosure process. Non-security bugs are filed as public
|
|
issues after a 90-day disclosure window.
|