mirror of
https://gitlab.kitware.com/cmake/cmake.git
synced 2026-10-07 04:02:23 +03:00
Matthew Woehlke
b8b0bf1f27
Modify cmListFile[Parser] to use cmMakefile rather than cmMessenger as the interface for issuing messages. This is necessary to provide a context for diagnostic messages so that they can be controlled via the diagnostic state (which is not owned by cmMessenger). Note that we actually bypass the cmMakefile when issuing errors, as these cannot be disabled (so the diagnostic context doesn't matter), and we want the calling cmMakefile to still be able to issue its own errors, which would be suppressed if the cmMakefile has already issued an error.
CMake Fuzzing Suite
===================
This directory contains fuzz targets for testing CMake with coverage-guided
fuzzing. These fuzzers are integrated with `OSS-Fuzz`_ for continuous fuzzing.
All fuzzers are implemented using the `libFuzzer engine`_.
.. _`OSS-Fuzz`: https://github.com/google/oss-fuzz
.. _`libFuzzer engine`: https://llvm.org/docs/LibFuzzer.html
Building Locally
----------------
See `reproducing OSS-Fuzz bugs locally`_ for official instructions from
OSS-Fuzz on reproducing using Docker.
Unofficially, to build the fuzzers locally with Clang and libFuzzer:
mkdir build && cd build
cmake -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ \
-DCMake_BUILD_FUZZING=ON \
-DCMAKE_C_FLAGS="-fsanitize=fuzzer-no-link,address" \
-DCMAKE_CXX_FLAGS="-fsanitize=fuzzer-no-link,address" \
..
cmake --build .
The above command runs the fuzzers using address sanitizer (ASAN). Fuzzing can
also be performed using memory (MSAN) or undefined behavior (UBSAN) sanitizers.
Adjust the ``CMAKE_(C|CXX)_FLAGS`` accordingly using
``-fsanitizer=fuzzer-no-link,memory`` or
``-fsanitizer=fuzzer-no-link,undefined``, respectively.
.. _`reproducing OSS-Fuzz bugs locally`: https://google.github.io/oss-fuzz/getting-started/reproducing-bugs-locally/
Seed Corpora
------------
Each fuzzer has a corresponding seed corpus in ``corpus/<fuzzer_name>/``.
Dictionaries
------------
Fuzzer dictionaries are provided to improve coverage. Each fuzzer has a
corresponding ``.dict`` file with format-specific tokens.
Security Considerations
-----------------------
These fuzzers specifically target security-sensitive code paths:
- **Path traversal**: Archive extraction with ``../`` sequences
- **Symlink attacks**: File handling with symlinks
- **Memory safety**: Buffer handling in parsers
- **Integer overflows**: Size calculations in binary parsers
Bug Reports
-----------
Security bugs found by OSS-Fuzz are reported to CMake maintainers via the
OSS-Fuzz security disclosure process. Non-security bugs are filed as public
issues after a 90-day disclosure window.