Tests/Fuzzing/cmELFFuzzer.cxx

/* Distributed under the OSI-approved BSD 3-Clause License.  See accompanying
   file LICENSE.rst or https://cmake.org/licensing for details.  */

/*
 * Fuzzer for CMake's ELF parser
 *
 * CMake parses ELF files to extract RPATH, RUNPATH, and SONAME information.
 * Malformed ELF files from untrusted sources could trigger vulnerabilities.
 *
 * Coverage targets:
 * - ELF header parsing (32-bit and 64-bit)
 * - Section header parsing
 * - Dynamic section parsing
 * - String table extraction
 * - RPATH/RUNPATH/SONAME extraction
 *
 * Performance notes:
 * - Uses memfd_create on Linux for memory-backed file I/O
 * - Falls back to temp files on other platforms
 */

#include <cstddef>
#include <cstdint>
#include <cstdio>
#include <cstdlib>
#include <sstream>
#include <string>

#include <unistd.h>

#include "cmELF.h"

#ifdef __linux__
#  include <sys/mman.h>
#  ifndef MFD_CLOEXEC
#    define MFD_CLOEXEC 0x0001U
#  endif
#endif

// ELF files can be large, but we limit to avoid timeouts
static constexpr size_t kMinInputSize = 16;         // Minimum ELF header
static constexpr size_t kMaxInputSize = 512 * 1024; // 512KB

static int g_memfd = -1;
static std::string g_memfdPath;

extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv)
{
  (void)argc;
  (void)argv;

#ifdef __linux__
  g_memfd = memfd_create("cmake_fuzz_elf", MFD_CLOEXEC);
  if (g_memfd >= 0) {
    g_memfdPath = "/proc/self/fd/" + std::to_string(g_memfd);
  }
#endif
  return 0;
}

extern "C" int LLVMFuzzerTestOneInput(uint8_t const* data, size_t size)
{
  // ELF files need minimum header size
  if (size < kMinInputSize || size > kMaxInputSize) {
    return 0;
  }

  std::string testFile;

#ifdef __linux__
  if (g_memfd >= 0) {
    // Use memfd for better performance
    ftruncate(g_memfd, 0);
    lseek(g_memfd, 0, SEEK_SET);
    if (write(g_memfd, data, size) != static_cast<ssize_t>(size)) {
      return 0;
    }
    testFile = g_memfdPath;
  } else
#endif
  {
    // Fallback to temp file
    char tmpFile[] = "/tmp/fuzz_elf_XXXXXX";
    int fd = mkstemp(tmpFile);
    if (fd < 0) {
      return 0;
    }
    if (write(fd, data, size) != static_cast<ssize_t>(size)) {
      close(fd);
      unlink(tmpFile);
      return 0;
    }
    close(fd);
    testFile = tmpFile;
  }

  // Parse the ELF file
  {
    cmELF elf(testFile.c_str());

    // Check validity
    if (elf) {
      // Exercise all the parsing functions
      (void)elf.GetFileType();
      (void)elf.GetMachine();
      (void)elf.GetNumberOfSections();
      (void)elf.HasDynamicSection();
      (void)elf.IsMIPS();

      // Try to get string entries
      std::string soname;
      elf.GetSOName(soname);
      (void)elf.GetSOName();
      (void)elf.GetRPath();
      (void)elf.GetRunPath();

      // Get dynamic entries
      auto entries = elf.GetDynamicEntries();
      if (!entries.empty()) {
        auto encoded = elf.EncodeDynamicEntries(entries);
        (void)encoded;

        // Get positions (limit iterations to avoid timeout)
        for (size_t i = 0; i < entries.size() && i < 100; ++i) {
          (void)elf.GetDynamicEntryPosition(static_cast<int>(i));
        }
      }

      // Print info to exercise that code path
      std::ostringstream oss;
      elf.PrintInfo(oss);
    }

    // Always check error message path
    (void)elf.GetErrorMessage();
  }

  // Cleanup temp file (memfd doesn't need cleanup)
#ifdef __linux__
  if (g_memfd < 0)
#endif
  {
    unlink(testFile.c_str());
  }

  return 0;
}