| CMake Fuzzing Suite | |
| =================== | |
| This directory contains fuzz targets for testing CMake with coverage-guided | |
| fuzzing. These fuzzers are integrated with `OSS-Fuzz`_ for continuous fuzzing. | |
| All fuzzers are implemented using the `libFuzzer engine`_. | |
| .. _`OSS-Fuzz`: https://github.com/google/oss-fuzz | |
| .. _`libFuzzer engine`: https://llvm.org/docs/LibFuzzer.html | |
| Building Locally | |
| ---------------- | |
| See `reproducing OSS-Fuzz bugs locally`_ for official instructions from | |
| OSS-Fuzz on reproducing using Docker. | |
| Unofficially, to build the fuzzers locally with Clang and libFuzzer:: | |
| mkdir build && cd build | |
| cmake -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ \ | |
| -DCMake_BUILD_FUZZING=ON \ | |
| -DCMAKE_C_FLAGS="-fsanitize=fuzzer-no-link,address" \ | |
| -DCMAKE_CXX_FLAGS="-fsanitize=fuzzer-no-link,address" \ | |
| .. | |
| cmake --build . | |
| The above command runs the fuzzers using address sanitizer (ASAN). Fuzzing can | |
| also be performed using memory (MSAN) or undefined behavior (UBSAN) sanitizers. | |
| Adjust the ``CMAKE_(C|CXX)_FLAGS`` accordingly using | |
| ``-fsanitizer=fuzzer-no-link,memory`` or | |
| ``-fsanitizer=fuzzer-no-link,undefined``, respectively. | |
| .. _`reproducing OSS-Fuzz bugs locally`: https://google.github.io/oss-fuzz/advanced-topics/reproducing/ | |
| Seed Corpora | |
| ------------ | |
| Each fuzzer has a corresponding seed corpus in ``corpus/<fuzzer_name>/``. | |
| Dictionaries | |
| ------------ | |
| Fuzzer dictionaries are provided to improve coverage. Each fuzzer has a | |
| corresponding ``.dict`` file with format-specific tokens. | |
| Security Considerations | |
| ----------------------- | |
| These fuzzers specifically target security-sensitive code paths: | |
| - **Path traversal**: Archive extraction with ``../`` sequences | |
| - **Symlink attacks**: File handling with symlinks | |
| - **Memory safety**: Buffer handling in parsers | |
| - **Integer overflows**: Size calculations in binary parsers | |
| Bug Reports | |
| ----------- | |
| Security bugs found by OSS-Fuzz are reported to CMake maintainers via the | |
| OSS-Fuzz security disclosure process. Non-security bugs are filed as public | |
| issues after a 90-day disclosure window. |