4 files changed, 100 insertions, 0 deletions

diff --git a/fuzz/Makefile.am b/fuzz/Makefile.am
new file mode 100644
index 0000000..b9798f9
--- /dev/null
+++ b/fuzz/Makefile.am
@@ -0,0 +1,36 @@
+if BUILD_FUZZERS
+
+libFuzzer.a: Fuzzer/build.sh
+        @echo "Building $@"
+        @./Fuzzer/build.sh
+
+Fuzzer/build.sh: LIBFUZZER_SRC
+
+LIBFUZZER_SRC:
+        @if test -d Fuzzer ; then \
+                if test -d Fuzzer/.git ; then \
+                        echo Making sure libFuzzer source tree is up-to-date... ; \
+                        cd Fuzzer && git checkout . && git pull && cd .. ; \
+                fi \
+        else \
+                echo Checking out libFuzzer source code... ; \
+                git clone https://chromium.googlesource.com/chromium/llvm-project/llvm/lib/Fuzzer ; \
+        fi
+
+CLEANFILES = libFuzzer.a
+
+noinst_PROGRAMS = xplist_fuzzer bplist_fuzzer
+
+xplist_fuzzer_SOURCES = xplist_fuzzer.cc
+xplist_fuzzer_LDFLAGS = -static
+xplist_fuzzer_LDADD = $(top_builddir)/src/libplist.la libFuzzer.a
+
+bplist_fuzzer_SOURCES = bplist_fuzzer.cc
+bplist_fuzzer_LDFLAGS = -static
+bplist_fuzzer_LDADD = $(top_builddir)/src/libplist.la libFuzzer.a
+
+TESTS = fuzzers.test
+
+EXTRA_DIST = bplist.dict xplist.dict init-fuzzers.sh test-fuzzers.sh fuzzers.test
+
+endif
diff --git a/fuzz/fuzzers.test b/fuzz/fuzzers.test
new file mode 100755
index 0000000..dd3fb08
--- /dev/null
+++ b/fuzz/fuzzers.test
@@ -0,0 +1,8 @@
+## -*- sh -*-
+
+set -e
+
+./init-fuzzers.sh
+
+./test-fuzzers.sh
+
diff --git a/fuzz/init-fuzzers.sh b/fuzz/init-fuzzers.sh
new file mode 100755
index 0000000..e48baa8
--- /dev/null
+++ b/fuzz/init-fuzzers.sh
@@ -0,0 +1,23 @@
+#!/bin/sh
+
+CURDIR=`pwd`
+FUZZDIR=`dirname $0`
+
+cd ${FUZZDIR}
+
+if ! test -x xplist_fuzzer || ! test -x bplist_fuzzer; then
+        echo "ERROR: you need to build the fuzzers first."
+        cd ${CURDIR}
+        exit 1
+fi
+
+mkdir -p xplist-input
+cp ../test/data/*.plist xplist-input/
+./xplist_fuzzer -merge=1 xplist-input crashes leaks -dict=xplist.dict
+
+mkdir -p bplist-input
+cp ../test/data/*.bplist bplist-input/
+./bplist_fuzzer -merge=1 bplist-input crashes leaks -dict=bplist.dict
+
+cd ${CURDIR}
+exit 0
diff --git a/fuzz/test-fuzzers.sh b/fuzz/test-fuzzers.sh
new file mode 100755
index 0000000..5c758c4
--- /dev/null
+++ b/fuzz/test-fuzzers.sh
@@ -0,0 +1,33 @@
+#!/bin/sh
+
+CURDIR=`pwd`
+FUZZDIR=`dirname $0`
+
+cd ${FUZZDIR}
+
+if ! test -x xplist_fuzzer || ! test -x bplist_fuzzer; then
+        echo "ERROR: you need to build the fuzzers first."
+        cd ${CURDIR}
+        exit 1
+fi
+
+if ! test -d xplist-input || ! test -d bplist-input; then
+        echo "ERROR: fuzzer corpora directories are not present. Did you run init-fuzzers.sh ?"
+        cd ${CURDIR}
+        exit 1
+fi
+
+echo "### TESTING xplist_fuzzer ###"
+if ! ./xplist_fuzzer xplist-input -dict=xplist.dict -runs=10000; then
+        cd ${CURDIR}
+        exit 1
+fi
+
+echo "### TESTING bplist_fuzzer ###"
+if ! ./bplist_fuzzer bplist-input -dict=bplist.dict -runs=10000; then
+        cd ${CURDIR}
+        exit 1
+fi
+
+cd ${CURDIR}
+exit 0