1cmake_minimum_required(VERSION 3.9)
2
3set(CMAKE_VERBOSE_MAKEFILE ON)
4set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
5set(CMAKE_POSITION_INDEPENDENT_CODE ON)
6
7project(FlatBuffersFuzzerTests)
8
9option(BUILD_DEBUGGER "Compile a debugger with main() and without libFuzzer" OFF)
10
11if(NOT DEFINED FLATBUFFERS_MAX_PARSING_DEPTH)
12 # Force checking of RecursionError in the test
13 set(FLATBUFFERS_MAX_PARSING_DEPTH 24)
14endif()
15message(STATUS "FLATBUFFERS_MAX_PARSING_DEPTH: ${FLATBUFFERS_MAX_PARSING_DEPTH}")
16
17# Usage '-fsanitize=address' doesn't allowed with '-fsanitize=memory'.
18# MemorySanitizer will not work out-of-the-box, and will instead report false
19# positives coming from uninstrumented code. Need to re-build both C++ standard
20# library: https://github.com/google/sanitizers/wiki/MemorySanitizerLibcxxHowTo
21option(USE_ASAN "Use fuzzers with ASASN" OFF)
22option(USE_MSAN "Use fuzzers with MSASN" OFF)
23option(OSS_FUZZ "Set this option to use flags by oss-fuzz" OFF)
24
25# Use Clang linker.
26set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -fuse-ld=lld")
27
28# add_link_options(-stdlib=libc++)
29
30add_compile_options(
31 # -stdlib=libc++ # Use Clang libc++ instead of GNU.
32 -std=c++17
33 -Wall
34 -pedantic
35 -Werror
36 -Wextra
37 -Wno-unused-parameter
38 -fsigned-char
39 -fno-omit-frame-pointer
40 -g # Generate source-level debug information
41 # -flto # enable link-time optimisation
42)
43
44# https://llvm.org/docs/Passes.html save IR to see call graph make one bitcode
45# file:> llvm-link *.bc -o out.bc print call-graph:> opt out.bc -analyze -print-
46# callgraph &> callgraph.txt set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -save-temps
47# -flto")
48
49# A special target with fuzzer+sanitizer flags.
50add_library(fuzzer_config INTERFACE)
51
52target_compile_options(
53 fuzzer_config
54 INTERFACE
55 $<$<NOT:$<BOOL:${OSS_FUZZ}>>:
56 -fsanitize-coverage=trace-cmp
57 >
58 $<$<BOOL:${USE_ASAN}>:
59 -fsanitize=fuzzer,undefined,address
60 >
61 $<$<BOOL:${USE_MSAN}>:
62 -fsanitize=fuzzer,undefined,memory
63 -fsanitize-memory-track-origins=2
64 >
65 $<$<BOOL:${OSS_FUZZ}>:
66 ${CXX}
67 ${CXXFLAGS}
68 >
69)
70
71target_link_libraries(
72 fuzzer_config
73 INTERFACE
74 $<$<BOOL:${USE_ASAN}>:
75 -fsanitize=fuzzer,undefined,address
76 >
77 $<$<BOOL:${USE_MSAN}>:
78 -fsanitize=fuzzer,undefined,memory
79 >
80 $<$<BOOL:${OSS_FUZZ}>:
81 $ENV{LIB_FUZZING_ENGINE}
82 >
83)
84
85set(FLATBUFFERS_DIR "${CMAKE_CURRENT_SOURCE_DIR}/../../")
86
87set(FlatBuffers_Library_SRCS
88 ${FLATBUFFERS_DIR}/include/flatbuffers/allocator.h
89 ${FLATBUFFERS_DIR}/include/flatbuffers/array.h
90 ${FLATBUFFERS_DIR}/include/flatbuffers/base.h
91 ${FLATBUFFERS_DIR}/include/flatbuffers/buffer.h
92 ${FLATBUFFERS_DIR}/include/flatbuffers/buffer_ref.h
93 ${FLATBUFFERS_DIR}/include/flatbuffers/default_allocator.h
94 ${FLATBUFFERS_DIR}/include/flatbuffers/detached_buffer.h
95 ${FLATBUFFERS_DIR}/include/flatbuffers/flatbuffer_builder.h
96 ${FLATBUFFERS_DIR}/include/flatbuffers/flatbuffers.h
97 ${FLATBUFFERS_DIR}/include/flatbuffers/flexbuffers.h
98 ${FLATBUFFERS_DIR}/include/flatbuffers/flex_flat_util.h
99 ${FLATBUFFERS_DIR}/include/flatbuffers/hash.h
100 ${FLATBUFFERS_DIR}/include/flatbuffers/idl.h
101 ${FLATBUFFERS_DIR}/include/flatbuffers/minireflect.h
102 ${FLATBUFFERS_DIR}/include/flatbuffers/reflection.h
103 ${FLATBUFFERS_DIR}/include/flatbuffers/reflection_generated.h
104 ${FLATBUFFERS_DIR}/include/flatbuffers/registry.h
105 ${FLATBUFFERS_DIR}/include/flatbuffers/stl_emulation.h
106 ${FLATBUFFERS_DIR}/include/flatbuffers/string.h
107 ${FLATBUFFERS_DIR}/include/flatbuffers/struct.h
108 ${FLATBUFFERS_DIR}/include/flatbuffers/table.h
109 ${FLATBUFFERS_DIR}/include/flatbuffers/util.h
110 ${FLATBUFFERS_DIR}/include/flatbuffers/vector.h
111 ${FLATBUFFERS_DIR}/include/flatbuffers/vector_downward.h
112 ${FLATBUFFERS_DIR}/include/flatbuffers/verifier.h
113 ${FLATBUFFERS_DIR}/src/idl_parser.cpp
114 ${FLATBUFFERS_DIR}/src/idl_gen_text.cpp
115 ${FLATBUFFERS_DIR}/src/reflection.cpp
116 ${FLATBUFFERS_DIR}/src/binary_annotator.h
117 ${FLATBUFFERS_DIR}/src/binary_annotator.cpp
118 ${FLATBUFFERS_DIR}/src/util.cpp
119 ${FLATBUFFERS_DIR}/tests/test_assert.cpp
120 ${FLATBUFFERS_DIR}/tests/64bit/test_64bit_bfbs_generated.h
121)
122
123include_directories(${FLATBUFFERS_DIR}/include)
124include_directories(${FLATBUFFERS_DIR}/tests)
125include_directories(${FLATBUFFERS_DIR}/src)
126
127add_library(flatbuffers_fuzzed STATIC ${FlatBuffers_Library_SRCS})
128# Use PUBLIC to force 'fuzzer_config' for all dependent targets
129target_link_libraries(flatbuffers_fuzzed PUBLIC fuzzer_config)
130
131# FLATBUFFERS_ASSERT should assert in Release as well. Redefine
132# FLATBUFFERS_ASSERT macro definition. Declare as PUBLIC to cover asserts in all
133# included header files.
134target_compile_definitions(
135 flatbuffers_fuzzed
136 PUBLIC
137 FLATBUFFERS_ASSERT=fuzzer_assert_impl
138 FLATBUFFERS_ASSERT_INCLUDE="${CMAKE_CURRENT_SOURCE_DIR}/fuzzer_assert.h"
139 PRIVATE
140 FLATBUFFERS_MAX_PARSING_DEPTH=${FLATBUFFERS_MAX_PARSING_DEPTH}
141)
142
143# Setup fuzzer tests.
144
145add_executable(scalar_fuzzer flatbuffers_scalar_fuzzer.cc)
146target_link_libraries(scalar_fuzzer PRIVATE flatbuffers_fuzzed)
147
148add_executable(parser_fuzzer flatbuffers_parser_fuzzer.cc)
149target_link_libraries(parser_fuzzer PRIVATE flatbuffers_fuzzed)
150
151add_executable(verifier_fuzzer flatbuffers_verifier_fuzzer.cc)
152target_link_libraries(verifier_fuzzer PRIVATE flatbuffers_fuzzed)
153
154add_executable(flexverifier_fuzzer flexbuffers_verifier_fuzzer.cc)
155target_link_libraries(flexverifier_fuzzer PRIVATE flatbuffers_fuzzed)
156
157add_executable(monster_fuzzer flatbuffers_monster_fuzzer.cc)
158target_link_libraries(monster_fuzzer PRIVATE flatbuffers_fuzzed)
159add_custom_command(
160 TARGET monster_fuzzer PRE_BUILD
161 COMMAND ${CMAKE_COMMAND} -E copy
162 ${CMAKE_SOURCE_DIR}/../monster_test.bfbs
163 ${CMAKE_CURRENT_BINARY_DIR}/monster_test.bfbs)
164
165add_executable(annotator_fuzzer flatbuffers_annotator_fuzzer.cc)
166target_link_libraries(annotator_fuzzer PRIVATE flatbuffers_fuzzed)
167add_custom_command(
168 TARGET annotator_fuzzer PRE_BUILD
169
170 COMMAND ${CMAKE_COMMAND} -E copy
171 ${CMAKE_SOURCE_DIR}/../annotated_binary/annotated_binary.bfbs
172 ${CMAKE_CURRENT_BINARY_DIR}/annotated_binary.bfbs
173
174 COMMAND ${CMAKE_COMMAND} -E copy
175 ${CMAKE_SOURCE_DIR}/../annotated_binary/annotated_binary.bin
176 ${CMAKE_CURRENT_BINARY_DIR}/seed_annotator/annotated_binary.bin
177)
178
179add_executable(64bit_fuzzer flatbuffers_64bit_fuzzer.cc)
180target_link_libraries(64bit_fuzzer PRIVATE flatbuffers_fuzzed)
181add_custom_command(
182 TARGET 64bit_fuzzer PRE_BUILD
183
184 COMMAND ${CMAKE_COMMAND} -E copy
185 ${CMAKE_SOURCE_DIR}/../64bit/test_64bit.bin
186 ${CMAKE_CURRENT_BINARY_DIR}/seed_64bit/test_64bit.bin
187)
188
189# Build debugger for weird cases found with fuzzer.
190if(BUILD_DEBUGGER)
191 add_library(flatbuffers_nonfuzz STATIC ${FlatBuffers_Library_SRCS})
192 target_compile_options(
193 flatbuffers_nonfuzz
194 PUBLIC
195 $<$<BOOL:${USE_ASAN}>:
196 -fsanitize=undefined,address
197 >
198 -fno-limit-debug-info
199 )
200
201 target_link_libraries(
202 flatbuffers_nonfuzz
203 PUBLIC
204 $<$<BOOL:${USE_ASAN}>:
205 -fsanitize=undefined,address
206 >
207 )
208
209 target_compile_definitions(
210 flatbuffers_nonfuzz
211 PUBLIC
212 FLATBUFFERS_ASSERT=fuzzer_assert_impl
213 FLATBUFFERS_ASSERT_INCLUDE="${CMAKE_CURRENT_SOURCE_DIR}/fuzzer_assert.h"
214 PRIVATE
215 FLATBUFFERS_MAX_PARSING_DEPTH=${FLATBUFFERS_MAX_PARSING_DEPTH}
216 )
217 add_executable(scalar_debug
218 flatbuffers_scalar_fuzzer.cc
219 scalar_debug.cpp
220 )
221 target_link_libraries(scalar_debug PRIVATE flatbuffers_nonfuzz)
222
223 add_executable(monster_debug
224 flatbuffers_monster_fuzzer.cc
225 monster_debug.cpp
226 )
227 target_link_libraries(monster_debug PRIVATE flatbuffers_nonfuzz)
228 add_custom_command(
229 TARGET monster_debug PRE_BUILD
230 COMMAND ${CMAKE_COMMAND} -E copy
231 ${CMAKE_SOURCE_DIR}/../monster_test.bfbs
232 ${CMAKE_CURRENT_BINARY_DIR}/monster_test.bfbs)
233
234endif(BUILD_DEBUGGER)
View as plain text