Makefile.am (20742B)
1 # This Makefile.am is in the public domain 2 3 # In-process fuzzing harnesses. See README in this directory. 4 # 5 # The harnesses are built only with --enable-fuzzing (see 6 # BUILD-INTEGRATION.md). They are ordinary check_PROGRAMS with a 7 # built-in deterministic driver, so they need neither clang nor 8 # libFuzzer nor AFL++; with those available the very same sources are 9 # compiled into libFuzzer/AFL++ targets by contrib/oss-fuzz/build.sh. 10 11 SUBDIRS = . 12 13 # Number of generate/mutate iterations per harness during "make check". 14 # Raise for a real fuzzing session, e.g. 15 # make LE_FUZZ_ITERATIONS=1000000 LE_FUZZ_SEED=42 check 16 LE_FUZZ_ITERATIONS = 20000 17 18 # PRNG seed; every run is exactly reproducible from (harness, seed). 19 LE_FUZZ_SEED = 1 20 21 # Where reproducers for failing inputs are written. 22 LE_FUZZ_CRASH_DIR = crashes 23 24 # Set to 1 to also flag string metadata that is not 0-terminated. Off by 25 # default: it is a contract violation rather than a memory error, and it 26 # is common enough in the older plugins to drown everything else. 27 LE_FUZZ_STRICT_PROC = 0 28 29 AM_CPPFLAGS = \ 30 -I$(top_srcdir)/src/include \ 31 -I$(top_srcdir)/src/common \ 32 -I$(top_srcdir)/src/main \ 33 -I$(top_srcdir)/src/fuzz 34 35 AM_TESTS_ENVIRONMENT = \ 36 LE_FUZZ_ITERATIONS="$(LE_FUZZ_ITERATIONS)" ; \ 37 export LE_FUZZ_ITERATIONS ; \ 38 LE_FUZZ_SEED="$(LE_FUZZ_SEED)" ; export LE_FUZZ_SEED ; \ 39 LE_FUZZ_CRASH_DIR="$(LE_FUZZ_CRASH_DIR)" ; \ 40 export LE_FUZZ_CRASH_DIR ; \ 41 LE_FUZZ_STRICT_PROC="$(LE_FUZZ_STRICT_PROC)" ; \ 42 export LE_FUZZ_STRICT_PROC ; \ 43 LIBEXTRACTOR_PREFIX="$(abs_top_builddir)/src/plugins/.libs" ; \ 44 export LIBEXTRACTOR_PREFIX ; 45 46 if USE_COVERAGE 47 AM_CFLAGS = --coverage -O0 48 XLIB = -lgcov 49 endif 50 51 # fuzz_datasource, fuzz_unzip and fuzz_ipc call functions that are 52 # internal to the library and are therefore hidden in the shared object; 53 # they are linked against the static archives, which requires 54 # --enable-static (the default). 55 LE_LIB = $(top_builddir)/src/main/libextractor.la 56 LE_COMMON = $(top_builddir)/src/common/libextractor_common.la 57 58 noinst_HEADERS = \ 59 fuzz_common.h \ 60 fuzz_ec.h \ 61 fuzz_plugin_name.h 62 63 EXTRA_DIST = \ 64 README \ 65 BUILD-INTEGRATION.md \ 66 CAMPAIGN.md \ 67 corpus 68 69 CLEANFILES = \ 70 $(LE_FUZZ_CRASH_DIR)/*.bin 71 72 73 # --------------------------------------------------------------------- 74 # Core harnesses 75 # --------------------------------------------------------------------- 76 77 CORE_FUZZERS = \ 78 fuzz_extract \ 79 fuzz_datasource \ 80 fuzz_ipc \ 81 fuzz_convert 82 83 fuzz_extract_SOURCES = fuzz_extract.c 84 fuzz_extract_LDADD = $(LE_LIB) $(XLIB) 85 86 fuzz_datasource_SOURCES = fuzz_datasource.c 87 fuzz_datasource_LDFLAGS = -static 88 fuzz_datasource_LDADD = $(LE_LIB) $(XLIB) 89 90 fuzz_ipc_SOURCES = fuzz_ipc.c 91 fuzz_ipc_LDFLAGS = -static 92 fuzz_ipc_LDADD = $(LE_LIB) $(XLIB) 93 94 fuzz_convert_SOURCES = fuzz_convert.c 95 fuzz_convert_LDFLAGS = -static 96 fuzz_convert_LDADD = $(LE_COMMON) $(LE_LIB) $(XLIB) 97 98 if HAVE_ZLIB 99 UNZIP_FUZZER = fuzz_unzip 100 fuzz_unzip_SOURCES = fuzz_unzip.c 101 fuzz_unzip_LDFLAGS = -static 102 fuzz_unzip_LDADD = $(LE_COMMON) $(XLIB) -lz 103 endif 104 105 106 # --------------------------------------------------------------------- 107 # Per-plugin harnesses 108 # 109 # Each of these compiles fuzz_plugin.c against the plugin's own sources, 110 # so the parser is instrumented and no dlopen()/fork() is involved. The 111 # two -D flags are described in fuzz_plugin_name.h. 112 # --------------------------------------------------------------------- 113 114 PLUGIN_DIR = $(top_srcdir)/src/plugins 115 116 # Plugins that are always built: pure in-tree parsers with no external 117 # dependency. These are where libextractor's own bugs live. 118 PLAIN_PLUGIN_FUZZERS = \ 119 fuzz_applefile \ 120 fuzz_dvi \ 121 fuzz_elf \ 122 fuzz_it \ 123 fuzz_man \ 124 fuzz_nsf \ 125 fuzz_nsfe \ 126 fuzz_ps \ 127 fuzz_real \ 128 fuzz_riff \ 129 fuzz_rtf \ 130 fuzz_s3m \ 131 fuzz_sid \ 132 fuzz_wav \ 133 fuzz_xm \ 134 fuzz_pecoff \ 135 fuzz_lnk \ 136 fuzz_sqlite \ 137 fuzz_tar \ 138 fuzz_iso9660 \ 139 fuzz_diskimage \ 140 fuzz_heif \ 141 fuzz_webp \ 142 fuzz_plist \ 143 fuzz_id3 \ 144 fuzz_gpx \ 145 fuzz_kml \ 146 fuzz_geotiff \ 147 fuzz_mbox 148 149 fuzz_applefile_SOURCES = fuzz_plugin.c 150 fuzz_applefile_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 151 -DLE_FUZZ_PLUGIN=applefile -DLE_FUZZ_ID=APPLEFILE 152 fuzz_applefile_LDADD = $(XLIB) 153 nodist_fuzz_applefile_SOURCES = \ 154 $(PLUGIN_DIR)/applefile_extractor.c $(PLUGIN_DIR)/pack.c 155 156 fuzz_dvi_SOURCES = fuzz_plugin.c 157 fuzz_dvi_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 158 -DLE_FUZZ_PLUGIN=dvi -DLE_FUZZ_ID=DVI 159 fuzz_dvi_LDADD = $(XLIB) $(SOCKET_LIBS) -lm 160 nodist_fuzz_dvi_SOURCES = $(PLUGIN_DIR)/dvi_extractor.c \ 161 $(PLUGIN_DIR)/fulltext.c $(PLUGIN_DIR)/pagelayout.c 162 163 fuzz_elf_SOURCES = fuzz_plugin.c 164 fuzz_elf_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 165 -DLE_FUZZ_PLUGIN=elf -DLE_FUZZ_ID=ELF 166 fuzz_elf_LDADD = $(XLIB) $(SOCKET_LIBS) 167 nodist_fuzz_elf_SOURCES = \ 168 $(PLUGIN_DIR)/elf_extractor.c $(PLUGIN_DIR)/pack.c 169 170 fuzz_it_SOURCES = fuzz_plugin.c 171 fuzz_it_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 172 -DLE_FUZZ_PLUGIN=it -DLE_FUZZ_ID=IT 173 fuzz_it_LDADD = $(XLIB) 174 nodist_fuzz_it_SOURCES = $(PLUGIN_DIR)/it_extractor.c 175 176 fuzz_man_SOURCES = fuzz_plugin.c 177 fuzz_man_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 178 -DLE_FUZZ_PLUGIN=man -DLE_FUZZ_ID=MAN 179 fuzz_man_LDADD = $(XLIB) 180 nodist_fuzz_man_SOURCES = $(PLUGIN_DIR)/man_extractor.c 181 182 fuzz_nsf_SOURCES = fuzz_plugin.c 183 fuzz_nsf_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 184 -DLE_FUZZ_PLUGIN=nsf -DLE_FUZZ_ID=NSF 185 fuzz_nsf_LDADD = $(XLIB) 186 nodist_fuzz_nsf_SOURCES = $(PLUGIN_DIR)/nsf_extractor.c 187 188 fuzz_nsfe_SOURCES = fuzz_plugin.c 189 fuzz_nsfe_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 190 -DLE_FUZZ_PLUGIN=nsfe -DLE_FUZZ_ID=NSFE 191 fuzz_nsfe_LDFLAGS = -static 192 fuzz_nsfe_LDADD = $(LE_COMMON) $(XLIB) 193 nodist_fuzz_nsfe_SOURCES = $(PLUGIN_DIR)/nsfe_extractor.c 194 195 fuzz_ps_SOURCES = fuzz_plugin.c 196 fuzz_ps_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 197 -DLE_FUZZ_PLUGIN=ps -DLE_FUZZ_ID=PS 198 fuzz_ps_LDADD = $(XLIB) 199 nodist_fuzz_ps_SOURCES = $(PLUGIN_DIR)/ps_extractor.c 200 201 fuzz_real_SOURCES = fuzz_plugin.c 202 fuzz_real_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 203 -DLE_FUZZ_PLUGIN=real -DLE_FUZZ_ID=REAL 204 fuzz_real_LDADD = $(XLIB) 205 nodist_fuzz_real_SOURCES = $(PLUGIN_DIR)/real_extractor.c 206 207 fuzz_riff_SOURCES = fuzz_plugin.c 208 fuzz_riff_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 209 -DLE_FUZZ_PLUGIN=riff -DLE_FUZZ_ID=RIFF 210 fuzz_riff_LDADD = $(XLIB) -lm 211 nodist_fuzz_riff_SOURCES = $(PLUGIN_DIR)/riff_extractor.c 212 213 fuzz_rtf_SOURCES = fuzz_plugin.c 214 fuzz_rtf_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 215 -DLE_FUZZ_PLUGIN=rtf -DLE_FUZZ_ID=RTF 216 fuzz_rtf_LDFLAGS = -static 217 fuzz_rtf_LDADD = $(LE_COMMON) $(XLIB) 218 nodist_fuzz_rtf_SOURCES = $(PLUGIN_DIR)/rtf_extractor.c 219 220 fuzz_s3m_SOURCES = fuzz_plugin.c 221 fuzz_s3m_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 222 -DLE_FUZZ_PLUGIN=s3m -DLE_FUZZ_ID=S3M 223 fuzz_s3m_LDADD = $(XLIB) 224 nodist_fuzz_s3m_SOURCES = $(PLUGIN_DIR)/s3m_extractor.c 225 226 fuzz_sid_SOURCES = fuzz_plugin.c 227 fuzz_sid_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 228 -DLE_FUZZ_PLUGIN=sid -DLE_FUZZ_ID=SID 229 fuzz_sid_LDADD = $(XLIB) 230 nodist_fuzz_sid_SOURCES = $(PLUGIN_DIR)/sid_extractor.c 231 232 fuzz_wav_SOURCES = fuzz_plugin.c 233 fuzz_wav_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 234 -DLE_FUZZ_PLUGIN=wav -DLE_FUZZ_ID=WAV 235 fuzz_wav_LDADD = $(XLIB) 236 nodist_fuzz_wav_SOURCES = $(PLUGIN_DIR)/wav_extractor.c 237 238 fuzz_xm_SOURCES = fuzz_plugin.c 239 fuzz_xm_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 240 -DLE_FUZZ_PLUGIN=xm -DLE_FUZZ_ID=XM 241 fuzz_xm_LDADD = $(XLIB) 242 nodist_fuzz_xm_SOURCES = $(PLUGIN_DIR)/xm_extractor.c 243 244 245 # Plugins that need zlib; these are the container formats, and the ZIP 246 # based ones share src/common/unzip.c. 247 if HAVE_ZLIB 248 ZLIB_PLUGIN_FUZZERS = \ 249 fuzz_deb \ 250 fuzz_msoffice \ 251 fuzz_odf \ 252 fuzz_png \ 253 fuzz_qt \ 254 fuzz_zip \ 255 fuzz_apk \ 256 fuzz_ebook 257 258 # The forensic header parsers. They share forensics.c, so it is 259 # compiled into every one of these harnesses. 260 fuzz_pecoff_SOURCES = fuzz_plugin.c 261 fuzz_pecoff_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 262 -DLE_FUZZ_PLUGIN=pecoff -DLE_FUZZ_ID=PECOFF 263 fuzz_pecoff_LDADD = $(XLIB) -lm 264 nodist_fuzz_pecoff_SOURCES = \ 265 $(PLUGIN_DIR)/pecoff_extractor.c \ 266 $(PLUGIN_DIR)/forensics.c 267 268 fuzz_lnk_SOURCES = fuzz_plugin.c 269 fuzz_lnk_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 270 -DLE_FUZZ_PLUGIN=lnk -DLE_FUZZ_ID=LNK 271 fuzz_lnk_LDADD = $(XLIB) -lm 272 nodist_fuzz_lnk_SOURCES = \ 273 $(PLUGIN_DIR)/lnk_extractor.c \ 274 $(PLUGIN_DIR)/forensics.c 275 276 fuzz_sqlite_SOURCES = fuzz_plugin.c 277 fuzz_sqlite_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 278 -DLE_FUZZ_PLUGIN=sqlite -DLE_FUZZ_ID=SQLITE 279 fuzz_sqlite_LDADD = $(XLIB) -lm 280 nodist_fuzz_sqlite_SOURCES = \ 281 $(PLUGIN_DIR)/sqlite_extractor.c \ 282 $(PLUGIN_DIR)/forensics.c 283 284 fuzz_tar_SOURCES = fuzz_plugin.c 285 fuzz_tar_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 286 -DLE_FUZZ_PLUGIN=tar -DLE_FUZZ_ID=TAR 287 fuzz_tar_LDADD = $(XLIB) -lm 288 nodist_fuzz_tar_SOURCES = \ 289 $(PLUGIN_DIR)/tar_extractor.c \ 290 $(PLUGIN_DIR)/forensics.c 291 292 fuzz_iso9660_SOURCES = fuzz_plugin.c 293 fuzz_iso9660_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 294 -DLE_FUZZ_PLUGIN=iso9660 -DLE_FUZZ_ID=ISO9660 295 fuzz_iso9660_LDADD = $(XLIB) -lm 296 nodist_fuzz_iso9660_SOURCES = \ 297 $(PLUGIN_DIR)/iso9660_extractor.c \ 298 $(PLUGIN_DIR)/forensics.c 299 300 fuzz_diskimage_SOURCES = fuzz_plugin.c 301 fuzz_diskimage_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 302 -DLE_FUZZ_PLUGIN=diskimage -DLE_FUZZ_ID=DISKIMAGE 303 fuzz_diskimage_LDADD = $(XLIB) -lm 304 nodist_fuzz_diskimage_SOURCES = \ 305 $(PLUGIN_DIR)/diskimage_extractor.c \ 306 $(PLUGIN_DIR)/forensics.c 307 308 fuzz_heif_SOURCES = fuzz_plugin.c 309 fuzz_heif_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 310 -DLE_FUZZ_PLUGIN=heif -DLE_FUZZ_ID=HEIF 311 fuzz_heif_LDADD = $(XLIB) -lm 312 nodist_fuzz_heif_SOURCES = \ 313 $(PLUGIN_DIR)/heif_extractor.c \ 314 $(PLUGIN_DIR)/forensics.c 315 316 fuzz_webp_SOURCES = fuzz_plugin.c 317 fuzz_webp_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 318 -DLE_FUZZ_PLUGIN=webp -DLE_FUZZ_ID=WEBP 319 fuzz_webp_LDADD = $(XLIB) -lm 320 nodist_fuzz_webp_SOURCES = \ 321 $(PLUGIN_DIR)/webp_extractor.c \ 322 $(PLUGIN_DIR)/forensics.c 323 324 fuzz_plist_SOURCES = fuzz_plugin.c 325 fuzz_plist_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 326 -DLE_FUZZ_PLUGIN=plist -DLE_FUZZ_ID=PLIST 327 fuzz_plist_LDADD = $(XLIB) -lm 328 nodist_fuzz_plist_SOURCES = \ 329 $(PLUGIN_DIR)/plist_extractor.c \ 330 $(PLUGIN_DIR)/forensics.c 331 332 fuzz_id3_SOURCES = fuzz_plugin.c 333 fuzz_id3_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 334 -DLE_FUZZ_PLUGIN=id3 -DLE_FUZZ_ID=ID3 335 fuzz_id3_LDADD = $(XLIB) -lm 336 nodist_fuzz_id3_SOURCES = \ 337 $(PLUGIN_DIR)/id3_extractor.c \ 338 $(PLUGIN_DIR)/forensics.c 339 340 fuzz_gpx_SOURCES = fuzz_plugin.c 341 fuzz_gpx_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 342 -DLE_FUZZ_PLUGIN=gpx -DLE_FUZZ_ID=GPX 343 fuzz_gpx_LDADD = $(XLIB) -lm 344 nodist_fuzz_gpx_SOURCES = \ 345 $(PLUGIN_DIR)/gpx_extractor.c \ 346 $(PLUGIN_DIR)/forensics.c 347 348 fuzz_kml_SOURCES = fuzz_plugin.c 349 fuzz_kml_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 350 -DLE_FUZZ_PLUGIN=kml -DLE_FUZZ_ID=KML 351 fuzz_kml_LDADD = $(XLIB) -lm 352 nodist_fuzz_kml_SOURCES = \ 353 $(PLUGIN_DIR)/kml_extractor.c \ 354 $(PLUGIN_DIR)/forensics.c 355 356 fuzz_geotiff_SOURCES = fuzz_plugin.c 357 fuzz_geotiff_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 358 -DLE_FUZZ_PLUGIN=geotiff -DLE_FUZZ_ID=GEOTIFF 359 fuzz_geotiff_LDADD = $(XLIB) -lm 360 nodist_fuzz_geotiff_SOURCES = \ 361 $(PLUGIN_DIR)/geotiff_extractor.c \ 362 $(PLUGIN_DIR)/forensics.c 363 364 fuzz_mbox_SOURCES = fuzz_plugin.c 365 fuzz_mbox_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 366 -DLE_FUZZ_PLUGIN=mbox -DLE_FUZZ_ID=MBOX 367 fuzz_mbox_LDADD = $(XLIB) -lm 368 nodist_fuzz_mbox_SOURCES = \ 369 $(PLUGIN_DIR)/mbox_extractor.c \ 370 $(PLUGIN_DIR)/forensics.c 371 372 373 fuzz_deb_SOURCES = fuzz_plugin.c 374 fuzz_deb_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 375 -DLE_FUZZ_PLUGIN=deb -DLE_FUZZ_ID=DEB 376 fuzz_deb_LDADD = $(XLIB) -lz 377 nodist_fuzz_deb_SOURCES = $(PLUGIN_DIR)/deb_extractor.c 378 379 fuzz_msoffice_SOURCES = fuzz_plugin.c 380 fuzz_msoffice_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 381 -DLE_FUZZ_PLUGIN=msoffice -DLE_FUZZ_ID=MSOFFICE 382 fuzz_msoffice_LDFLAGS = -static 383 fuzz_msoffice_LDADD = $(LE_COMMON) $(XLIB) -lz 384 nodist_fuzz_msoffice_SOURCES = $(PLUGIN_DIR)/msoffice_extractor.c 385 386 fuzz_odf_SOURCES = fuzz_plugin.c 387 fuzz_odf_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 388 -DLE_FUZZ_PLUGIN=odf -DLE_FUZZ_ID=ODF 389 fuzz_odf_LDFLAGS = -static 390 fuzz_odf_LDADD = $(LE_COMMON) $(XLIB) -lz 391 nodist_fuzz_odf_SOURCES = $(PLUGIN_DIR)/odf_extractor.c \ 392 $(PLUGIN_DIR)/fulltext.c 393 394 fuzz_png_SOURCES = fuzz_plugin.c 395 fuzz_png_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 396 -DLE_FUZZ_PLUGIN=png -DLE_FUZZ_ID=PNG 397 fuzz_png_LDFLAGS = -static 398 fuzz_png_LDADD = $(LE_COMMON) $(XLIB) -lz 399 nodist_fuzz_png_SOURCES = $(PLUGIN_DIR)/png_extractor.c 400 401 fuzz_qt_SOURCES = fuzz_plugin.c 402 fuzz_qt_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 403 -DLE_FUZZ_PLUGIN=qt -DLE_FUZZ_ID=QT 404 fuzz_qt_LDADD = $(XLIB) -lz 405 nodist_fuzz_qt_SOURCES = $(PLUGIN_DIR)/qt_extractor.c 406 407 fuzz_zip_SOURCES = fuzz_plugin.c 408 fuzz_zip_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 409 -DLE_FUZZ_PLUGIN=zip -DLE_FUZZ_ID=ZIP 410 fuzz_zip_LDFLAGS = -static 411 fuzz_zip_LDADD = $(LE_COMMON) $(XLIB) -lz 412 nodist_fuzz_zip_SOURCES = $(PLUGIN_DIR)/zip_extractor.c 413 414 fuzz_apk_SOURCES = fuzz_plugin.c 415 fuzz_apk_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 416 -DLE_FUZZ_PLUGIN=apk -DLE_FUZZ_ID=APK 417 fuzz_apk_LDFLAGS = -static 418 fuzz_apk_LDADD = $(LE_COMMON) $(XLIB) -lm -lz 419 nodist_fuzz_apk_SOURCES = \ 420 $(PLUGIN_DIR)/apk_extractor.c \ 421 $(PLUGIN_DIR)/forensics.c 422 423 fuzz_ebook_SOURCES = fuzz_plugin.c 424 fuzz_ebook_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 425 -DLE_FUZZ_PLUGIN=ebook -DLE_FUZZ_ID=EBOOK 426 fuzz_ebook_LDFLAGS = -static 427 fuzz_ebook_LDADD = $(LE_COMMON) $(XLIB) -lm -lz 428 nodist_fuzz_ebook_SOURCES = \ 429 $(PLUGIN_DIR)/ebook_extractor.c \ 430 $(PLUGIN_DIR)/forensics.c \ 431 $(PLUGIN_DIR)/fulltext.c 432 433 endif 434 435 436 # Plugins that wrap a third-party parser. Their own code is thin, but 437 # the glue -- the part that turns what the library returns into a 438 # metadata callback -- is ours and is worth the same treatment. 439 if HAVE_GIF 440 GIF_FUZZER = fuzz_gif 441 fuzz_gif_SOURCES = fuzz_plugin.c 442 fuzz_gif_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 443 -DLE_FUZZ_PLUGIN=gif -DLE_FUZZ_ID=GIF 444 fuzz_gif_LDADD = $(XLIB) -lgif 445 nodist_fuzz_gif_SOURCES = $(PLUGIN_DIR)/gif_extractor.c 446 endif 447 448 if HAVE_JPEG 449 JPEG_FUZZER = fuzz_jpeg 450 fuzz_jpeg_SOURCES = fuzz_plugin.c 451 fuzz_jpeg_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 452 -DLE_FUZZ_PLUGIN=jpeg -DLE_FUZZ_ID=JPEG 453 fuzz_jpeg_LDADD = $(XLIB) -ljpeg 454 nodist_fuzz_jpeg_SOURCES = $(PLUGIN_DIR)/jpeg_extractor.c 455 endif 456 457 if HAVE_TIFF 458 TIFF_FUZZER = fuzz_tiff 459 fuzz_tiff_SOURCES = fuzz_plugin.c 460 fuzz_tiff_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 461 -DLE_FUZZ_PLUGIN=tiff -DLE_FUZZ_ID=TIFF 462 fuzz_tiff_LDADD = $(XLIB) -ltiff 463 nodist_fuzz_tiff_SOURCES = $(PLUGIN_DIR)/tiff_extractor.c 464 endif 465 466 if HAVE_FLAC 467 FLAC_FUZZER = fuzz_flac 468 fuzz_flac_SOURCES = fuzz_plugin.c 469 fuzz_flac_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 470 -DLE_FUZZ_PLUGIN=flac -DLE_FUZZ_ID=FLAC 471 fuzz_flac_LDADD = $(XLIB) -lFLAC $(LE_LIBINTL) 472 nodist_fuzz_flac_SOURCES = $(PLUGIN_DIR)/flac_extractor.c 473 endif 474 475 if HAVE_VORBISFILE 476 OGG_FUZZER = fuzz_ogg 477 fuzz_ogg_SOURCES = fuzz_plugin.c 478 fuzz_ogg_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 479 -DLE_FUZZ_PLUGIN=ogg -DLE_FUZZ_ID=OGG 480 fuzz_ogg_LDADD = $(XLIB) -lvorbisfile -lvorbis -logg 481 nodist_fuzz_ogg_SOURCES = $(PLUGIN_DIR)/ogg_extractor.c 482 endif 483 484 if HAVE_ARCHIVE 485 ARCHIVE_FUZZER = fuzz_archive 486 fuzz_archive_SOURCES = fuzz_plugin.c 487 fuzz_archive_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 488 -DLE_FUZZ_PLUGIN=archive -DLE_FUZZ_ID=ARCHIVE 489 fuzz_archive_LDADD = $(XLIB) -larchive 490 nodist_fuzz_archive_SOURCES = $(PLUGIN_DIR)/archive_extractor.c 491 endif 492 493 if HAVE_MAGIC 494 MIME_FUZZER = fuzz_mime 495 fuzz_mime_SOURCES = fuzz_plugin.c 496 fuzz_mime_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 497 -DLE_FUZZ_PLUGIN=mime -DLE_FUZZ_ID=MIME 498 fuzz_mime_LDADD = $(XLIB) -lmagic 499 nodist_fuzz_mime_SOURCES = $(PLUGIN_DIR)/mime_extractor.c 500 endif 501 502 # The html plugin: libtidy builds the tree, but the walk over it (and, 503 # with the "fulltext" option, the charset sniffing and conversion) is 504 # ours. 505 if HAVE_MAGIC 506 if HAVE_TIDY 507 HTML_FUZZER = fuzz_html 508 fuzz_html_SOURCES = fuzz_plugin.c 509 fuzz_html_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) $(TIDY_CFLAGS) \ 510 -DLE_FUZZ_PLUGIN=html -DLE_FUZZ_ID=HTML 511 fuzz_html_LDADD = $(XLIB) -ltidy -lmagic $(LTLIBICONV) 512 nodist_fuzz_html_SOURCES = \ 513 $(PLUGIN_DIR)/html_extractor.c \ 514 $(PLUGIN_DIR)/fulltext.c 515 endif 516 endif 517 518 # The FFmpeg-based media plugins. What gets instrumented here is our own 519 # glue -- the AVIO callbacks against the fault-injecting extraction 520 # context of fuzz_ec.h, the option parser and the size arithmetic -- and 521 # not FFmpeg's demuxers, which upstream fuzzes far more thoroughly than 522 # we could. previewgst and the gstreamer plugin have no target here; 523 # thumbnailgst has one (below) for its srt/gallery glue. 524 if HAVE_FFMPEG 525 THUMBNAILFFMPEG_FUZZER = fuzz_thumbnailffmpeg 526 fuzz_thumbnailffmpeg_SOURCES = fuzz_plugin.c 527 fuzz_thumbnailffmpeg_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 528 $(FFMPEG_CFLAGS) \ 529 -DLE_FUZZ_PLUGIN=thumbnailffmpeg -DLE_FUZZ_ID=THUMBNAILFFMPEG 530 fuzz_thumbnailffmpeg_LDADD = $(XLIB) $(FFMPEG_LIBS) -lmagic 531 nodist_fuzz_thumbnailffmpeg_SOURCES = \ 532 $(PLUGIN_DIR)/thumbnailffmpeg_extractor.c \ 533 $(PLUGIN_DIR)/mediaffmpeg.c \ 534 $(PLUGIN_DIR)/mediautil.c 535 endif 536 537 # thumbnailgst, dynamically linked (GStreamer loads its elements as 538 # modules at run time anyway). GStreamer's own threads are fine for the 539 # in-process driver: every pipeline is shut down (joining its threads) 540 # before the plugin returns. A hostile file can stall GStreamer's 541 # preroll until the plugin's deadline (10s by default) runs out, and 542 # the harness may run the plugin twice per input, hence the longer 543 # watchdog. 544 if HAVE_GSTREAMER_MEDIA 545 THUMBNAILGST_FUZZER = fuzz_thumbnailgst 546 fuzz_thumbnailgst_SOURCES = fuzz_plugin.c 547 fuzz_thumbnailgst_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 548 $(GSTREAMER_CFLAGS) $(GSTREAMER_APP_CFLAGS) $(GSTREAMER_VIDEO_CFLAGS) \ 549 -DLE_FUZZ_PLUGIN=thumbnailgst -DLE_FUZZ_ID=THUMBNAILGST \ 550 -DFUZZ_DEFAULT_TIMEOUT=45 551 fuzz_thumbnailgst_LDADD = $(XLIB) $(GSTREAMER_LIBS) $(GSTREAMER_APP_LIBS) \ 552 $(GSTREAMER_VIDEO_LIBS) -lmagic -lpthread 553 nodist_fuzz_thumbnailgst_SOURCES = \ 554 $(PLUGIN_DIR)/thumbnailgst_extractor.c \ 555 $(PLUGIN_DIR)/mediagst.c \ 556 $(PLUGIN_DIR)/mediautil.c 557 endif 558 559 if HAVE_FFMPEG_AUDIO 560 PREVIEWOPUS_FUZZER = fuzz_previewopus 561 fuzz_previewopus_SOURCES = fuzz_plugin.c 562 fuzz_previewopus_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) \ 563 $(FFMPEG_CFLAGS) $(FFMPEG_SWR_CFLAGS) \ 564 -DLE_FUZZ_PLUGIN=previewopus -DLE_FUZZ_ID=PREVIEWOPUS 565 fuzz_previewopus_LDADD = $(XLIB) $(FFMPEG_LIBS) $(FFMPEG_SWR_LIBS) -lmagic 566 nodist_fuzz_previewopus_SOURCES = \ 567 $(PLUGIN_DIR)/previewopus_extractor.c \ 568 $(PLUGIN_DIR)/mediaffmpeg.c \ 569 $(PLUGIN_DIR)/mediautil.c 570 endif 571 572 if HAVE_GSF 573 OLE2_FUZZER = fuzz_ole2 574 fuzz_ole2_SOURCES = fuzz_plugin.c 575 fuzz_ole2_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) $(GSF_CFLAGS) \ 576 -DLE_FUZZ_PLUGIN=ole2 -DLE_FUZZ_ID=OLE2 577 fuzz_ole2_LDFLAGS = -static 578 fuzz_ole2_LDADD = $(LE_COMMON) $(XLIB) $(GSF_LIBS) 579 nodist_fuzz_ole2_SOURCES = $(PLUGIN_DIR)/ole2_extractor.c \ 580 $(PLUGIN_DIR)/fulltext.c 581 endif 582 583 # pdf_extractor.cc is C++, which makes automake link this one with $(CXX). 584 if HAVE_POPPLER 585 PDF_FUZZER = fuzz_pdf 586 fuzz_pdf_SOURCES = fuzz_plugin.c 587 fuzz_pdf_CPPFLAGS = $(AM_CPPFLAGS) -I$(PLUGIN_DIR) $(POPPLER_CFLAGS) \ 588 -DLE_FUZZ_PLUGIN=pdf -DLE_FUZZ_ID=PDF 589 fuzz_pdf_LDADD = $(XLIB) $(POPPLER_LIBS) -lm 590 nodist_fuzz_pdf_SOURCES = \ 591 $(PLUGIN_DIR)/pdf_extractor.cc \ 592 $(PLUGIN_DIR)/fulltext.c \ 593 $(PLUGIN_DIR)/pagelayout.c 594 endif 595 596 597 check_PROGRAMS = \ 598 $(CORE_FUZZERS) \ 599 $(UNZIP_FUZZER) \ 600 $(PLAIN_PLUGIN_FUZZERS) \ 601 $(ZLIB_PLUGIN_FUZZERS) \ 602 $(GIF_FUZZER) \ 603 $(JPEG_FUZZER) \ 604 $(TIFF_FUZZER) \ 605 $(FLAC_FUZZER) \ 606 $(OGG_FUZZER) \ 607 $(ARCHIVE_FUZZER) \ 608 $(MIME_FUZZER) \ 609 $(HTML_FUZZER) \ 610 $(OLE2_FUZZER) \ 611 $(PDF_FUZZER) \ 612 $(THUMBNAILFFMPEG_FUZZER) \ 613 $(THUMBNAILGST_FUZZER) \ 614 $(PREVIEWOPUS_FUZZER) 615 616 TESTS = $(check_PROGRAMS) 617 618 .NOTPARALLEL: 619 620 621 # Regenerate the on-disk seed corpus from the built-in one. 622 .PHONY: refresh-corpus 623 refresh-corpus: $(check_PROGRAMS) 624 for p in $(check_PROGRAMS) ; do \ 625 ./$$p --write-corpus=$(srcdir)/corpus || exit 1 ; \ 626 done 627 $(top_srcdir)/contrib/oss-fuzz/make_seed_corpus.sh \ 628 $(top_srcdir) $(srcdir)/corpus --plain 629 630 # Replay the whole on-disk corpus through every harness; this is what a 631 # CI regression run should do after a crash has been fixed. 632 # 633 # corpus/known-findings/ is listed separately because --corpus-dir does 634 # not recurse. It holds the reproducers of the findings in issues.txt; 635 # anything failing there once its patch has been applied is a regression. 636 CORPUS_DIRS = \ 637 $(srcdir)/corpus \ 638 $(srcdir)/corpus/known-findings 639 640 .PHONY: check-corpus 641 check-corpus: $(check_PROGRAMS) 642 for p in $(check_PROGRAMS) ; do \ 643 for d in $(CORPUS_DIRS) ; do \ 644 test -d $$d || continue ; \ 645 LIBEXTRACTOR_PREFIX="$(abs_top_builddir)/src/plugins/.libs" \ 646 ./$$p --corpus-dir=$$d || exit 1 ; \ 647 done ; \ 648 done