Integrate Kostya's clang-proto-fuzzer with LLVM.
Summary:
The clang-proto-fuzzer models a subset of C++ as a protobuf and
uses libprotobuf-mutator to generate interesting mutations of C++
programs. Clang-proto-fuzzer has already found several bugs in
Clang (e.g., https://bugs.llvm.org/show_bug.cgi?id=33747,
https://bugs.llvm.org/show_bug.cgi?id=33749).
As with clang-fuzzer, clang-proto-fuzzer requires the following
cmake flags:
- CMAKE_C_COMPILER=clang
- CMAKE_CXX_COMPILER=clang++
- LLVM_USE_SANITIZE_COVERAGE=YES // needed for libFuzzer
- LLVM_USE_SANITIZER=Address // needed for libFuzzer
In addition, clang-proto-fuzzer requires:
- CLANG_ENABLE_PROTO_FUZZER=ON
clang-proto-fuzzer also requires the following dependencies:
- binutils // needed for libprotobuf-mutator
- liblzma-dev // needed for libprotobuf-mutator
- libz-dev // needed for libprotobuf-mutator
- docbook2x // needed for libprotobuf-mutator
- Recent version of protobuf [3.3.0 is known to work]
A working version of libprotobuf-mutator will automatically be
downloaded and built as an external project.
Implementation of clang-proto-fuzzer provided by Kostya
Serebryany.
https://bugs.llvm.org/show_bug.cgi?id=33829
Reviewers: kcc, vitalybuka, bogner
Reviewed By: kcc, vitalybuka
Subscribers: thakis, mgorny, cfe-commits
Differential Revision: https://reviews.llvm.org/D36324
llvm-svn: 310408
diff --git a/clang/tools/clang-fuzzer/ExampleClangProtoFuzzer.cpp b/clang/tools/clang-fuzzer/ExampleClangProtoFuzzer.cpp
new file mode 100644
index 0000000..2312327
--- /dev/null
+++ b/clang/tools/clang-fuzzer/ExampleClangProtoFuzzer.cpp
@@ -0,0 +1,28 @@
+//===-- ExampleClangProtoFuzzer.cpp - Fuzz Clang --------------------------===//
+//
+// The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+///
+/// \file
+/// \brief This file implements a function that runs Clang on a single
+/// input and uses libprotobuf-mutator to find new inputs. This function is
+/// then linked into the Fuzzer library.
+///
+//===----------------------------------------------------------------------===//
+
+#include "cxx_proto.pb.h"
+#include "handle-cxx/handle_cxx.h"
+#include "proto-to-cxx/proto_to_cxx.h"
+
+#include "src/libfuzzer/libfuzzer_macro.h"
+
+using namespace clang_fuzzer;
+
+DEFINE_BINARY_PROTO_FUZZER(const Function& input) {
+ auto S = FunctionToString(input);
+ HandleCXX(S, {"-O2"});
+}