/src/binutils-gdb/binutils/fuzz_objdump.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* Copyright 2021 Google LLC |
2 | | Licensed under the Apache License, Version 2.0 (the "License"); |
3 | | you may not use this file except in compliance with the License. |
4 | | You may obtain a copy of the License at |
5 | | http://www.apache.org/licenses/LICENSE-2.0 |
6 | | Unless required by applicable law or agreed to in writing, software |
7 | | distributed under the License is distributed on an "AS IS" BASIS, |
8 | | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
9 | | See the License for the specific language governing permissions and |
10 | | limitations under the License. |
11 | | */ |
12 | | |
13 | | /* |
14 | | * We convert objdump.c into a header file to make convenient for fuzzing. |
15 | | * We do this for several of the binutils applications when creating |
16 | | * the binutils fuzzers. |
17 | | */ |
18 | | #include "fuzz_objdump.h" |
19 | | |
20 | 39.1k | void objdump_reset() { |
21 | 39.1k | process_links = true; |
22 | 39.1k | do_follow_links = true; |
23 | 39.1k | dump_section_contents = true; |
24 | 39.1k | dump_section_headers = true; |
25 | 39.1k | dump_private_headers = true; |
26 | 39.1k | dump_ar_hdrs = true; |
27 | 39.1k | dump_dwarf_section_info = true; |
28 | | // We must call both dwarf_select_sections_by_letters and dwarf_select_sections_all |
29 | | // since dwarf_select_sections_all does not set do_debug_lines |= FLAG_DEBUG_LINES_DECODED; |
30 | 39.1k | dwarf_select_sections_by_letters("L"); |
31 | 39.1k | dwarf_select_sections_all (); |
32 | 39.1k | dump_debugging = true; |
33 | | |
34 | 39.1k | dump_stab_section_info = true; |
35 | 39.1k | disassemble_all = true; |
36 | 39.1k | } |
37 | | |
38 | | int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size); |
39 | | int |
40 | | LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) |
41 | 81.2k | { |
42 | 81.2k | char filename[256]; |
43 | 81.2k | sprintf(filename, "/tmp/libfuzzer.%d", getpid()); |
44 | 81.2k | FILE *fp = fopen(filename, "wb"); |
45 | 81.2k | if (!fp) { |
46 | 0 | return 0; |
47 | 0 | } |
48 | 81.2k | fwrite(data, size, 1, fp); |
49 | 81.2k | fclose(fp); |
50 | | |
51 | 81.2k | program_name = filename; |
52 | | |
53 | 81.2k | objdump_reset(); |
54 | | |
55 | | // These flags contain a large set of calls to bfd_fatal (which calls |
56 | | // exit), so to enable fuzzing of objdump with a fuzzer that lives for |
57 | | // a longer period of time (more than 10 seconds) define |
58 | | // OBJDUMP_SAFE |
59 | 81.2k | #ifndef OBJDUMP_SAFE |
60 | 81.2k | dump_reloc_info = true; |
61 | | // ctf section and reloc are simply too quick to exit and disrupts |
62 | | // fuzzing too much. Will leave this commented out for now. |
63 | | //dump_dynamic_reloc_info = true; |
64 | | //dump_ctf_section_info = true; |
65 | 81.2k | disassemble = true; |
66 | 81.2k | #endif |
67 | | |
68 | | // Main fuzz entrypoint in objdump.c |
69 | 81.2k | display_file(filename, NULL, true); |
70 | | |
71 | 81.2k | unlink(filename); |
72 | 81.2k | return 0; |
73 | 81.2k | } |