Line | Count | Source |
1 | | /* Copyright 2021 Google LLC |
2 | | Licensed under the Apache License, Version 2.0 (the "License"); |
3 | | you may not use this file except in compliance with the License. |
4 | | You may obtain a copy of the License at |
5 | | http://www.apache.org/licenses/LICENSE-2.0 |
6 | | Unless required by applicable law or agreed to in writing, software |
7 | | distributed under the License is distributed on an "AS IS" BASIS, |
8 | | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
9 | | See the License for the specific language governing permissions and |
10 | | limitations under the License. |
11 | | */ |
12 | | |
13 | | /* |
14 | | * We convert as.c into a header file to make convenient for fuzzing. |
15 | | * We do this for several of the binutils applications when creating |
16 | | * the binutils fuzzers. |
17 | | */ |
18 | | #include <fuzz_as.h> |
19 | | |
20 | | /* Don't allow cleanups. libiberty's function of the same name adds |
21 | | cleanups to a list without any means of clearing the list. The |
22 | | list must be clear at the start if LLVMFuzzerTestOneInput is to run |
23 | | more than once, otherwise we will get multiple copies of the same |
24 | | cleanup on the list which leads to double frees if xexit is called. |
25 | | Also a cleanup from the first run can result in use-after-free |
26 | | errors when as_fatal is hit as in issue 56429. */ |
27 | | int |
28 | | xatexit (void (*fn) (void) ATTRIBUTE_UNUSED) |
29 | 414 | { |
30 | 414 | return 0; |
31 | 414 | } |
32 | | |
33 | | int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size); |
34 | 64.1k | int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { |
35 | 64.1k | if (size > 1024) |
36 | 94 | return 0; |
37 | 64.0k | char filename[256]; |
38 | 64.0k | sprintf(filename, "/tmp/libfuzzer-%d.s", getpid()); |
39 | 64.0k | FILE *fp = fopen(filename, "wb"); |
40 | 64.0k | if (!fp) { |
41 | 0 | return 0; |
42 | 0 | } |
43 | 64.0k | fwrite(data, size, 1, fp); |
44 | 64.0k | fclose(fp); |
45 | | |
46 | 64.0k | reg_section = NULL; |
47 | | |
48 | 64.0k | char *fakeArgv[3]; |
49 | 64.0k | fakeArgv[0] = "fuzz_as"; |
50 | 64.0k | fakeArgv[1] = filename; // Assemble our fake source file. |
51 | 64.0k | fakeArgv[2] = NULL; |
52 | | |
53 | 64.0k | int argc = 2; |
54 | 64.0k | char **argv = fakeArgv; |
55 | 64.0k | gas_early_init (&argc, &argv); |
56 | | |
57 | 64.0k | out_file_name = "/tmp/tmp-out"; |
58 | | |
59 | 64.0k | gas_init (); |
60 | | |
61 | | // Main fuzzer target. Assemble our random data. |
62 | 64.0k | perform_an_assembly_pass (argc, argv); |
63 | | |
64 | | // Cleanup |
65 | 64.0k | cond_finish_check (-1); |
66 | 64.0k | codeview_finish (); |
67 | 64.0k | dwarf2_finish (); |
68 | 64.0k | cfi_finish (); |
69 | 64.0k | input_scrub_end (); |
70 | | |
71 | 64.0k | keep_it = 0; |
72 | 64.0k | output_file_close (); |
73 | 64.0k | free_notes (); |
74 | 64.0k | unlink(filename); |
75 | | |
76 | 64.0k | return 0; |
77 | 64.0k | } |