/* Distributed under the OSI-approved BSD 3-Clause License.  See accompanying

   file LICENSE.rst or https://cmake.org/licensing for details.  */

/*

 * Fuzzer for generator expression evaluation.

 *

 * cmGeneratorExpressionFuzzer only tokenizes and preprocesses $<...>, and

 * cmScriptFuzzer runs in script mode where no generator exists, so the

 * evaluator (cmGeneratorExpressionNode.cxx, the DAG checker, and the

 * transitive-property / link-interface code in cmGeneratorTarget) is never

 * reached by any fuzzer.

 *

 * Each input gets a fresh project-mode fixture: a base cmGlobalGenerator, a

 * makefile populated from a fixed listfile (interface, imported, alias,

 * object, static, executable and custom targets with genex-bearing usage

 * requirements), and generator targets created the same way as

 * "cmake --find-package" does.  C and CXX are marked enabled with

 * GNU-like compiler variables so that language- and compiler-dependent

 * expressions have something to evaluate against.  No compiler is run.

 *

 * Input layout:

 *   byte 0: bits 0-1 mode, bits 2-4 head target, bits 5-6 config,

 *           bit 7 EvaluateForBuildsystem

 *   byte 1: bits 0-2 language, bits 3-4 property, bits 5-7 current target

 *   rest:   generator expression (or property value in Injection mode)

 *

 * Modes (see Mode below):

 *   Evaluate     cmGeneratorExpression::Evaluate

 *   Compiled     Parse once, evaluate for two configs, query collected

 * metadata Interpreter  cmGeneratorExpressionInterpreter with a

 * transitive-property DAG Injection    Store the input in a usage-requirement

 * property of a fixture target, then read it back through a consumer so it is

 *                evaluated transitively

 */

#include <cstddef>

#include <cstdint>

#include <cstdio>

#include <cstdlib>

#include <map>

#include <memory>

#include <string>

#include <utility>

#include <cm/memory>

#include "cmGenExContext.h"

#include "cmGeneratorExpression.h"

#include "cmGlobalGenerator.h"

#include "cmLocalGenerator.h"

#include "cmMakefile.h"

#include "cmMessageMetadata.h"

#include "cmState.h"

#include "cmStateDirectory.h"

#include "cmStateSnapshot.h"

#include "cmSystemTools.h"

#include "cmTarget.h"

#include "cmake.h"

static constexpr size_t kHeaderSize = 2;

// Evaluation is recursive in nesting depth; keep inputs short.

static constexpr size_t kMaxExprSize = 4 * 1024;

static std::string g_srcDir;

static std::string g_binDir;

namespace {

// Stand-in for the variables project() would load after compiler detection.

char const kToolchain[] = R"cmake(

cmake_minimum_required(VERSION 4.0)

set(CMAKE_SYSTEM_NAME Linux)

set(CMAKE_SYSTEM_PROCESSOR x86_64)

set(CMAKE_BUILD_TYPE Debug)

set_property(GLOBAL PROPERTY TARGET_SUPPORTS_SHARED_LIBS TRUE)

set(CMAKE_STATIC_LIBRARY_PREFIX lib)

set(CMAKE_STATIC_LIBRARY_SUFFIX .a)

set(CMAKE_SHARED_LIBRARY_PREFIX lib)

set(CMAKE_SHARED_LIBRARY_SUFFIX .so)

set(CMAKE_SHARED_MODULE_PREFIX lib)

set(CMAKE_SHARED_MODULE_SUFFIX .so)

set(CMAKE_EXECUTABLE_SUFFIX "")

foreach(lang IN ITEMS C CXX)

  set(CMAKE_${lang}_COMPILER_ID GNU)

  set(CMAKE_${lang}_COMPILER_VERSION 13.2.0)

  set(CMAKE_${lang}_COMPILER_FRONTEND_VARIANT GNU)

  set(CMAKE_${lang}_COMPILER_LINKER_ID GNU)

  set(CMAKE_${lang}_COMPILER_LINKER_FRONTEND_VARIANT GNU)

  set(CMAKE_${lang}_OUTPUT_EXTENSION .o)

  set(CMAKE_${lang}_STANDARD_DEFAULT 17)

endforeach()

set(CMAKE_C_COMPILER /usr/bin/cc)

set(CMAKE_C_SOURCE_FILE_EXTENSIONS c m)

set(CMAKE_C_IGNORE_EXTENSIONS h H o O obj OBJ def DEF rc RC)

set(CMAKE_C_LINKER_PREFERENCE 10)

set(CMAKE_C_COMPILE_FEATURES

  c_std_90 c_std_99 c_std_11 c_std_17 c_std_23

  c_function_prototypes c_restrict c_static_assert c_variadic_macros)

set(CMAKE_CXX_COMPILER /usr/bin/c++)

set(CMAKE_CXX_SOURCE_FILE_EXTENSIONS

  C M c++ cc cpp cxx mm mpp CPP ixx cppm ccm cxxm c++m)

set(CMAKE_CXX_IGNORE_EXTENSIONS inl h hpp HPP H o O obj OBJ def DEF rc RC)

set(CMAKE_CXX_LINKER_PREFERENCE 30)

set(CMAKE_CXX_LINKER_PREFERENCE_PROPAGATES 1)

set(CMAKE_CXX_COMPILE_FEATURES

  cxx_std_98 cxx_std_11 cxx_std_14 cxx_std_17 cxx_std_20 cxx_std_23

  cxx_auto_type cxx_constexpr cxx_lambdas cxx_nullptr cxx_variadic_templates)

)cmake";

char const kProject[] = R"cmake(

cmake_minimum_required(VERSION 4.0)

add_library(fuzz_iface INTERFACE)

target_compile_definitions(fuzz_iface INTERFACE

  IFACE_DEF=1

  $<$<CONFIG:Debug>:IFACE_DEBUG>

  $<$<COMPILE_LANGUAGE:CXX>:IFACE_CXX>)

target_include_directories(fuzz_iface INTERFACE

  $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>

  $<INSTALL_INTERFACE:include>)

target_compile_options(fuzz_iface INTERFACE

  $<$<COMPILE_LANG_AND_ID:CXX,GNU,Clang>:-Wall>)

target_link_options(fuzz_iface INTERFACE

  $<$<LINK_LANGUAGE:CXX>:-Wl,--as-needed>)

target_sources(fuzz_iface INTERFACE

  FILE_SET HEADERS BASE_DIRS ${CMAKE_CURRENT_SOURCE_DIR}

  FILES ${CMAKE_CURRENT_SOURCE_DIR}/fuzz.h)

set_target_properties(fuzz_iface PROPERTIES

  INTERFACE_FUZZ_BOOL ON

  INTERFACE_FUZZ_STRING fuzz

  INTERFACE_FUZZ_NUMBER 3

  INTERFACE_FUZZ_CUSTOM "custom;$<CONFIG>"

  COMPATIBLE_INTERFACE_BOOL FUZZ_BOOL

  COMPATIBLE_INTERFACE_STRING FUZZ_STRING

  COMPATIBLE_INTERFACE_NUMBER_MAX FUZZ_NUMBER

  TRANSITIVE_COMPILE_PROPERTIES FUZZ_CUSTOM)

add_library(fuzz_dep INTERFACE)

target_link_libraries(fuzz_dep INTERFACE

  fuzz_iface

  $<LINK_ONLY:fuzz_imported_static>

  $<$<CONFIG:Release>:Fuzz::shared>)

add_library(fuzz_imported_static STATIC IMPORTED)

set_target_properties(fuzz_imported_static PROPERTIES

  IMPORTED_CONFIGURATIONS "DEBUG;RELEASE"

  IMPORTED_LOCATION_DEBUG /opt/fuzz/lib/libfuzz_d.a

  IMPORTED_LOCATION_RELEASE /opt/fuzz/lib/libfuzz.a

  MAP_IMPORTED_CONFIG_RELWITHDEBINFO Release

  IMPORTED_LINK_INTERFACE_LANGUAGES C

  INTERFACE_COMPILE_DEFINITIONS IMPORTED_STATIC)

add_library(fuzz_imported_shared SHARED IMPORTED GLOBAL)

set_target_properties(fuzz_imported_shared PROPERTIES

  IMPORTED_LOCATION /opt/fuzz/lib/libfuzz_shared.so.1.2.3

  IMPORTED_SONAME libfuzz_shared.so.1

  INTERFACE_INCLUDE_DIRECTORIES /opt/fuzz/include

  INTERFACE_LINK_LIBRARIES fuzz_imported_static)

add_library(Fuzz::shared ALIAS fuzz_imported_shared)

add_executable(fuzz_imported_exe IMPORTED)

set_property(TARGET fuzz_imported_exe PROPERTY

  IMPORTED_LOCATION /opt/fuzz/bin/fuzz_tool)

add_library(fuzz_obj OBJECT fuzz.c fuzz.cpp)

target_compile_definitions(fuzz_obj PRIVATE OBJ_DEF)

add_library(fuzz_static STATIC fuzz.c)

target_link_libraries(fuzz_static

  PUBLIC fuzz_dep

  PRIVATE fuzz_obj Fuzz::shared)

set_target_properties(fuzz_static PROPERTIES

  OUTPUT_NAME fuzzy

  OUTPUT_NAME_DEBUG fuzzy_d

  POSITION_INDEPENDENT_CODE ON

  COMPILE_DEFINITIONS "STATIC_OWN=$<CONFIG>")

add_library(Fuzz::static ALIAS fuzz_static)

add_executable(fuzz_exe fuzz.cpp)

target_link_libraries(fuzz_exe PRIVATE Fuzz::static)

set_property(TARGET fuzz_exe PROPERTY FUZZ_STRING fuzz)

add_custom_target(fuzz_custom

  COMMAND fuzz_imported_exe $<TARGET_FILE:fuzz_exe>)

set_source_files_properties(fuzz.c PROPERTIES

  COMPILE_DEFINITIONS "SRC_DEF=$<CONFIG>"

  FUZZ_SRC_PROP value)

set_property(GLOBAL PROPERTY FUZZ_GLOBAL "global;value")

set_property(DIRECTORY PROPERTY FUZZ_DIR_PROP dir)

)cmake";

char const* const kConfigs[] = { "", "Debug", "Release", "RelWithDebInfo" };

char const* const kLanguages[] = { "",        "C",   "CXX",  "CUDA",

                                   "Fortran", "HIP", "OBJC", "Swift" };

// Index 0 means "no target".

char const* const kTargets[] = {

  nullptr,        "fuzz_exe",    "fuzz_static",

  "fuzz_obj",     "fuzz_iface",  "fuzz_imported_static",

  "Fuzz::shared", "fuzz_custom",

};

char const* const kFixtureTargets[] = {

  "fuzz_exe",          "fuzz_static",          "Fuzz::static",

  "fuzz_obj",          "fuzz_iface",           "fuzz_dep",

  "fuzz_imported_exe", "fuzz_imported_static", "fuzz_imported_shared",

  "Fuzz::shared",      "fuzz_custom",

};

// Properties that generators pass to cmGeneratorExpressionInterpreter.

char const* const kInterpreterProperties[] = {

  "COMPILE_OPTIONS",

  "COMPILE_DEFINITIONS",

  "INCLUDE_DIRECTORIES",

  "COMPILE_FLAGS",

};

struct Injection

{

  char const* Target;

  char const* Property;

  // Evaluated with fuzz_exe as head so the injected value is reached

  // through the link closure.

  char const* Reader;

};

Injection const kInjections[] = {

  { "fuzz_dep", "INTERFACE_COMPILE_DEFINITIONS",

    "$<TARGET_PROPERTY:COMPILE_DEFINITIONS>" },

  { "fuzz_dep", "INTERFACE_INCLUDE_DIRECTORIES",

    "$<TARGET_PROPERTY:INCLUDE_DIRECTORIES>" },

  { "fuzz_dep", "INTERFACE_LINK_LIBRARIES",

    "$<TARGET_PROPERTY:COMPILE_OPTIONS>" },

  { "fuzz_exe", "LINK_LIBRARIES", "$<TARGET_PROPERTY:LINK_OPTIONS>" },

};

// Which evaluation entry point the input exercises (bits 0-1 of byte 0).

enum class Mode

{

  Evaluate,    // cmGeneratorExpression::Evaluate (one-shot)

  Compiled,    // Parse once, evaluate for two configs, query metadata

  Interpreter, // cmGeneratorExpressionInterpreter (generator property path)

  Injection,   // Store in a usage requirement, evaluate transitively

};

bool WriteFile(std::string const& path, char const* content)

{

  FILE* fp = fopen(path.c_str(), "wb");

  if (!fp) {

    return false;

  }

  bool const ok = fputs(content, fp) >= 0;

  fclose(fp);

  return ok;

}

struct Fixture

{

  cmake CMake{ cmState::Role::Project };

  cmGlobalGenerator* GG = nullptr;

  cmMakefile* MF = nullptr;

  cmLocalGenerator* LG = nullptr;

  bool Build(Injection const* inject, std::string const& value)

  {

    this->CMake.SetHomeDirectory(g_srcDir);

    this->CMake.SetHomeOutputDirectory(g_binDir);

    this->CMake.SetGlobalGenerator(

      cm::make_unique<cmGlobalGenerator>(&this->CMake));

    this->GG = this->CMake.GetGlobalGenerator();

    cmStateSnapshot snapshot = this->CMake.GetCurrentSnapshot();

    snapshot.GetDirectory().SetCurrentSource(g_srcDir);

    snapshot.GetDirectory().SetCurrentBinary(g_binDir);

    snapshot.SetDefaultDefinitions();

    auto mf = cm::make_unique<cmMakefile>(this->GG, snapshot);

    this->MF = mf.get();

    this->GG->AddMakefile(std::move(mf));

    if (!this->MF->ReadListFileAsString(kToolchain, "fuzz_toolchain.cmake")) {

      return false;

    }

    this->GG->SetLanguageEnabled("C", this->MF);

    this->GG->SetLanguageEnabled("CXX", this->MF);

    if (!this->MF->ReadListFileAsString(kProject, "CMakeLists.txt") ||

        cmSystemTools::GetFatalErrorOccurred()) {

      return false;

    }

    if (inject) {

      cmTarget* target = this->MF->FindLocalNonAliasTarget(inject->Target);

      if (!target) {

        return false;

      }

      target->SetProperty(inject->Property, value);

    }

    this->GG->CreateGenerationObjects();

    if (this->GG->GetLocalGenerators().empty()) {

      return false;

    }

    this->LG = this->GG->GetLocalGenerators().front().get();

    return true;

  }

  cmGeneratorTarget const* Find(char const* name) const

  {

    return name ? this->LG->FindGeneratorTargetToUse(name) : nullptr;

  }

};

} // namespace

extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv)

{

  (void)argc;

  (void)argv;

  char tmpl[] = "/tmp/cmake_fuzz_genex_eval_XXXXXX";

  char* dir = mkdtemp(tmpl);

  g_srcDir = dir ? dir : "/tmp/cmake_fuzz_genex_eval";

  g_binDir = g_srcDir + "/build";

  cmSystemTools::MakeDirectory(g_srcDir + "/include");

  cmSystemTools::MakeDirectory(g_binDir);

  WriteFile(g_srcDir + "/fuzz.c", "int fuzz_c(void) { return 0; }\n");

  WriteFile(g_srcDir + "/fuzz.cpp", "int main() { return 0; }\n");

  WriteFile(g_srcDir + "/fuzz.h", "#pragma once\n");

  // A broken fixture would make every input a no-op, so fail loudly here

  // while diagnostics are still printed.

  {

    Fixture fx;

    bool ok = fx.Build(nullptr, std::string()) &&

      !cmSystemTools::GetFatalErrorOccurred();

    for (char const* name : kFixtureTargets) {

      if (ok && !fx.Find(name)) {

        fprintf(stderr, "fixture target missing: %s\n", name);

        ok = false;

      }

    }

    if (!ok) {

      fprintf(stderr, "cmGeneratorExpressionEvalFuzzer: fixture failed\n");

      abort();

    }

  }

  cmSystemTools::ResetErrorOccurredFlag();

  cmSystemTools::SetMessageCallback(

    [](std::string const&, cmMessageMetadata const&) {});

  cmSystemTools::SetStdoutCallback([](std::string const&) {});

  cmSystemTools::SetStderrCallback([](std::string const&) {});

  return 0;

}

extern "C" int LLVMFuzzerTestOneInput(uint8_t const* data, size_t size)

{

  if (size < kHeaderSize || size > kHeaderSize + kMaxExprSize) {

    return 0;

  }

  uint8_t const sel0 = data[0];

  uint8_t const sel1 = data[1];

  Mode const mode = static_cast<Mode>(sel0 & 0x3u);

  char const* const headName = kTargets[(sel0 >> 2) & 0x7u];

  std::string const config = kConfigs[(sel0 >> 5) & 0x3u];

  std::string const otherConfig = kConfigs[((sel0 >> 5) + 1) & 0x3u];

  bool const forBuildsystem = (sel0 & 0x80u) != 0;

  std::string const language = kLanguages[sel1 & 0x7u];

  unsigned const propIndex = (sel1 >> 3) & 0x3u;

  char const* const currentName = kTargets[(sel1 >> 5) & 0x7u];

  std::string expr(reinterpret_cast<char const*>(data + kHeaderSize),

                   size - kHeaderSize);

  // The fatal-error flag is global and would stop the next fixture's

  // listfile from running.

  cmSystemTools::ResetErrorOccurredFlag();

  {

    Fixture fx;

    Injection const* inject =

      mode == Mode::Injection ? &kInjections[propIndex] : nullptr;

    if (fx.Build(inject, expr)) {

      cmGeneratorTarget const* head = fx.Find(headName);

      switch (mode) {

        case Mode::Evaluate: {

          (void)cmGeneratorExpression::Evaluate(

            std::move(expr), fx.LG, config, head, nullptr, nullptr, language);

        } break;

        case Mode::Compiled: {

          cmGeneratorExpression ge(fx.CMake);

          std::unique_ptr<cmCompiledGeneratorExpression> cge =

            ge.Parse(std::move(expr));

          cge->SetEvaluateForBuildsystem(forBuildsystem);

          cmGeneratorTarget const* current = fx.Find(currentName);

          cm::GenEx::Context ctx(fx.LG, config, language);

          (void)cge->Evaluate(ctx, nullptr, head, current);

          (void)cge->GetTargets();

          (void)cge->GetAllTargetsSeen();

          (void)cge->GetSeenTargetProperties();

          (void)cge->GetHadContextSensitiveCondition();

          (void)cge->GetHadHeadSensitiveCondition();

          (void)cge->GetHadLinkLanguageSensitiveCondition();

          (void)cge->GetSourceSensitiveTargets();

          if (head) {

            std::map<std::string, std::string> standards;

            cge->GetMaxLanguageStandard(head, standards);

          }

          cm::GenEx::Context otherCtx(fx.LG, otherConfig, language);

          (void)cge->Evaluate(otherCtx, nullptr, head, current);

        } break;

        case Mode::Interpreter: {

          if (!head) {

            head = fx.Find("fuzz_exe");

          }

          cmGeneratorExpressionInterpreter interpreter(fx.LG, config, head,

                                                       language);

          (void)interpreter.Evaluate(std::move(expr),

                                     kInterpreterProperties[propIndex]);

        } break;

        case Mode::Injection: {

          Injection const& inj = kInjections[propIndex];

          (void)cmGeneratorExpression::Evaluate(inj.Reader, fx.LG, config,

                                                fx.Find("fuzz_exe"), nullptr,

                                                nullptr, language);

          std::string direct = "$<TARGET_PROPERTY:";

          direct += inj.Target;

          direct += ',';

          direct += inj.Property;

          direct += '>';

          (void)cmGeneratorExpression::Evaluate(std::move(direct), fx.LG,

                                                config);

        } break;

      }

    }

  }

  cmSystemTools::ResetErrorOccurredFlag();

  return 0;

}