mirror of
https://github.com/IfcOpenShell/IfcOpenShell.git
synced 2026-08-09 17:31:45 +00:00
Bruno Postle
a68113474b
A coverage-guided libFuzzer harness (src/ifcfuzz/ifcparse_fuzzer.cpp) that constructs IfcFile directly from in-memory input and calls toString() on every parsed instance to force full lazy attribute evaluation, rather than only observing IfcConvert's exit code from a fuzzed subprocess. Gated behind a new BUILD_FUZZERS option (OFF by default) so it has no effect on existing builds; enabling it requires a Clang toolchain built with -fsanitize=fuzzer. -fsanitize=fuzzer itself stays scoped to the one new target rather than going into the global compiler flags, since it supplies its own main() and would otherwise break every other target including CMake's own compiler checks. Already found and fixed three real bugs this way: two null-pointer dereferences (in header parsing and reference resolution) and a leak of IfcSpfLexer on early return/exception during file scanning. See src/ifcfuzz/README.md for build and usage instructions.