mirror of
https://github.com/IfcOpenShell/IfcOpenShell.git
synced 2026-08-28 15:53:00 +00:00
Bruno Postle
8739f6c13e
A coverage-guided libFuzzer harness (src/ifcfuzz/ifcparse_fuzzer.cpp) that constructs IfcFile directly from in-memory input and calls toString() on every parsed instance to force full lazy attribute evaluation, rather than only observing IfcConvert's exit code from a fuzzed subprocess. Gated behind a new BUILD_FUZZERS option (OFF by default) so it has no effect on existing builds; enabling it requires a Clang toolchain built with -fsanitize=fuzzer. -fsanitize=fuzzer itself stays scoped to the one new target rather than going into the global compiler flags, since it supplies its own main() and would otherwise break every other target including CMake's own compiler checks. Already found and fixed three real bugs this way: two null-pointer dereferences (in header parsing and reference resolution) and a leak of IfcSpfLexer on early return/exception during file scanning. See src/ifcfuzz/README.md for build and usage instructions.
38 lines
2.4 KiB
CMake
38 lines
2.4 KiB
CMake
################################################################################
|
|
# #
|
|
# This file is part of IfcOpenShell. #
|
|
# #
|
|
# IfcOpenShell is free software: you can redistribute it and/or modify #
|
|
# it under the terms of the Lesser GNU General Public License as published by #
|
|
# the Free Software Foundation, either version 3.0 of the License, or #
|
|
# (at your option) any later version. #
|
|
# #
|
|
# IfcOpenShell is distributed in the hope that it will be useful, #
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of #
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
|
|
# Lesser GNU General Public License for more details. #
|
|
# #
|
|
# You should have received a copy of the Lesser GNU General Public License #
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>. #
|
|
# #
|
|
################################################################################
|
|
|
|
# libFuzzer harness(es) for IfcOpenShell. Only built when BUILD_FUZZERS is ON,
|
|
# which is expected to be paired with a Clang toolchain configured with
|
|
# -fsanitize=fuzzer (and typically also address,undefined) in
|
|
# CMAKE_CXX_FLAGS - this target does not add sanitizer flags itself.
|
|
|
|
include_directories("${CMAKE_SOURCE_DIR}/../src")
|
|
|
|
add_executable(ifcparse_fuzzer ifcparse_fuzzer.cpp)
|
|
target_include_directories(ifcparse_fuzzer PRIVATE "${CMAKE_SOURCE_DIR}/../src")
|
|
target_link_libraries(ifcparse_fuzzer PRIVATE IfcParse)
|
|
|
|
# -fsanitize=fuzzer supplies its own main() and libFuzzer's driver, so it
|
|
# must stay scoped to this one executable rather than going in the global
|
|
# CMAKE_CXX_FLAGS - every other target (including CMake's own compiler
|
|
# checks) would otherwise fail to link. ASan/UBSan, by contrast, are applied
|
|
# globally via CMAKE_CXX_FLAGS so that IfcParse itself is instrumented.
|
|
target_compile_options(ifcparse_fuzzer PRIVATE -fsanitize=fuzzer)
|
|
target_link_options(ifcparse_fuzzer PRIVATE -fsanitize=fuzzer)
|