blob: 6fb4f538bd467e3ae43709e6266fd0aee6ecbd73 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
|
# Fuzz harness
libFuzzer + ASan + UBSan targets for every self-contained parser surface in
slosh. Each target compiles only its own `.c` against its header — no vendor
libraries, no libghostty-vt linking — so the build is fast and the coverage
is tight.
## Targets
| target | source | attack surface |
|-----------|-------------------|----------------------------------------|
| `kdl` | `src/kdl.c` | config and layout files |
| `jsonval` | `src/jsonval.c` | control-API JSON (MSG_CMD on the socket) |
| `expr` | `src/expr.c` | shader expression compiler + evaluator |
| `proto` | `src/proto.c` | client↔server wire framing |
| `osc5577` | `src/osc5577.c` | pane status-bar escape sequences |
| `input` | `src/input.c` | outer-terminal keyboard/mouse/paste |
## Quick start
```
cd tests/fuzz
make # build libFuzzer binaries
make run-kdl TIME=30 # fuzz one target for 30 seconds
make run-all TIME=15 # fuzz all targets, 15 seconds each
make replay # build file-replay binaries (no libFuzzer)
make corpus # replay seed corpora (CI gate, no fuzzing)
```
Crashes land in `findings/<target>/`; grown corpora stay in `corpus/<target>/`.
## Reproducing a crash
```
./replay_kdl findings/kdl/crash-abc123 # under ASan, no fuzzer runtime
gdb --args ./replay_kdl findings/kdl/crash-abc123
```
## Adding a target
1. Write `fuzz_foo.c` with `LLVMFuzzerTestOneInput`.
2. Add `foo` to `TARGETS` in the Makefile.
3. Drop seed inputs in `corpus/foo/`.
The Makefile convention is that `fuzz_foo.c` + `src/foo.c` compile together
with no other objects. If a new target needs more, add an explicit rule.
|
