1#!/bin/bash -eu 2# Copyright 2019 Google Inc. 3# 4# Licensed under the Apache License, Version 2.0 (the "License"); 5# you may not use this file except in compliance with the License. 6# You may obtain a copy of the License at 7# 8# http://www.apache.org/licenses/LICENSE-2.0 9# 10# Unless required by applicable law or agreed to in writing, software 11# distributed under the License is distributed on an "AS IS" BASIS, 12# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13# See the License for the specific language governing permissions and 14# limitations under the License. 15# 16################################################################################ 17 18# Case-sensitive names of internal Firefox fuzzing targets. Edit to add more. 19FUZZ_TARGETS=( 20 # WebRTC 21 SdpParser 22 StunParser 23 # IPC 24 ContentParentIPC 25 CompositorManagerParentIPC 26 ContentSecurityPolicyParser 27 # Image 28 ImageGIF 29 ImageICO 30 ImageBMP 31 # Demuxing 32 MediaADTS 33 MediaFlac 34 MediaMP3 35 MediaOgg 36 MediaWebM 37 # MediaWAV disabled due to frequent OOMs 38) 39 40# Firefox object (build) directory and configuration file. 41export MOZ_OBJDIR=$WORK/obj-fuzz 42export MOZCONFIG=$SRC/mozconfig.$SANITIZER 43 44# Install dependencies. Note that bootstrap installs cargo, which must be added 45# to PATH via source. In a successive run (for a different sanitizer), the 46# cargo installation carries over, but bootstrap fails if cargo is not in PATH. 47export SHELL=/bin/bash 48[[ -f "$HOME/.cargo/env" ]] && source $HOME/.cargo/env 49./mach bootstrap --no-interactive --application-choice browser 50source $HOME/.cargo/env 51 52# Update internal libFuzzer. 53(cd tools/fuzzing/libfuzzer && ./clone_libfuzzer.sh HEAD) 54 55# Build! 56./mach build 57./mach gtest buildbutdontrun 58 59# Packages Firefox only to immediately extract the archive. Some files are 60# replaced with gtest-variants, which is required by the fuzzing interface. 61# Weighs in shy of 1GB afterwards. About double for coverage builds. 62./mach package 63tar -xf $MOZ_OBJDIR/dist/firefox*bz2 -C $OUT 64cp -L $MOZ_OBJDIR/dist/bin/gtest/libxul.so $OUT/firefox 65cp $OUT/firefox/dependentlibs.list $OUT/firefox/dependentlibs.list.gtest 66 67# Get absolute paths of the required system libraries. 68LIBRARIES=$({ 69 xargs -I{} ldd $OUT/firefox/{} | gawk '/=> [/]/ {print $3}' | sort -u 70} < $OUT/firefox/dependentlibs.list) 71 72# Copy libraries. Less than 50MB total. 73mkdir -p $OUT/lib 74for LIBRARY in $LIBRARIES; do cp -L $LIBRARY $OUT/lib; done 75 76# Build a wrapper binary for each target to set environment variables. 77for FUZZ_TARGET in ${FUZZ_TARGETS[@]} 78do 79 $CC $CFLAGS -O0 \ 80 -DFUZZ_TARGET=$FUZZ_TARGET \ 81 $SRC/target.c -o $OUT/$FUZZ_TARGET 82done 83 84cp $SRC/*.options $OUT 85 86# SdpParser 87find media/webrtc -iname "*.sdp" \ 88 -type f -exec zip -qu $OUT/SdpParser_seed_corpus.zip "{}" \; 89cp $SRC/fuzzdata/dicts/sdp.dict $OUT/SdpParser.dict 90 91# StunParser 92find media/webrtc -iname "*.stun" \ 93 -type f -exec zip -qu $OUT/StunParser_seed_corpus.zip "{}" \; 94cp $SRC/fuzzdata/dicts/stun.dict $OUT/StunParser.dict 95 96# ContentParentIPC 97cp $SRC/fuzzdata/settings/ipc/libfuzzer.content.blacklist.txt $OUT/firefox 98 99# ImageGIF 100zip -rj $OUT/ImageGIF_seed_corpus.zip $SRC/fuzzdata/samples/gif 101cp $SRC/fuzzdata/dicts/gif.dict $OUT/ImageGIF.dict 102 103# ImageICO 104zip -rj $OUT/ImageICO_seed_corpus.zip $SRC/fuzzdata/samples/ico 105 106# ImageBMP 107zip -rj $OUT/ImageBMP_seed_corpus.zip $SRC/fuzzdata/samples/bmp 108 109# MediaADTS 110zip -rj $OUT/MediaADTS_seed_corpus.zip $SRC/fuzzdata/samples/aac 111 112# MediaFlac 113zip -rj $OUT/MediaFlac_seed_corpus.zip $SRC/fuzzdata/samples/flac 114 115# MediaMP3 116zip -rj $OUT/MediaMP3_seed_corpus.zip $SRC/fuzzdata/samples/mp3 117 118# MediaOgg 119zip -rj $OUT/MediaOgg_seed_corpus.zip $SRC/fuzzdata/samples/ogg 120 121# MediaWebM 122zip -rj $OUT/MediaWebM_seed_corpus.zip $SRC/fuzzdata/samples/webm 123 124# MediaWAV 125# zip -rj $OUT/MediaWAV_seed_corpus.zip $SRC/fuzzdata/samples/wav 126