1#!/bin/bash -eu 2# Copyright 2016 Google Inc. 3# 4# Licensed under the Apache License, Version 2.0 (the "License"); 5# you may not use this file except in compliance with the License. 6# You may obtain a copy of the License at 7# 8# http://www.apache.org/licenses/LICENSE-2.0 9# 10# Unless required by applicable law or agreed to in writing, software 11# distributed under the License is distributed on an "AS IS" BASIS, 12# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13# See the License for the specific language governing permissions and 14# limitations under the License. 15# 16################################################################################ 17 18echo "---------------------------------------------------------------" 19 20if [ "$SANITIZER" = "dataflow" ] && [ "$FUZZING_ENGINE" != "dataflow" ]; then 21 echo "ERROR: 'dataflow' sanitizer can be used with 'dataflow' engine only." 22 exit 1 23fi 24 25if [ "$FUZZING_LANGUAGE" = "jvm" ]; then 26 if [ "$FUZZING_ENGINE" != "libfuzzer" ]; then 27 echo "ERROR: JVM projects can be fuzzed with libFuzzer engine only." 28 exit 1 29 fi 30 if [ "$SANITIZER" != "address" ]; then 31 echo "ERROR: JVM projects can be fuzzed with AddressSanitizer only." 32 exit 1 33 fi 34 if [ "$ARCHITECTURE" != "x86_64" ]; then 35 echo "ERROR: JVM projects can be fuzzed on x86_64 architecture only." 36 exit 1 37 fi 38fi 39 40if [ "$FUZZING_LANGUAGE" = "python" ]; then 41 if [ "$FUZZING_ENGINE" != "libfuzzer" ]; then 42 echo "ERROR: Python projects can be fuzzed with libFuzzer engine only." 43 exit 1 44 fi 45 if [ "$SANITIZER" != "address" ] && [ "$SANITIZER" != "undefined" ]; then 46 echo "ERROR: Python projects can be fuzzed with AddressSanitizer and UndefinedBehaviorSanitizer only." 47 exit 1 48 fi 49 if [ "$ARCHITECTURE" != "x86_64" ]; then 50 echo "ERROR: Python projects can be fuzzed on x86_64 architecture only." 51 exit 1 52 fi 53fi 54 55if [ -z "${SANITIZER_FLAGS-}" ]; then 56 FLAGS_VAR="SANITIZER_FLAGS_${SANITIZER}" 57 export SANITIZER_FLAGS=${!FLAGS_VAR-} 58fi 59 60if [[ $ARCHITECTURE == "i386" ]]; then 61 export CFLAGS="-m32 $CFLAGS" 62 cp -R /usr/i386/lib/* /usr/lib 63fi 64# JVM projects are fuzzed with Jazzer, which has libFuzzer built in. 65if [[ $FUZZING_ENGINE != "none" ]] && [[ $FUZZING_LANGUAGE != "jvm" ]]; then 66 # compile script might override environment, use . to call it. 67 . compile_${FUZZING_ENGINE} 68fi 69 70if [[ $SANITIZER_FLAGS = *sanitize=memory* ]] 71then 72 # Take all libraries from lib/msan and MSAN_LIBS_PATH 73 # export CXXFLAGS_EXTRA="-L/usr/msan/lib $CXXFLAGS_EXTRA" 74 cp -R /usr/msan/lib/* /usr/lib/ 75 76 if [[ -z "${MSAN_LIBS_PATH-}" ]]; then 77 echo 'WARNING: Building without MSan instrumented libraries.' 78 else 79 # Copy all static libraries only. Don't include .so files because they can 80 # break non MSan compiled programs. 81 (cd "$MSAN_LIBS_PATH" && find . -name '*.a' -exec cp --parents '{}' / ';') 82 fi 83fi 84 85# Coverage flag overrides. 86COVERAGE_FLAGS_VAR="COVERAGE_FLAGS_${SANITIZER}" 87if [[ -n ${!COVERAGE_FLAGS_VAR+x} ]] 88then 89 export COVERAGE_FLAGS="${!COVERAGE_FLAGS_VAR}" 90fi 91 92 # Don't need coverage instrumentation for engine-less, afl++ builds. 93if [ $FUZZING_ENGINE = "none" ] || [ $FUZZING_ENGINE = "afl" ]; then 94 export COVERAGE_FLAGS= 95fi 96 97# Rust does not support sanitizers and coverage flags via CFLAGS/CXXFLAGS, so 98# use RUSTFLAGS. 99# FIXME: Support code coverage once support is in. 100# See https://github.com/rust-lang/rust/issues/34701. 101if [ "$SANITIZER" != "undefined" ] && [ "$SANITIZER" != "coverage" ] && [ "$ARCHITECTURE" != 'i386' ]; then 102 export RUSTFLAGS="--cfg fuzzing -Zsanitizer=${SANITIZER} -Cdebuginfo=1 -Cforce-frame-pointers" 103else 104 export RUSTFLAGS="--cfg fuzzing -Cdebuginfo=1 -Cforce-frame-pointers" 105fi 106if [ "$SANITIZER" = "coverage" ] 107then 108 # link to C++ from comment in f5098035eb1a14aa966c8651d88ea3d64323823d 109 export RUSTFLAGS="$RUSTFLAGS -Zinstrument-coverage -C link-arg=-lc++" 110fi 111 112# Add Rust libfuzzer flags. 113# See https://github.com/rust-fuzz/libfuzzer/blob/master/build.rs#L12. 114export CUSTOM_LIBFUZZER_PATH="$LIB_FUZZING_ENGINE_DEPRECATED" 115export CUSTOM_LIBFUZZER_STD_CXX=c++ 116 117export CFLAGS="$CFLAGS $SANITIZER_FLAGS $COVERAGE_FLAGS" 118export CXXFLAGS="$CFLAGS $CXXFLAGS_EXTRA" 119 120if [ "$FUZZING_LANGUAGE" = "python" ]; then 121 sanitizer_with_fuzzer_lib_dir=`python3 -c "import atheris; import os; print(os.path.dirname(atheris.path()))"` 122 sanitizer_with_fuzzer_output_lib=$OUT/sanitizer_with_fuzzer.so 123 if [ "$SANITIZER" = "address" ]; then 124 cp $sanitizer_with_fuzzer_lib_dir/asan_with_fuzzer.so $sanitizer_with_fuzzer_output_lib 125 elif [ "$SANITIZER" = "undefined" ]; then 126 cp $sanitizer_with_fuzzer_lib_dir/ubsan_with_fuzzer.so $sanitizer_with_fuzzer_output_lib 127 fi 128 129 # Disable leak checking as it is unsupported. 130 export CFLAGS="$CFLAGS -fno-sanitize=function,leak,vptr," 131 export CXXFLAGS="$CXXFLAGS -fno-sanitize=function,leak,vptr" 132fi 133 134# Copy latest llvm-symbolizer in $OUT for stack symbolization. 135cp $(which llvm-symbolizer) $OUT/ 136 137# Copy Jazzer to $OUT if needed. 138if [ "$FUZZING_LANGUAGE" = "jvm" ]; then 139 cp $(which jazzer_agent_deploy.jar) $(which jazzer_driver) $(which jazzer_driver_asan) $OUT/ 140fi 141 142echo "---------------------------------------------------------------" 143echo "CC=$CC" 144echo "CXX=$CXX" 145echo "CFLAGS=$CFLAGS" 146echo "CXXFLAGS=$CXXFLAGS" 147echo "---------------------------------------------------------------" 148 149BUILD_CMD="bash -eux $SRC/build.sh" 150 151# We need to preserve source code files for generating a code coverage report. 152# We need exact files that were compiled, so copy both $SRC and $WORK dirs. 153COPY_SOURCES_CMD="cp -rL --parents $SRC $WORK /usr/include /usr/local/include $GOPATH $OSSFUZZ_RUSTPATH $OUT" 154 155if [ "${BUILD_UID-0}" -ne "0" ]; then 156 adduser -u $BUILD_UID --disabled-password --gecos '' builder 157 chown -R builder $SRC $OUT $WORK 158 su -c "$BUILD_CMD" builder 159 if [ "$SANITIZER" = "coverage" ]; then 160 # Some directories have broken symlinks (e.g. honggfuzz), ignore the errors. 161 su -c "$COPY_SOURCES_CMD" builder 2>/dev/null || true 162 fi 163else 164 $BUILD_CMD 165 if [ "$SANITIZER" = "coverage" ]; then 166 # Some directories have broken symlinks (e.g. honggfuzz), ignore the errors. 167 $COPY_SOURCES_CMD 2>/dev/null || true 168 fi 169fi 170 171if [[ "$FUZZING_ENGINE" = "dataflow" ]]; then 172 # Remove seed corpus as it can be huge but is not needed for a dataflow build. 173 rm -f $OUT/*.zip 174fi 175