fuzz: remove legacy setup for running fuzzers outside oss-fuzz

We don't need this anymore.

Differential Revision: https://phab.mercurial-scm.org/D7567

contrib/fuzz/Makefile

@@ -1,190 +1,165 b''
 CC = clang
 CXX = clang++
 
 # By default, use our own standalone_fuzz_target_runner.
 # This runner does no fuzzing, but simply executes the inputs
 # provided via parameters.
 # Run e.g. "make all LIB_FUZZING_ENGINE=/path/to/libFuzzer.a"
 # to link the fuzzer(s) against a real fuzzing engine.
 #
 # OSS-Fuzz will define its own value for LIB_FUZZING_ENGINE.
 LIB_FUZZING_ENGINE ?= standalone_fuzz_target_runner.o
 
 PYTHON_CONFIG ?= $$OUT/sanpy/bin/python-config
 
 CXXFLAGS += -Wno-deprecated-register
 
 all: standalone_fuzz_target_runner.o oss-fuzz
 
 standalone_fuzz_target_runner.o: standalone_fuzz_target_runner.cc
 
 pyutil.o: pyutil.cc pyutil.h
 	$(CXX) $(CXXFLAGS) -g -O1 \
 	  `$(PYTHON_CONFIG) --cflags` \
 	  -I../../mercurial -c -o pyutil.o pyutil.cc
 
-bdiff.o: ../../mercurial/bdiff.c
-	$(CC) $(CFLAGS) -fsanitize=fuzzer-no-link,address -c -o bdiff.o \
-	  ../../mercurial/bdiff.c
-
-bdiff: bdiff.cc bdiff.o 
-	$(CXX) $(CXXFLAGS) -DHG_FUZZER_INCLUDE_MAIN=1 -g -O1 -fsanitize=fuzzer-no-link,address \
-	  -std=c++17 \
-	  -I../../mercurial bdiff.cc bdiff.o -o bdiff
-
 bdiff-oss-fuzz.o: ../../mercurial/bdiff.c
 	$(CC) $(CFLAGS) -c -o bdiff-oss-fuzz.o ../../mercurial/bdiff.c
 
 bdiff_fuzzer: bdiff.cc bdiff-oss-fuzz.o
 	$(CXX) $(CXXFLAGS) -std=c++17 -I../../mercurial bdiff.cc \
 	  bdiff-oss-fuzz.o $(LIB_FUZZING_ENGINE) -o \
 	  $$OUT/bdiff_fuzzer
 
 mpatch.o: ../../mercurial/mpatch.c
 	$(CC) -g -O1 -fsanitize=fuzzer-no-link,address -c -o mpatch.o \
 	  ../../mercurial/mpatch.c
 
-mpatch: CXXFLAGS += -std=c++17
-mpatch: mpatch.cc mpatch.o
-	$(CXX) $(CXXFLAGS) -DHG_FUZZER_INCLUDE_MAIN=1 -g -O1 -fsanitize=fuzzer-no-link,address \
-	  -I../../mercurial mpatch.cc mpatch.o -o mpatch
-
 mpatch-oss-fuzz.o: ../../mercurial/mpatch.c
 	$(CC) $(CFLAGS) -c -o mpatch-oss-fuzz.o ../../mercurial/mpatch.c
 
 mpatch_fuzzer: mpatch.cc mpatch-oss-fuzz.o 
 	$(CXX) $(CXXFLAGS) -std=c++17 -I../../mercurial mpatch.cc \
 	  mpatch-oss-fuzz.o $(LIB_FUZZING_ENGINE) -o \
 	  $$OUT/mpatch_fuzzer
 
 mpatch_corpus.zip:
 	python mpatch_corpus.py $$OUT/mpatch_fuzzer_seed_corpus.zip
 
-x%.o: ../../mercurial/thirdparty/xdiff/x%.c ../../mercurial/thirdparty/xdiff/*.h
-	$(CC) -g -O1 -fsanitize=fuzzer-no-link,address -c \
-	  -o $@ \
-	  $<
-
-xdiff: CXXFLAGS += -std=c++17
-xdiff: xdiff.cc xdiffi.o xprepare.o xutils.o 
-	$(CXX) $(CXXFLAGS) -DHG_FUZZER_INCLUDE_MAIN=1 -g -O1 -fsanitize=fuzzer-no-link,address \
-	  -I../../mercurial xdiff.cc \
-	  xdiffi.o xprepare.o xutils.o -o xdiff
-
 fuzz-x%.o: ../../mercurial/thirdparty/xdiff/x%.c ../../mercurial/thirdparty/xdiff/*.h
 	$(CC) $(CFLAGS) -c \
 	  -o $@ \
 	  $<
 
 xdiff_fuzzer: xdiff.cc fuzz-xdiffi.o fuzz-xprepare.o fuzz-xutils.o 
 	$(CXX) $(CXXFLAGS) -std=c++17 -I../../mercurial xdiff.cc \
 	  fuzz-xdiffi.o fuzz-xprepare.o fuzz-xutils.o \
 	  $(LIB_FUZZING_ENGINE) -o $$OUT/xdiff_fuzzer
 
 manifest.o: ../../mercurial/cext/manifest.c
 	$(CC) $(CFLAGS) `$(PYTHON_CONFIG) --cflags` \
 	  -I../../mercurial \
 	  -c -o manifest.o ../../mercurial/cext/manifest.c
 
 charencode.o: ../../mercurial/cext/charencode.c
 	$(CC) $(CFLAGS) `$(PYTHON_CONFIG) --cflags` \
 	  -I../../mercurial \
 	  -c -o charencode.o ../../mercurial/cext/charencode.c
 
 parsers.o: ../../mercurial/cext/parsers.c
 	$(CC) $(CFLAGS) `$(PYTHON_CONFIG) --cflags` \
 	  -I../../mercurial \
 	  -c -o parsers.o ../../mercurial/cext/parsers.c
 
 dirs.o: ../../mercurial/cext/dirs.c
 	$(CC) $(CFLAGS) `$(PYTHON_CONFIG) --cflags` \
 	  -I../../mercurial \
 	  -c -o dirs.o ../../mercurial/cext/dirs.c
 
 pathencode.o: ../../mercurial/cext/pathencode.c
 	$(CC) $(CFLAGS) `$(PYTHON_CONFIG) --cflags` \
 	  -I../../mercurial \
 	  -c -o pathencode.o ../../mercurial/cext/pathencode.c
 
 revlog.o: ../../mercurial/cext/revlog.c
 	$(CC) $(CFLAGS) `$(PYTHON_CONFIG) --cflags` \
 	  -I../../mercurial \
 	  -c -o revlog.o ../../mercurial/cext/revlog.c
 
 dirs_fuzzer: dirs.cc manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o
 	$(CXX) $(CXXFLAGS) `$(PYTHON_CONFIG) --cflags` \
 	  -Wno-register -Wno-macro-redefined \
 	  -I../../mercurial dirs.cc \
 	  manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o \
 	  $(LIB_FUZZING_ENGINE) `$(PYTHON_CONFIG) --ldflags` \
 	  -o $$OUT/dirs_fuzzer
 
 fncache_fuzzer: fncache.cc manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o
 	$(CXX) $(CXXFLAGS) `$(PYTHON_CONFIG) --cflags` \
 	  -Wno-register -Wno-macro-redefined \
 	  -I../../mercurial fncache.cc \
 	  manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o \
 	  $(LIB_FUZZING_ENGINE) `$(PYTHON_CONFIG) --ldflags` \
 	  -o $$OUT/fncache_fuzzer
 
 jsonescapeu8fast_fuzzer: jsonescapeu8fast.cc manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o
 	$(CXX) $(CXXFLAGS) `$(PYTHON_CONFIG) --cflags` \
 	  -Wno-register -Wno-macro-redefined \
 	  -I../../mercurial jsonescapeu8fast.cc \
 	  manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o \
 	  $(LIB_FUZZING_ENGINE) `$(PYTHON_CONFIG) --ldflags` \
 	  -o $$OUT/jsonescapeu8fast_fuzzer
 
 manifest_corpus.zip:
 	python manifest_corpus.py $$OUT/manifest_fuzzer_seed_corpus.zip
 
 manifest_fuzzer: manifest.cc manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o
 	$(CXX) $(CXXFLAGS) `$(PYTHON_CONFIG) --cflags` \
 	  -Wno-register -Wno-macro-redefined \
 	  -I../../mercurial manifest.cc \
 	  manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o \
 	  $(LIB_FUZZING_ENGINE) `$(PYTHON_CONFIG) --ldflags` \
 	  -o $$OUT/manifest_fuzzer
 
 revlog_fuzzer: revlog.cc manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o
 	$(CXX) $(CXXFLAGS) `$(PYTHON_CONFIG) --cflags` \
 	  -Wno-register -Wno-macro-redefined \
 	  -I../../mercurial revlog.cc \
 	  manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o \
 	  $(LIB_FUZZING_ENGINE) `$(PYTHON_CONFIG) --ldflags` \
 	  -o $$OUT/revlog_fuzzer
 
 revlog_corpus.zip:
 	python revlog_corpus.py $$OUT/revlog_fuzzer_seed_corpus.zip
 
 dirstate_fuzzer: dirstate.cc manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o
 	$(CXX) $(CXXFLAGS) `$(PYTHON_CONFIG) --cflags` \
 	  -Wno-register -Wno-macro-redefined \
 	  -I../../mercurial dirstate.cc \
 	  manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o \
 	  $(LIB_FUZZING_ENGINE) `$(PYTHON_CONFIG) --ldflags` \
 	  -o $$OUT/dirstate_fuzzer
 
 dirstate_corpus.zip:
 	python dirstate_corpus.py $$OUT/dirstate_fuzzer_seed_corpus.zip
 
 fm1readmarkers_fuzzer: fm1readmarkers.cc manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o
 	$(CXX) $(CXXFLAGS) `$(PYTHON_CONFIG) --cflags` \
 	  -Wno-register -Wno-macro-redefined \
 	  -I../../mercurial fm1readmarkers.cc \
 	  manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o \
 	  $(LIB_FUZZING_ENGINE) `$(PYTHON_CONFIG) --ldflags` \
 	  -o $$OUT/fm1readmarkers_fuzzer
 
 fm1readmarkers_corpus.zip:
 	python fm1readmarkers_corpus.py $$OUT/fm1readmarkers_fuzzer_seed_corpus.zip
 
 clean:
 	$(RM) *.o *_fuzzer \
 	  bdiff \
 	  mpatch \
 	  xdiff
 
 oss-fuzz: bdiff_fuzzer mpatch_fuzzer mpatch_corpus.zip xdiff_fuzzer dirs_fuzzer fncache_fuzzer jsonescapeu8fast_fuzzer manifest_fuzzer manifest_corpus.zip revlog_fuzzer revlog_corpus.zip dirstate_fuzzer dirstate_corpus.zip fm1readmarkers_fuzzer fm1readmarkers_corpus.zip
 
 .PHONY: all clean oss-fuzz

contrib/fuzz/bdiff.cc

@@ -1,47 +1,39 b''
 /*
  * bdiff.cc - fuzzer harness for bdiff.c
  *
  * Copyright 2018, Google Inc.
  *
  * This software may be used and distributed according to the terms of
  * the GNU General Public License, incorporated herein by reference.
  */
 #include <memory>
 #include <stdlib.h>
 
 #include "FuzzedDataProvider.h"
 
 extern "C" {
 #include "bdiff.h"
 
 extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv)
 {
 	return 0;
 }
 
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
 {
 	FuzzedDataProvider provider(Data, Size);
 	std::string left = provider.ConsumeRandomLengthString(Size);
 	std::string right = provider.ConsumeRemainingBytesAsString();
 
 	struct bdiff_line *a, *b;
 	int an = bdiff_splitlines(left.c_str(), left.size(), &a);
 	int bn = bdiff_splitlines(right.c_str(), right.size(), &b);
 	struct bdiff_hunk l;
 	bdiff_diff(a, an, b, bn, &l);
 	free(a);
 	free(b);
 	bdiff_freehunks(l.next);
 	return 0; // Non-zero return values are reserved for future use.
 }
 
-#ifdef HG_FUZZER_INCLUDE_MAIN
-int main(int argc, char **argv)
-{
-	const char data[] = "asdf";
-	return LLVMFuzzerTestOneInput((const uint8_t *)data, 4);
-}
-#endif
-
 } // extern "C"

contrib/fuzz/mpatch.cc

@@ -1,127 +1,114 b''
 /*
  * mpatch.cc - fuzzer harness for mpatch.c
  *
  * Copyright 2018, Google Inc.
  *
  * This software may be used and distributed according to the terms of
  * the GNU General Public License, incorporated herein by reference.
  */
 #include <iostream>
 #include <memory>
 #include <stdint.h>
 #include <stdlib.h>
 #include <vector>
 
 #include "fuzzutil.h"
 
 extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv)
 {
 	return 0;
 }
 
 // To avoid having too many OOMs from the fuzzer infrastructure, we'll
 // skip patch application if the resulting fulltext would be bigger
 // than 10MiB.
 #define MAX_OUTPUT_SIZE 10485760
 
 extern "C" {
 #include "bitmanipulation.h"
 #include "mpatch.h"
 
 struct mpatchbin {
 	std::unique_ptr<char[]> data;
 	size_t len;
 };
 
 static mpatch_flist *getitem(void *vbins, ssize_t pos)
 {
 	std::vector<mpatchbin> *bins = (std::vector<mpatchbin> *)vbins;
 	const mpatchbin &bin = bins->at(pos + 1);
 	struct mpatch_flist *res;
 	LOG(2) << "mpatch_decode " << bin.len << std::endl;
 	if (mpatch_decode(bin.data.get(), bin.len, &res) < 0)
 		return NULL;
 	return res;
 }
 
 // input format:
 // u8 number of inputs
 // one u16 for each input, its length
 // the inputs
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
 {
 	if (!Size) {
 		return 0;
 	}
 	// First byte of data is how many texts we expect, first text
 	// being the base the rest being the deltas.
 	ssize_t numtexts = Data[0];
 	if (numtexts < 2) {
 		// No point if we don't have at least a base text and a delta...
 		return 0;
 	}
 	// Each text will be described by a byte for how long it
 	// should be, so give up if we don't have enough.
 	if ((Size - 1) < (numtexts * 2)) {
 		return 0;
 	}
 	size_t consumed = 1 + (numtexts * 2);
 	LOG(2) << "input contains " << Size << std::endl;
 	LOG(2) << numtexts << " texts, consuming " << consumed << std::endl;
 	std::vector<mpatchbin> bins;
 	bins.reserve(numtexts);
 	for (int i = 0; i < numtexts; ++i) {
 		mpatchbin bin;
 		size_t nthsize = getbeuint16((char *)Data + 1 + (2 * i));
 		LOG(2) << "text " << i << " is " << nthsize << std::endl;
 		char *start = (char *)Data + consumed;
 		consumed += nthsize;
 		if (consumed > Size) {
 			LOG(2) << "ran out of data, consumed " << consumed
 			       << " of " << Size << std::endl;
 			return 0;
 		}
 		bin.len = nthsize;
 		bin.data.reset(new char[nthsize]);
 		memcpy(bin.data.get(), start, nthsize);
 		bins.push_back(std::move(bin));
 	}
 	LOG(2) << "mpatch_flist" << std::endl;
 	struct mpatch_flist *patch =
 	    mpatch_fold(&bins, getitem, 0, numtexts - 1);
 	if (!patch) {
 		return 0;
 	}
 	LOG(2) << "mpatch_calcsize" << std::endl;
 	ssize_t outlen = mpatch_calcsize(bins[0].len, patch);
 	LOG(2) << "outlen " << outlen << std::endl;
 	if (outlen < 0 || outlen > MAX_OUTPUT_SIZE) {
 		goto cleanup;
 	}
 	{
 		char *dest = (char *)malloc(outlen);
 		LOG(2) << "expecting " << outlen << " total bytes at "
 		       << (void *)dest << std::endl;
 		mpatch_apply(dest, bins[0].data.get(), bins[0].len, patch);
 		free(dest);
 		LOG(1) << "applied a complete patch" << std::endl;
 	}
 cleanup:
 	mpatch_lfree(patch);
 	return 0;
 }
 
-#ifdef HG_FUZZER_INCLUDE_MAIN
-int main(int argc, char **argv)
-{
-	// One text, one patch.
-	const char data[] = "\x02\x00\0x1\x00\x0d"
-	                    // base text
-	                    "a"
-	                    // binary delta that will append a single b
-	                    "\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x01b";
-	return LLVMFuzzerTestOneInput((const uint8_t *)data, 19);
-}
-#endif
-
 } // extern "C"

contrib/fuzz/xdiff.cc

@@ -1,66 +1,58 b''
 /*
  * xdiff.cc - fuzzer harness for thirdparty/xdiff
  *
  * Copyright 2018, Google Inc.
  *
  * This software may be used and distributed according to the terms of
  * the GNU General Public License, incorporated herein by reference.
  */
 #include "thirdparty/xdiff/xdiff.h"
 #include <inttypes.h>
 #include <stdlib.h>
 
 #include "FuzzedDataProvider.h"
 
 extern "C" {
 
 int LLVMFuzzerInitialize(int *argc, char ***argv)
 {
 	return 0;
 }
 
 int hunk_consumer(long a1, long a2, long b1, long b2, void *priv)
 {
 	// TODO: probably also test returning -1 from this when things break?
 	return 0;
 }
 
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
 {
 	// Don't allow fuzzer inputs larger than 100k, since we'll just bog
 	// down and not accomplish much.
 	if (Size > 100000) {
 		return 0;
 	}
 	FuzzedDataProvider provider(Data, Size);
 	std::string left = provider.ConsumeRandomLengthString(Size);
 	std::string right = provider.ConsumeRemainingBytesAsString();
 	mmfile_t a, b;
 
 	a.ptr = (char *)left.c_str();
 	a.size = left.size();
 	b.ptr = (char *)right.c_str();
 	b.size = right.size();
 	xpparam_t xpp = {
 	    XDF_INDENT_HEURISTIC, /* flags */
 	};
 	xdemitconf_t xecfg = {
 	    XDL_EMIT_BDIFFHUNK, /* flags */
 	    hunk_consumer,      /* hunk_consume_func */
 	};
 	xdemitcb_t ecb = {
 	    NULL, /* priv */
 	};
 	xdl_diff(&a, &b, &xpp, &xecfg, &ecb);
 	return 0; // Non-zero return values are reserved for future use.
 }
 
-#ifdef HG_FUZZER_INCLUDE_MAIN
-int main(int argc, char **argv)
-{
-	const char data[] = "asdf";
-	return LLVMFuzzerTestOneInput((const uint8_t *)data, 4);
-}
-#endif
-
 } // extern "C"