add fuzzing

meson.build

@@ -305,6 +305,8 @@ subdir('src/pacman')
 subdir('src/util')
 subdir('scripts')
 
+subdir('src/fuzzing')
+
 # Internationalization
 if get_option('i18n')
   i18n = import('i18n')
@@ -398,6 +400,17 @@ executable(
   install : true,
 )
 
+# Note: this target must be built with clang!
+executable(
+    'fuzz_wordsplit',
+    fuzzing_sources,
+    include_directories : includes,
+    link_with : [libcommon],
+    dependencies : [],
+    c_args : ['-fsanitize=fuzzer,address', '-ggdb'],
+    link_args : ['-fsanitize=fuzzer,address', '-ggdb'],
+)
+
 foreach wrapper : script_wrappers
   cdata = configuration_data()
   cdata.set_quoted('BASH', BASH.full_path())

src/fuzzing/fuzz_util_string_length.c

@@ -0,0 +1,26 @@
+#define _XOPEN_SOURCE
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <wchar.h>
+
+#include "util.h"
+
+int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
+
+static int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+    if (Size == 0)
+        return 0;
+
+    // Prepare a null terminated string
+    char* cstring = malloc(Size+1);
+    memcpy(cstring, Data, Size);
+    cstring[Size] = 0;
+
+    string_length(cstring);
+
+    free(cstring);
+
+    return 0;
+}

src/fuzzing/fuzz_wordsplit.c

@@ -0,0 +1,28 @@
+#define _XOPEN_SOURCE
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <wchar.h>
+
+#include "util-common.h"
+
+int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
+
+int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+    if (Size == 0)
+        return 0;
+
+    // Prepare a null terminated string
+    char* cstring = malloc(Size+1);
+    memcpy(cstring, Data, Size);
+    cstring[Size] = 0;
+
+    char** ptr = wordsplit(cstring);
+    if (ptr)
+        free(ptr);
+
+    free(cstring);
+
+    return 0;
+}

src/fuzzing/meson.build

@@ -0,0 +1,3 @@
+fuzzing_sources = files('''
+  fuzz_wordsplit.c
+'''.split())

src/pacman/util.c

@@ -449,7 +449,7 @@ static char *concat_list(alpm_list_t *lst, formatfn fn)
 	return output;
 }
 
-static size_t string_length(const char *s)
+size_t string_length(const char *s)
 {
 	int len;
 	wchar_t *wcstr;

src/pacman/util.h

@@ -47,6 +47,7 @@ typedef struct _pm_target_t {
 	int is_explicit;
 } pm_target_t;
 
+size_t string_length(const char *s);
 void trans_init_error(void);
 /* flags is a bitfield of alpm_transflag_t flags */
 int trans_init(int flags, int check_valid);