Add libFuzzer targets

.github/workflows/build.yml

@@ -114,3 +114,41 @@ jobs:
     - name: build
       run: cmake --build "${{ env.CMAKE_BUILD_DIR }}" --config Release
 
+  fuzz:
+    runs-on: ubuntu-latest
+    env:
+      CMAKE_BUILD_DIR: ${{ github.workspace }}/build-fuzz
+      CMAKE_GENERATOR: "Ninja"
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: dependencies
+      run: |
+        sudo apt-get install -y nasm ninja-build
+
+    - name: Restore cache
+      uses: actions/cache@v4
+      with:
+        path: |
+            ${{ env.CMAKE_BUILD_DIR }}/vcpkg_installed
+        key: fuzz-${{ hashFiles( '**/vcpkg.json' ) }}
+
+    - name: configure
+      run: cmake -B "${{ env.CMAKE_BUILD_DIR }}"
+                 -DFUZZING=ON
+                 -DSANITIZERS=ON
+                 -DCMAKE_CXX_COMPILER=clang++
+                 -DCMAKE_C_COMPILER=clang
+                 -DCMAKE_TOOLCHAIN_FILE="$VCPKG_INSTALLATION_ROOT/scripts/buildsystems/vcpkg.cmake"
+                 -DCRYPTO="BORINGSSL"
+                 -DVCPKG_MANIFEST_DIR="alternatives/BORINGSSL"
+
+    - name: build
+      run: cmake --build "${{ env.CMAKE_BUILD_DIR }}"
+
+    - name: run fuzz_header
+      run: ${{ env.CMAKE_BUILD_DIR }}/fuzz/fuzz_header -max_total_time=60
+
+    - name: run fuzz_unprotect
+      run: ${{ env.CMAKE_BUILD_DIR }}/fuzz/fuzz_unprotect -max_total_time=60

CMakeLists.txt

@@ -123,3 +123,11 @@ if(TESTING)
   enable_testing()
   add_subdirectory(test)
 endif()
+
+###
+### Fuzzers
+###
+option(FUZZING "Build fuzz targets" OFF)
+if(FUZZING)
+  add_subdirectory(fuzz)
+endif()

fuzz/CMakeLists.txt

@@ -0,0 +1,9 @@
+set(FUZZ_TARGETS fuzz_header fuzz_unprotect)
+
+foreach(target ${FUZZ_TARGETS})
+  add_executable(${target} ${target}.cpp)
+  target_link_libraries(${target} PRIVATE ${LIB_NAME} ${CRYPTO_LIB})
+  target_include_directories(${target} PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../src)
+  target_compile_options(${target} PRIVATE -fsanitize=fuzzer)
+  target_link_options(${target} PRIVATE -fsanitize=fuzzer)
+endforeach()

fuzz/fuzz_header.cpp

@@ -0,0 +1,15 @@
+#include <cstddef>
+#include <cstdint>
+#include <tuple>
+
+#include <header.h>
+
+using namespace SFRAME_NAMESPACE;
+
+extern "C" int
+LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+  auto input = input_bytes(data, size);
+  std::ignore = Header::parse(input);
+  return 0;
+}

fuzz/fuzz_unprotect.cpp

@@ -0,0 +1,41 @@
+#include <cstddef>
+#include <cstdint>
+#include <tuple>
+#include <vector>
+
+#include <sframe/sframe.h>
+
+using namespace SFRAME_NAMESPACE;
+
+// Fixed key material so the decrypt path is exercised.
+static const uint8_t kKeyData[] = {
+  0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+  0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+};
+
+extern "C" int
+LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+  if (size == 0) {
+    return 0;
+  }
+
+  // Use the first byte to select a cipher suite, remaining bytes as ciphertext.
+  auto suite = static_cast<CipherSuite>((data[0] % 5) + 1);
+  auto ciphertext = input_bytes(data + 1, size - 1);
+
+  auto ctx = Context(suite);
+
+  // Add keys for several KeyIDs so header-parsed IDs have a chance of matching.
+  auto key = input_bytes(kKeyData, sizeof(kKeyData));
+  for (KeyID kid = 0; kid < 16; kid++) {
+    ctx.add_key(kid, KeyUsage::unprotect, key);
+  }
+
+  auto plaintext_buf = std::vector<uint8_t>(size);
+  auto pt_out = output_bytes(plaintext_buf);
+
+  std::ignore = ctx.unprotect(pt_out, ciphertext, {});
+
+  return 0;
+}