harfbuzz/test/fuzzing
Behdad Esfahbod 03085132ba [buffer] Fix out-buffer under memory-alloc failure
This was broken in July refactoring of the buffer, and exposed to
ReverseChainSingleSubstFormat1 in 3807061d63

Fixes:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38800
https://bugs.chromium.org/p/chromium/issues/detail?id=1303552
2022-03-21 18:09:06 -06:00
..
fonts [buffer] Fix out-buffer under memory-alloc failure 2022-03-21 18:09:06 -06:00
sets [fuzz] minor, move two fuzzer cases to their correct place 2020-02-12 19:17:18 +03:30
Makefile.am Revert "Remove autotools build support" 2020-08-11 23:51:59 +04:30
README Move all references of old url to the new address (#622) 2017-11-20 14:49:22 -05:00
hb-draw-fuzzer.cc [draw] Emit move_to immediately, like other operators 2022-02-13 13:21:15 -06:00
hb-fuzzer.hh [fuzzer] minor 2020-08-12 02:40:55 +04:30
hb-set-fuzzer.cc Fix various typos 2022-01-16 05:39:03 -08:00
hb-shape-fuzzer.cc [fuzz] Disable verification for now. 2022-01-28 14:07:29 -07:00
hb-subset-fuzzer.cc [subset] switch ..._set_flags to not take a mask. 2021-07-29 18:30:27 -07:00
main.cc [blob] Add failing versions of create API 2021-06-15 13:56:30 -06:00
meson.build [meson] Require 0.55.0 2021-11-22 03:11:36 +02:00
run-draw-fuzzer-tests.py [test] Remove timeout from test runners 2020-10-15 00:49:02 -07:00
run-shape-fuzzer-tests.py [test] Remove timeout from test runners 2020-10-15 00:49:02 -07:00
run-subset-fuzzer-tests.py [test] Remove timeout from test runners 2020-10-15 00:49:02 -07:00

README

In order to build the fuzzer one needs to build HarfBuzz and
harfbuzz/test/fuzzing/hb-fuzzer.cc with:
  - Using the most recent Clang
  - With -fsanitize=address (or =undefined, or a combination)
  - With -fsanitize-coverage=edge[,8bit-counters,trace-cmp]
  - With various defines that limit worst case exponential behavior.
    See FUZZING_CPPFLAGS in harfbuzz/src/Makefile.am for the list.
  - link against libFuzzer

To run the fuzzer one needs to first obtain a test corpus as a directory
containing interesting fonts.  A good starting point is inside
harfbuzz/test/shaping/fonts/fonts/.
Then, run the fuzzer like this:
   ./hb-fuzzer -max_len=2048 CORPUS_DIR
Where max_len specifies the maximal length of font files to handle.
The smaller the faster.

For more details consult the following locations:
  - http://llvm.org/docs/LibFuzzer.html or
  - https://github.com/google/libfuzzer-bot/tree/master/harfbuzz
  - https://github.com/harfbuzz/harfbuzz/issues/139