diff --git a/.devcontainer b/.devcontainer index 86cd764..8c0bb5a 160000 --- a/.devcontainer +++ b/.devcontainer @@ -1 +1 @@ -Subproject commit 86cd764e920f18eb66b5a7cf612d4dbadd695a20 +Subproject commit 8c0bb5a3ac33eae5ec608e874974927c502e3624 diff --git a/.github/workflows/fuzzing.yaml b/.github/workflows/fuzzing.yaml new file mode 100644 index 0000000..b8ed675 --- /dev/null +++ b/.github/workflows/fuzzing.yaml @@ -0,0 +1,78 @@ +name: Fuzzing with CI Fuzz + +# Runs all fuzz tests in this repository with CI Fuzz. + +# You need to set CIFUZZ_DOWNLOAD_TOKEN as a repository secret. Get the token +# from https://downloads.code-intelligence.com/. + +# Run workflow each time code is pushed to default branch of the repository, +# for every pull request to the default branch and on a schedule. Allow to +# run this workflow manually. +# The scheduled workflow runs every day at 03:50 UTC. +on: + push: + branches: [ $default-branch ] + pull_request: + branches: [ $default-branch ] + schedule: + - cron: '50 03 * * *' + workflow_dispatch: + +jobs: + fuzz: + runs-on: ubuntu-latest + + permissions: + # Please comment-out the ones you don't need and uncomment the ones you do need + + # Required to upload Findings to GitHub code scanning + security-events: write + + # Required to commit Findings to repository + # contents: write + + steps: + - name: Install dependecies + run: | + sudo apt update + sudo apt install clang llvm lcov + + - name: Checkout repository + uses: "actions/checkout@v4" + + - name: Install CI Fuzz + uses: "CodeIntelligenceTesting/actions/install-cifuzz@v2" + with: + version: latest + download-token: ${{ secrets.CIFUZZ_DOWNLOAD_TOKEN }} + + + # Needs configuration of rclone + # - name: Copy corpus from cloud storage + # run: | + # mkdir -p .cifuzz-corpus + # rclone copy -v cloud-storage:corpora/PROJECT_NAME .cifuzz-corpus + + - name: Run fuzzing + uses: "CodeIntelligenceTesting/actions/run-fuzzing@v2" + with: + duration: 15s + + # Needs configuration of rclone + # - name: Copy corpus to cloud storage + # run: | + # rclone copy -v .cifuzz-corpus cloud-storage:corpora/PROJECT_NAME + + - name: Upload code-scanning report + if: always() + uses: "CodeIntelligenceTesting/actions/upload-code-scanning-report@v2" + + # Uncomment this step if you want to commit all Findings found when running this workflow: + # - name: Commit Findings to repository + # run: | + # git config --global user.name 'GitHub Action' + # git config --global user.email 'zgtm@users.noreply.github.com' + # git add .cifuzz-findings + # git commit -m "Automated commit of CI Fuzz Findings" + # git push + diff --git a/cifuzz.yaml b/cifuzz.yaml index 4b78df7..0ad763f 100644 --- a/cifuzz.yaml +++ b/cifuzz.yaml @@ -1,5 +1,5 @@ ## Configuration for a CI Fuzz project -## Generated on 2025-04-15 +## Generated on 2025-06-23 ## The build system used to build this project. If not set, cifuzz tries to ## detect the build system automatically. @@ -8,7 +8,13 @@ build-system: cmake ## Engine used for fuzzing, default is "libfuzzer-clang". ## Valid values: "libfuzzer-clang", "honggfuzz-clang", "honggfuzz-gcc" -#engine: honggfuzz-gcc +engine: libfuzzer-clang + +## Sanitizers to use when building fuzz tests. If not set, ASan and UBSan +## are used by default. +#sanitizers: +# - address +# - undefined ## If the build system type is "other", this command is used to build the fuzz ## tests. @@ -27,6 +33,7 @@ build-system: cmake #build-system-args: # - -DBUILD_TESTS=ON + ## Directories containing sample inputs used as seeds for running fuzz tests. ## For general information on seed corpora, see: ## https://docs.code-intelligence.com/glossary#seed-corpus @@ -43,12 +50,17 @@ build-system: cmake ## For libFuzzer see: https://llvm.org/docs/LibFuzzer.html#dictionaries #dict: path/to/dictionary.dct -## Command-line arguments to pass to the fuzzing engine when running fuzz tests. -## For libFuzzer see: https://llvm.org/docs/LibFuzzer.html#options -engine-args: - - -use_value_profile=1 # Only use value profile with libFuzzer! Never use it with Honggfuzz! +## Command-line arguments to pass to libFuzzer when running fuzz tests. +## See https://llvm.org/docs/LibFuzzer.html#options for possible options. +libfuzzer-args: + - -use_value_profile=1 # - -rss_limit_mb=4096 +## Command-line arguments to pass to Honggfuzz when running fuzz tests. +## See https://github.com/google/honggfuzz/blob/master/docs/USAGE.md for possible options. +#honggfuzz-args: +# - --rlimit_rss=4096 + ## Maximum time to run all fuzz tests. Default is 10 minutes. The time will be ## split up evenly between multiple fuzz tests. To keep running indefinitely, ## set value to 0. @@ -63,4 +75,4 @@ max-idle-time: 0 ## Set style for command output. ## Valid values: "pretty", "plain" -#style: plain +#style: plain \ No newline at end of file