mirror of https://github.com/wolfSSL/wolfMQTT.git
61 lines
1.5 KiB
Bash
Executable File
61 lines
1.5 KiB
Bash
Executable File
#!/bin/bash
|
|
# fuzz.sh - Build and run the wolfMQTT broker fuzzer
|
|
#
|
|
# Usage: ./scripts/fuzz.sh [seconds]
|
|
# seconds: fuzz duration (default: 60)
|
|
#
|
|
# Requires: clang with libFuzzer support
|
|
|
|
set -e
|
|
|
|
FUZZ_TIME=${1:-60}
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
ROOT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
|
|
cd "$ROOT_DIR"
|
|
|
|
# Check for clang
|
|
if ! command -v clang >/dev/null 2>&1; then
|
|
echo "Error: clang is required for fuzzing (libFuzzer)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Generate configure if needed
|
|
if [ ! -f ./configure ]; then
|
|
./autogen.sh
|
|
fi
|
|
|
|
# Configure with fuzzer and address sanitizer
|
|
CC=clang ./configure --enable-broker --enable-v5 --enable-fuzz \
|
|
--disable-tls --disable-examples \
|
|
CFLAGS="-fsanitize=fuzzer-no-link,address -fno-omit-frame-pointer -g -O1" \
|
|
LDFLAGS="-fsanitize=address"
|
|
|
|
make -j$(nproc)
|
|
|
|
# Generate seed corpus
|
|
python3 tests/fuzz/gen_corpus.py
|
|
|
|
# Run fuzzer
|
|
echo "Fuzzing for ${FUZZ_TIME} seconds..."
|
|
export ASAN_OPTIONS="detect_leaks=1:abort_on_error=1:symbolize=1"
|
|
|
|
timeout "$FUZZ_TIME" \
|
|
./tests/fuzz/broker_fuzz \
|
|
tests/fuzz/corpus/ \
|
|
-dict=tests/fuzz/mqtt.dict \
|
|
-max_len=4096 \
|
|
-timeout=10 \
|
|
-rss_limit_mb=2048 \
|
|
-print_final_stats=1 \
|
|
|| FUZZ_RC=$?
|
|
|
|
# timeout returns 124 on normal expiry, fuzzer returns 0 on no crash
|
|
if [ "${FUZZ_RC:-0}" -eq 124 ] || [ "${FUZZ_RC:-0}" -eq 0 ]; then
|
|
echo "Fuzzer completed without crashes"
|
|
else
|
|
echo "Fuzzer found crashes (exit code $FUZZ_RC)"
|
|
ls -la crash-* 2>/dev/null || true
|
|
exit 1
|
|
fi
|