Fuzzing target for tizen-platform-config

diff --git a/targets/tizen-platform-config/README.md b/targets/tizen-platform-config/README.md
new file mode 100644 (file)
index 0000000..1ceca13
--- /dev/null
+++ b/targets/tizen-platform-config/README.md
@@ -0,0 +1,7 @@
+# tizen-platform-config
+
+Target functions for tizen-platform-config project (platform/core/system/tizen-platform-config)
+
+Fuzzed functions:
+* tzplatform_mkstr(enum tzplatform_variable id, const char *str)
+* tzplatform_mkpath(enum tzplatform_variable id, const char *path)

diff --git a/targets/tizen-platform-config/build.sh b/targets/tizen-platform-config/build.sh
new file mode 100755 (executable)
index 0000000..963d1e9
--- /dev/null
+++ b/targets/tizen-platform-config/build.sh
@@ -0,0 +1,16 @@
+#!/bin/bash -e
+
+BUILD_HOME=/home/abuild/rpmbuild/BUILD/tizen-platform-config-4.0/src
+CXX=g++
+SOURCE=tzplatform-fuzz.cpp
+CFLAGS="-g -I${BUILD_HOME} -Wall -Wextra"
+LDFLAGS="-L${BUILD_HOME}/.libs -lpthread -ltzplatform-config-2.0"
+OUT=tzplatfrom-fuzz.out
+LIBFUZZER=$(rpm -ql libFuzzer 2>/dev/null | grep libFuzzer.a)
+
+if [[ -z $LIBFUZZER ]]; then
+   echo "libFuzzer is not installed!"
+   exit 1
+fi
+
+${CXX} ${CFLAGS} ${SOURCE} ${LIBFUZZER} ${LDFLAGS} -o ${OUT}

diff --git a/targets/tizen-platform-config/tzplatform-fuzz.cpp b/targets/tizen-platform-config/tzplatform-fuzz.cpp
new file mode 100644 (file)
index 0000000..a329378
--- /dev/null
+++ b/targets/tizen-platform-config/tzplatform-fuzz.cpp
@@ -0,0 +1,27 @@
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "tzplatform_variables.h"
+#include "tzplatform_config.h"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    char *str = (char*)malloc(size+1);
+    if (str != NULL) {
+        memcpy(str, data, size);
+        str[size] = '\0';
+    }
+
+    int i = 0;
+    while(i != tzplatform_getcount()) {
+        enum tzplatform_variable id = (enum tzplatform_variable) i;
+        // For both below functions:
+        // the returned value is an allocated unique string that MUST not be freed.
+        tzplatform_mkstr(id, str);
+        tzplatform_mkpath(id, str);
+        i++;
+    }
+    free(str);
+
+    return 0;
+}