Add built-in fuzzing harnesses for security testing.
Andrew Dunstan <andrew@dunslane.net>
Add built-in fuzzing harnesses for security testing. Add 12 libFuzzer-compatible fuzzing harnesses behind a new -Dfuzzing=true meson option. Each harness implements LLVMFuzzerTestOneInput() and can also be built in standalone mode (reading from files) when no fuzzer engine is detected. Frontend targets (no backend dependencies): fuzz_json - non-incremental JSON parser (pg_parse_json) fuzz_json_incremental - incremental/chunked JSON parser fuzz_conninfo - libpq connection string parser (PQconninfoParse) fuzz_pglz - PGLZ decompressor (pglz_decompress) fuzz_unescapebytea - libpq bytea unescape (PQunescapeBytea) fuzz_b64decode - base64 decoder (pg_b64_decode) fuzz_saslprep - SASLprep normalization (pg_saslprep) fuzz_parsepgarray - array literal parser (parsePGArray) fuzz_pgbench_expr - pgbench expression parser (via Bison/Flex) Backend targets (link against postgres_lib): fuzz_rawparser - SQL raw parser (raw_parser) fuzz_regex - regex engine (pg_regcomp/pg_regexec) fuzz_typeinput - type input functions (numeric/date/timestamp/interval)
Files
| Path | Change | +/− |
|---|---|---|
| meson_options.txt | modified | +3 −0 |
| src/test/fuzzing/fuzz_b64decode.c | added | +98 −0 |
| src/test/fuzzing/fuzz_conninfo.c | added | +105 −0 |
| src/test/fuzzing/fuzz_json.c | added | +104 −0 |
| src/test/fuzzing/fuzz_json_incremental.c | added | +127 −0 |
| src/test/fuzzing/fuzz_parsepgarray.c | added | +102 −0 |
| src/test/fuzzing/fuzz_pgbench_expr.c | added | +211 −0 |
| src/test/fuzzing/fuzz_pglz.c | added | +127 −0 |
| src/test/fuzzing/fuzz_rawparser.c | added | +162 −0 |
| src/test/fuzzing/fuzz_regex.c | added | +193 −0 |
| src/test/fuzzing/fuzz_saslprep.c | added | +104 −0 |
| src/test/fuzzing/fuzz_typeinput.c | added | +218 −0 |
| src/test/fuzzing/fuzz_unescapebytea.c | added | +103 −0 |
| src/test/fuzzing/meson.build | added | +203 −0 |
| src/test/meson.build | modified | +2 −0 |