Re: [PATCH] fuzz: add oss-fuzz build.sh script

[Alexander Bulekov]

On 200605 1956, Philippe Mathieu-Daudé wrote:
> On 6/5/20 7:40 PM, Alexander Bulekov wrote:
> > It is neater to keep this in the QEMU repo, since any change that
> > requires an update to the oss-fuzz build configuration, can make the
> > necessary changes in the same series.
> > 
> > Suggested-by: Philippe Mathieu-Daude <f4bug@amsat.org>
> 
> 'Philippe Mathieu-Daudé' ;)

Oops - Sorry.

> 
> > Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
> > ---
> >  scripts/oss-fuzz/build.sh | 47 +++++++++++++++++++++++++++++++++++++++
> >  1 file changed, 47 insertions(+)
> >  create mode 100755 scripts/oss-fuzz/build.sh
> > 
> > diff --git a/scripts/oss-fuzz/build.sh b/scripts/oss-fuzz/build.sh
> > new file mode 100755
> > index 0000000000..7be6dcce4c
> > --- /dev/null
> > +++ b/scripts/oss-fuzz/build.sh
> > @@ -0,0 +1,47 @@
> > +#!/bin/sh
> > +#
> > +# Update syscall_nr.h files from linux headers asm-generic/unistd.h
> 
> Hmmm?

Fixed in v2.

> 
> > +#
> > +# This code is licensed under the GPL version 2 or later.  See
> > +# the COPYING file in the top-level directory.
> > +#
> > +
> > +# build project
> 
> Please mention this file use consumed by
> https://github.com/google/oss-fuzz/.../projects/qemu/Dockerfile
> 
> > +# e.g.
> > +# ./autogen.sh
> > +# ./configure
> > +# make -j$(nproc) all
> > +
> > +# build fuzzers
> > +# e.g.
> > +# $CXX $CXXFLAGS -std=c++11 -Iinclude \
> > +#     /path/to/name_of_fuzzer.cc -o $OUT/name_of_fuzzer \
> > +#     $LIB_FUZZING_ENGINE /path/to/library.a
> > +
> > +mkdir -p $OUT/lib/              # Shared libraries
> 
> Maybe rename OUT -> DEST_DIR?

$OUT is something specified by OSS-Fuzz, when it runs the script in
docker. If its better, I can do DEST_DIR=$OUT

> > +
> > +# Build once to get the list of dynamic lib paths, and copy them over
> > +./configure --datadir="./data/" --disable-werror --cc="$CC" --cxx="$CXX" \
> > +    --extra-cflags="$CFLAGS -U __OPTIMIZE__ "
> 
> So we use an in-tree build.
> 
> Still we could set some SRCDIR=./
I can change it to build in ./build/ or even an out-of-tree build, if
thats neater..

> 
> > +make CONFIG_FUZZ=y CFLAGS="$LIB_FUZZING_ENGINE" -j$(nproc) 
> > i386-softmmu/fuzz
> > +
> > +for i in $(ldd ./i386-softmmu/qemu-fuzz-i386  | cut -f3 -d' '); do 
> > +    cp $i $OUT/lib/
> > +done
> > +rm ./i386-softmmu/qemu-fuzz-i386
> > +
> > +# Build a second time to build the final binary with correct rpath
> > +./configure --datadir="./data/" --disable-werror --cc="$CC" --cxx="$CXX" \
> > +    --extra-cflags="$CFLAGS -U __OPTIMIZE__" \
> > +    --extra-ldflags="-Wl,-rpath,'\$\$ORIGIN/lib'"
> > +make CONFIG_FUZZ=y CFLAGS="$LIB_FUZZING_ENGINE" -j$(nproc) 
> > i386-softmmu/fuzz
> > +
> > +# Copy over the datadir
> > +cp  -r ./pc-bios/ $OUT/pc-bios
> 
> "make install-datadir"?
With something like: ./configure --datadir="$OUT/pc-bios/"
Ok.

> 
> > +
> > +# Copy over the qemu-fuzz-i386, naming it according to each available fuzz
> > +# target (See 05509c8e6d fuzz: select fuzz target using executable name)
> > +for target in $(./i386-softmmu/qemu-fuzz-i386 | awk '$1 ~ /\*/  {print 
> > $2}');
> > +do
> > +    cp ./i386-softmmu/qemu-fuzz-i386 $OUT/qemu-fuzz-i386-target-$target
> 
> There seems to be an extra 'target'.
I don't think so, unless i'm missing something.
We do a strstr(argv[0], "-target-") in fuzz.c The
targets need to be named:
qemu-fuzz-i386-target-virtio-net-socket
qemu-fuzz-i386-target-i440fx-qos-fork-fuzz
etc..

Thanks
-Alex

> > +done
> > 
> 
> Or "make install", not sure.