fuzz.sh

#!/bin/sh
set -eu

cd "$(dirname "$0")" || exit 1

usage="usage: ./fuzz.sh <target>|all [seconds]"
targets="frame_decode frame_roundtrip replay_buffer bundle_roundtrip ssh_hostname"

if [ "$#" -eq 0 ]; then
    echo "$usage"
    echo
    echo "targets:"
    echo "  frame_decode      arbitrary bytes into the frame codec, fed in chunks"
    echo "  frame_roundtrip   every frame survives encode and decode unchanged"
    echo "  replay_buffer     push and replay sequences against a small buffer"
    echo "  bundle_roundtrip  the state bundle survives a write and a read back"
    echo "  ssh_hostname      arbitrary text into the ssh -G hostname parser"
    echo
    echo "without a time limit a run continues until interrupted; crashing"
    echo "inputs land in fuzz/artifacts/<target>/"
    exit 0
fi

if [ "$#" -gt 2 ]; then
    echo "$usage" >&2
    exit 2
fi

target="$1"
seconds="${2:-}"

case " $targets all " in
    *" $target "*) ;;
    *)
        echo "fuzz: unknown target $target; run ./fuzz.sh for the list" >&2
        exit 2
        ;;
esac

case "$seconds" in
    "") ;;
    *[!0-9]*)
        echo "fuzz: seconds must be a whole number, not $seconds" >&2
        exit 2
        ;;
esac

# The one place the toolchain is named; the ci job reads the same file. It is
# a pin rather than plain nightly because nightlies after that date hit an
# internal compiler error building tokio with optimizations, and every target
# links tokio. Bump the file once that is fixed upstream.
pin="$(cat fuzz/nightly-version)"

if ! rustup run "$pin" cargo --version >/dev/null 2>&1; then
    echo "fuzz: the fuzz targets need the pinned toolchain:" >&2
    echo "    rustup toolchain install $pin" >&2
    exit 1
fi

if ! cargo fuzz --version >/dev/null 2>&1; then
    echo "fuzz: cargo-fuzz is not installed:" >&2
    # Plain `cargo install cargo-fuzz` builds it with the default toolchain,
    # whose rustc can be older than cargo-fuzz's own lockfile requires.
    echo "    cargo +$pin install cargo-fuzz --locked" >&2
    exit 1
fi

# The working corpus comes first, so findings accumulate there; the committed
# seeds follow as a second, read-only directory.
run() {
    mkdir -p "fuzz/corpus/$1"
    echo "fuzz: $1"
    if [ -n "$seconds" ]; then
        cargo +"$pin" fuzz run "$1" "fuzz/corpus/$1" "fuzz/seeds/$1" \
            -- -max_total_time="$seconds"
    else
        cargo +"$pin" fuzz run "$1" "fuzz/corpus/$1" "fuzz/seeds/$1"
    fi
}

if [ "$target" = all ]; then
    for one in $targets; do
        run "$one"
    done
else
    run "$target"
fi