ci: add libFuzzer job

The job builds with clang, ASan and UBSan, and runs every fuzz target
on an empty corpus for 10000 runs or 20 seconds, whichever comes first.

It passes -len_control=0, so inputs have full length from the first
run. Otherwise libFuzzer lengthens them slowly, and in 10000 runs they
stay under 100 bytes, too short for the musig, ellswift and
silentpayments targets to reach their last checks.

CFLAGS carry -fsanitize=fuzzer-no-link, not -fsanitize=fuzzer: on Linux
clang links the latter as a whole archive, libFuzzer's main included,
into every program it links, which clashes with the main of configure's
checks, the tests and the examples.

Assisted-by: my usual tools (LLM, Internet, computer). Mistakes are mine.
Signed-off-by: Ferdinando Ametrano <ferdinando@ametrano.net>

Author: fametrano

.github/workflows/ci.yml

@@ -48,6 +48,7 @@ env:
   SYMBOL_CHECK: 'yes'
   # Compile and run the examples.
   EXAMPLES: 'yes'
+  FUZZ: 'no'
   # Disable Docker build summary generation.
   # See https://github.com/docker/build-push-action/blob/master/README.md#environment-variables.
   DOCKER_BUILD_SUMMARY: false
@@ -328,6 +329,34 @@ jobs:
       - *CI_SCRIPT_IN_DOCKER
       - *PRINT_LOGS
 
+  fuzz_debian:
+    name: "libFuzzer"
+    runs-on: ubuntu-latest
+    needs: docker_cache
+
+    strategy:
+      matrix:
+        configuration:
+          - env_vars: {}
+
+    env:
+      CC: 'clang'
+      ASM: 'auto'
+      FUZZ: 'yes'
+      CTIMETESTS: 'no'
+      CFLAGS: '-fsanitize=fuzzer-no-link,address,undefined -g'
+      UBSAN_OPTIONS: 'print_stacktrace=1:halt_on_error=1'
+      ASAN_OPTIONS: 'strict_string_checks=1:detect_stack_use_after_return=1:detect_leaks=1'
+      LSAN_OPTIONS: 'use_unaligned=1'
+      SECP256K1_TEST_ITERS: 2
+      BENCH: 'no'
+      SYMBOL_CHECK: 'no'
+
+    steps:
+      - *CHECKOUT
+      - *CI_SCRIPT_IN_DOCKER
+      - *PRINT_LOGS
+
   msan_debian:
     name: "MSan"
     runs-on: ubuntu-latest

ci/ci.sh

@@ -15,7 +15,7 @@ print_environment() {
             ECMULTWINDOW ECMULTGENKB ASM WIDEMUL WITH_VALGRIND EXTRAFLAGS \
             EXPERIMENTAL ECDH RECOVERY EXTRAKEYS MUSIG SCHNORRSIG ELLSWIFT SILENTPAYMENTS \
             SECP256K1_TEST_ITERS BENCH SECP256K1_BENCH_ITERS CTIMETESTS SYMBOL_CHECK \
-            EXAMPLES \
+            EXAMPLES FUZZ \
             HOST WRAPPER_CMD \
             CC CFLAGS CPPFLAGS AR NM \
             UBSAN_OPTIONS ASAN_OPTIONS LSAN_OPTIONS
@@ -66,6 +66,7 @@ fi
     --enable-module-musig="$MUSIG" \
     --enable-module-silentpayments="$SILENTPAYMENTS" \
     --enable-examples="$EXAMPLES" \
+    --enable-fuzz="$FUZZ" \
     --enable-ctime-tests="$CTIMETESTS" \
     --with-valgrind="$WITH_VALGRIND" \
     --host="$HOST" $EXTRAFLAGS
@@ -136,6 +137,16 @@ then
     fi
 fi
 
+if [ "$FUZZ" = "yes" ]
+then
+    # With FUZZ empty, ./fuzz lists its targets after a header line.
+    targets=$(FUZZ='' ./fuzz 2>&1 | tail -n +2)
+    test -n "$targets"
+    for target in $targets; do
+        FUZZ="$target" $EXEC ./fuzz -runs=10000 -max_total_time=20 -len_control=0 >> fuzz.log 2>&1
+    done
+fi
+
 # Rebuild precomputed files (if not cross-compiling).
 if [ -z "$HOST" ]
 then