engine: first attempts on fuzzing the engine

utils/run-fuzzer/run-fuzzer.c

@@ -0,0 +1,34 @@
+#include <dlfcn.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#if !defined LIB || !defined FUNC
+#error
+#endif
+
+typedef int (*FuzzFunc)(const char *Data, size_t Size);
+
+void *handle = NULL;
+FuzzFunc f = NULL;
+
+int LLVMFuzzerTestOneInput( const char *Data, size_t Size )
+{
+	if( !handle )
+		handle = dlopen( LIB, RTLD_NOW );
+
+	if( handle )
+	{
+		if( !f )
+			f = dlsym( handle, FUNC );
+
+		if( f )
+		{
+			return f( Data, Size );
+		}
+	}
+
+	fprintf( stderr, "Fail: %s\n", dlerror() );
+
+	abort();
+	return 0;
+}

utils/run-fuzzer/wscript

@@ -0,0 +1,40 @@
+#! /usr/bin/env python
+# encoding: utf-8
+# a1batross, mittorn, 2018
+
+def options(opt):
+	pass
+
+def configure(conf):
+	if conf.options.BUILD_TYPE != 'sanitize':
+		conf.fatal('useless without -T sanitize')
+
+	if conf.env.COMPILER_CC != 'clang':
+		conf.fatal('only clang is supported')
+
+	conf.env.append_unique('CFLAGS', '-fsanitize=fuzzer')
+	conf.env.append_unique('LINKFLAGS', '-fsanitize=fuzzer')
+
+def add_runner_target(bld, lib, func):
+	source = bld.path.ant_glob('*.c')
+	includes = '.'
+	libs = [ 'DL' ]
+
+	bld(
+		source   = source,
+		target   = 'run-fuzzer-' + func,
+		features = 'c cprogram',
+		includes = includes,
+		use      = libs,
+		defines  = ['FUNC="Fuzz_' + func + '"', 'LIB="' + lib + '"'],
+		install_path = bld.env.BINDIR,
+		subsystem = bld.env.CONSOLE_SUBSYSTEM
+	)
+
+def build(bld):
+	add_runner_target(bld, 'libxash.so', 'Sound_LoadMPG')
+	add_runner_target(bld, 'libxash.so', 'Sound_LoadWAV')
+	add_runner_target(bld, 'libxash.so', 'Image_LoadBMP')
+	add_runner_target(bld, 'libxash.so', 'Image_LoadPNG')
+	add_runner_target(bld, 'libxash.so', 'Image_LoadDDS')
+	add_runner_target(bld, 'libxash.so', 'Image_LoadTGA')