libqmi-glib,test: add fuzzer test for qmi_message_new_from_raw()

4 files changed, 45 insertions, 0 deletions

diff --git a/meson.build b/meson.build
index afc69350..8b23a1cc 100644
--- a/meson.build
+++ b/meson.build
@@ -239,6 +239,8 @@ if enable_man
   subdir('docs/man')
 endif
 
+enable_fuzzer = get_option('fuzzer')
+
 configure_file(
   output: 'config.h',
   configuration: config_h,
@@ -251,6 +253,7 @@ summary({
   'bash completion': enable_bash_completion,
   'gobject introspection': enable_gir,
   'man pages': enable_man,
+  'fuzzer': enable_fuzzer,
 }, section: 'Build')
 
 summary({
diff --git a/meson_options.txt b/meson_options.txt
index 3f3a22b0..491961ef 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -19,3 +19,5 @@ option('gtk_doc', type: 'boolean', value: false, description: 'use gtk-doc to bu
 option('man', type: 'boolean', value: true, description: 'build man pages using help2man')
 
 option('bash_completion', type: 'boolean', value: true, description: 'install bash completion files')
+
+option('fuzzer', type: 'boolean', value: false, description: 'build fuzzer tests')
diff --git a/src/libqmi-glib/test/meson.build b/src/libqmi-glib/test/meson.build
index 884d2721..eef08214 100644
--- a/src/libqmi-glib/test/meson.build
+++ b/src/libqmi-glib/test/meson.build
@@ -39,3 +39,15 @@ foreach test_name, test_args: test_units
     env: test_env,
   )
 endforeach
+
+if get_option('fuzzer')
+  fuzzer_name = 'test-message-fuzzer'
+  exe = executable(
+    fuzzer_name,
+    sources: fuzzer_name + '.c',
+    include_directories: top_inc,
+    dependencies: libqmi_glib_dep,
+    c_args: '-DLIBQMI_GLIB_COMPILATION',
+    link_args : '-fsanitize=fuzzer',
+  )
+endif
diff --git a/src/libqmi-glib/test/test-message-fuzzer.c b/src/libqmi-glib/test/test-message-fuzzer.c
new file mode 100644
index 00000000..b344a017
--- /dev/null
+++ b/src/libqmi-glib/test/test-message-fuzzer.c
@@ -0,0 +1,28 @@
+/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2022 Google, Inc.
+ */
+
+#include <config.h>
+#include <string.h>
+#include <stdint.h>
+#include <glib.h>
+
+#include "qmi-message.h"
+
+int
+LLVMFuzzerTestOneInput (const uint8_t *data,
+                        size_t         size)
+{
+    g_autoptr(GByteArray) bytearray = NULL;
+    g_autoptr(QmiMessage) message = NULL;
+    g_autoptr(GError)     error = NULL;
+
+    if (!size)
+      return 0;
+
+    bytearray = g_byte_array_append (g_byte_array_sized_new (size), data, size);
+    message = qmi_message_new_from_raw (bytearray, &error);
+    return 0;
+}