6 Commits

Author SHA1 Message Date
4b5422181d Fix use-after-free in fuzzpuzz
When reporting that the game name in a save file isn't recognised,
don't include the name from the save file in the error message, partly
to avoid the complexity of freeing it properly on two different code
paths and partly because including unsanitized data from a
fuzzer-supplied save file in the error message just seems dangerous.
And properly sanitising it would waste the fuzzer's time exploring the
sanitising code.

Thanks to Ben Hutchings for reporting the bug.
2023-01-16 10:43:41 +00:00
1a48d76fcc Remember to free the game name in fuzzpuzz 2023-01-12 22:21:45 +00:00
5fa1931560 Don't leak midends in fuzzpuzz
If deserialising a save file fails, the midend still needs to be freed.
2023-01-12 22:21:45 +00:00
311d227ba6 Merge the two versions of fuzzpuzz back together
Now there's a single version of the main loop that runs once in normal
mode and repeatedly in AFL++ persistent mode.  In persistent mode,
fmemopen() allows the loop to read the shared-memory buffer as though
it were a stdio stream.  fmemopen() is POSIX-only, but so is AFL++.
2023-01-12 22:21:45 +00:00
69924f376b AFL-specific shared-memory fuzzing mode
Rather than a save file from standard input and then exiting, this reads
it from a shared memory buffer and then loops.  This makes fuzzing
_much_ faster: one core on my laptop can now load about 30,000 save
files per second.
2023-01-12 22:21:45 +00:00
53a1faa0d7 Add a fuzzing harness for Puzzles
This just feeds save files into the loading code, but because of how
Puzzles is structured that actually exercises most of its parsers.
2023-01-12 22:21:34 +00:00