Start adding some support for finding crashes using fuzzing.

As of this commits, a lot of tests will fail.

FossilOrigin-Name: b69b0e75daaa2ac3959f7a474207ba786823d1a5f8147cfe280df729cb829713

2 files changed, 61 insertions, 0 deletions

diff --git a/tools/fuzz b/tools/fuzz
new file mode 100755
index 0000000..892e950
--- /dev/null
+++ b/tools/fuzz
@@ -0,0 +1,28 @@
+#!/bin/sh
+
+if [ $# -ne 1 ]
+then
+	echo Usage: tools/fuzz BUILD_TYPE
+	exit 1
+fi
+
+rm -rf builds/fuzz-$1
+mkdir -p builds/fuzz-$1
+cd builds/fuzz-$1
+../../configure --enable-enable-build-mode=$1 --disable-shared CC=afl-cc
+make clean && make
+mkdir -p fuzz-in
+mkdir -p fuzz-out
+mkdir -p fuzz-in-min
+cp ../../tests/scripts/good/*.aplwc fuzz-in
+cp ../../tests/scripts/bad/*.aplwc fuzz-in
+afl-cmin -i fuzz-in -o fuzz-in-min -- ./aplwc @@
+rm fuzz-in/*
+cd fuzz-in-min
+for f in *
+do
+	afl-tmin -i "$f" -o "../fuzz-in/$f" -- ../aplwc @@
+done
+cd ..
+rm -rf fuzz-in-min
+afl-fuzz -i fuzz-in -o fuzz-out -m 20 -t 50 -- ./aplwc @@
diff --git a/tools/save-fuzz-crashes b/tools/save-fuzz-crashes
new file mode 100755
index 0000000..ea21356
--- /dev/null
+++ b/tools/save-fuzz-crashes
@@ -0,0 +1,33 @@
+#!/bin/sh
+
+out=tests/fuzz-crashes
+
+n=0
+for f in "$out"/*.fuzz
+do
+	name=${f##*/}
+	num=${name%.fuzz}
+	if [ "$num" -gt "$n" ]
+	then
+		n=$num
+	fi
+done
+
+n=$((n+1))
+
+for dir in builds/fuzz-*/fuzz-out/default/crashes
+do
+	for f in "$dir"/id*
+	do
+		cp "$f" "$out/$n.fuzz"
+		n=$((n+1))
+	done
+done
+
+rm -f "$out/Makefile.am"
+echo -n "TEST_INPUTS += " > "$out/Makefile.am"
+for f in "$out"/*.fuzz
+do
+	printf "%s " "$f" >> "$out/Makefile.am"
+done
+echo "" >> "$out/Makefile.am"