From dec1f967a10b6d954f1ca6bb2e175eccd23a01bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
Date: Tue, 5 Oct 2021 16:45:04 +0200
Subject: [PATCH] DO NOT MERGE [WIP]
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ci skip]

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 .gitignore                            |  5 +++++
 checkpolicy/fuzz/checkpolicy-fuzzer.c | 15 +++++++++++++++
 scripts/oss-fuzz.sh                   |  4 ++--
 3 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 6ff6126585..00eb03fdfc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,3 +25,8 @@ cscope.*
 .*.swp
 # Failsafes
 !.gitignore
+
+/corpus_dir/
+/out/
+/DESTDIR/
+/fuzz-*.log
diff --git a/checkpolicy/fuzz/checkpolicy-fuzzer.c b/checkpolicy/fuzz/checkpolicy-fuzzer.c
index e906b01341..87688e36d9 100644
--- a/checkpolicy/fuzz/checkpolicy-fuzzer.c
+++ b/checkpolicy/fuzz/checkpolicy-fuzzer.c
@@ -120,6 +120,19 @@ static int read_source_policy(policydb_t *p, const uint8_t *data, size_t size)
 	return 0;
 }
 
+static int check_level(hashtab_key_t key, hashtab_datum_t datum, void *arg __attribute__ ((unused)))
+{
+	const level_datum_t *levdatum = (level_datum_t *) datum;
+
+	if (!levdatum->isalias && !levdatum->defined) {
+		fprintf(stderr,
+			"Error:  sensitivity %s was not used in a level definition!\n",
+			key);
+		abort();
+	}
+	return 0;
+}
+
 static int write_binary_policy(policydb_t *p, FILE *outfp)
 {
 	struct policy_file pf;
@@ -170,6 +183,8 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 	if (read_source_policy(&parsepolicydb, data, size))
 		goto exit;
 
+	(void) hashtab_map(parsepolicydb.p_levels.table, check_level, NULL);
+
 	if (hierarchy_check_constraints(NULL, &parsepolicydb))
 		goto exit;
 
diff --git a/scripts/oss-fuzz.sh b/scripts/oss-fuzz.sh
index 069f130aed..49c3eed1b2 100755
--- a/scripts/oss-fuzz.sh
+++ b/scripts/oss-fuzz.sh
@@ -32,10 +32,10 @@ SANITIZER=${SANITIZER:-address}
 flags="-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=$SANITIZER -fsanitize=fuzzer-no-link"
 
 export CC=${CC:-clang}
-export CFLAGS="${CFLAGS:-$flags} -I$DESTDIR/usr/include -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64"
+export CFLAGS="${CFLAGS:-$flags} -I$DESTDIR/usr/include -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -Wall -Wextra -Wfloat-equal -Winit-self -Wmissing-format-attribute -Wmissing-noreturn -Wnull-dereference -Wpointer-arith -Wshadow -Wstrict-prototypes -Wundef -Wunused -Wwrite-strings"
 
 export CXX=${CXX:-clang++}
-export CXXFLAGS=${CXXFLAGS:-$flags}
+export CXXFLAGS="${CXXFLAGS:-$flags} -Wall -Wextra"
 
 export OUT=${OUT:-$(pwd)/out}
 mkdir -p "$OUT"