wip

[ci skip]

.gitignore

@@ -25,3 +25,8 @@ cscope.*
 .*.swp
 # Failsafes
 !.gitignore
+
+/corpus_dir/
+/out/
+/DESTDIR/
+/fuzz-*.log

checkpolicy/mybuild.sh

@@ -0,0 +1,20 @@
+#!/bin/sh
+
+set -e
+
+if [ "$1x" = "cleanx" ]; then
+	make -C ../libsepol/src/ clean
+	make clean
+
+	exit 0
+fi
+
+CC=${CC:-'ccache clang-16'}
+CFLAGS=${CFLAGS:-'-O1 -g -ftrivial-auto-var-init=pattern -fsanitize=address -fsanitize-address-use-after-scope -fsanitize-address-use-after-return=always -fno-omit-frame-pointer -fsanitize=undefined -fsanitize=nullability -fsanitize=implicit-conversion -fsanitize=integer -fsanitize=float-divide-by-zero -fsanitize=local-bounds -fno-sanitize-recover=all'}
+
+make -C ../libsepol/src/ CC="$CC" CFLAGS="$CFLAGS -Werror -Wall -Wdeclaration-after-statement -Wextra -Wfloat-equal -Wformat -Winit-self -Wmissing-format-attribute -Wmissing-noreturn -Wnull-dereference -Wpointer-arith -Wshadow -Wstrict-prototypes -Wundef -Wunused -Wwrite-strings" libsepol.a -j4
+
+make clean
+make -C test/ clean
+make CC="$CC" CFLAGS="$CFLAGS -Werror -Wall -Wcast-qual -Wdeclaration-after-statement -Wextra -Wfloat-equal -Wformat=2 -Winit-self -Wmissing-format-attribute -Wmissing-noreturn -Wmissing-prototypes -Wnull-dereference -Wpointer-arith -Wshadow -Wstrict-prototypes -Wundef -Wunused -Wwrite-strings -isystem $(pwd)/../libsepol/include/" LIBSEPOLA="$(pwd)/../libsepol/src/libsepol.a" -j4
+make -C test/ CC="$CC" CFLAGS="$CFLAGS -Werror -Wall -Wcast-qual -Wdeclaration-after-statement -Wextra -Wfloat-equal -Wformat=2 -Winit-self -Wmissing-format-attribute -Wmissing-noreturn -Wmissing-prototypes -Wnull-dereference -Wpointer-arith -Wshadow -Wstrict-prototypes -Wundef -Wunused -Wwrite-strings -isystem $(pwd)/../libsepol/include/" LIBSEPOLA="$(pwd)/../libsepol/src/libsepol.a" -j4

libsepol/src/private.h

@@ -45,7 +45,7 @@
 #define ARRAY_SIZE(x) (sizeof(x)/sizeof((x)[0]))
 
 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
-# define is_saturated(x) (x == (typeof(x))-1 || (x) > (1U << 16))
+# define is_saturated(x) (x == (typeof(x))-1 || (x) > (1U << 9))
 #else
 # define is_saturated(x) (x == (typeof(x))-1)
 #endif

scripts/oss-fuzz.sh

@@ -32,10 +32,10 @@ SANITIZER=${SANITIZER:-address}
 flags="-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=$SANITIZER -fsanitize=fuzzer-no-link"
 
 export CC=${CC:-clang}
-export CFLAGS="${CFLAGS:-$flags} -I$DESTDIR/usr/include -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64"
+export CFLAGS="${CFLAGS:-$flags} -I$DESTDIR/usr/include -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -Wall -Wextra -Wfloat-equal -Winit-self -Wmissing-format-attribute -Wmissing-noreturn -Wnull-dereference -Wpointer-arith -Wshadow -Wstrict-prototypes -Wundef -Wunused -Wwrite-strings"
 
 export CXX=${CXX:-clang++}
-export CXXFLAGS=${CXXFLAGS:-$flags}
+export CXXFLAGS="${CXXFLAGS:-$flags} -Wall -Wextra"
 
 export OUT=${OUT:-$(pwd)/out}
 mkdir -p "$OUT"