thodg/libgit2

2018-10-11T12:26:44

fuzzers: initialize libgit2 in standalone driver The standalone driver for libgit2's fuzzing targets makes use of functions from libgit2 itself. While this is totally fine to do, we need to make sure to always have libgit2 initialized via `git_libgit2_init` before we call out to any of these. While this happens in most cases as we call `LLVMFuzzerInitialize`, which is provided by our fuzzers and which right now always calls `git_libgit2_init`, one exception to this rule is our error path when not enough arguments have been given. In this case, we will call `git_vector_free_deep` without libgit2 having been initialized. As we did not set up our allocation functions in that case, this will lead to a segmentation fault. Fix the issue by always initializing and shutting down libgit2 in the standalone driver. Note that we cannot let this replace the initialization in `LLVMFuzzerInitialize`, as it is required when using the "real" fuzzers by LLVM without our standalone driver. It's no problem to call the initialization and deinitialization functions multiple times, though.

diff --git a/fuzzers/standalone_driver.c b/fuzzers/standalone_driver.c
index fd8453d..000bfbf 100644
--- a/fuzzers/standalone_driver.c
+++ b/fuzzers/standalone_driver.c
@@ -11,6 +11,7 @@
 #include <stdlib.h>
 #include <sys/types.h>
 
+#include "git2.h"
 #include "fileops.h"
 #include "path.h"
 
@@ -41,6 +42,11 @@ int main(int argc, char **argv)
 	unsigned i = 0;
 	int error = 0;
 
+	if (git_libgit2_init() < 0) {
+		fprintf(stderr, "Failed to initialize libgit2\n");
+		abort();
+	}
+
 	if (argc != 2) {
 		fprintf(stderr, "Usage: %s <corpus directory>\n", argv[0]);
 		error = -1;
@@ -66,5 +72,6 @@ int main(int argc, char **argv)
 
 exit:
 	git_vector_free_deep(&corpus_files);
+	git_libgit2_shutdown();
 	return error;
 }