From d5c52ab39fa42e9b7ed7418046cbb71257d2b8da Mon Sep 17 00:00:00 2001
From: "Reece H. Dunn" <msclrhd@gmail.com>
Date: Mon, 19 Mar 2018 21:50:08 +0000
Subject: [PATCH] Fix building ssml-fuzzer with libFuzzer.

---
 Makefile.am  | 19 ++++++++++++-------
 README.md    | 19 +++++++++++++++++--
 configure.ac | 17 +++++++++++++++++
 3 files changed, 46 insertions(+), 9 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index 4760f731..fc43bdc0 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -261,19 +261,24 @@ check:	tests/encoding.check \
 
 ##### fuzzer:
 
-# When OSS-Fuzz [https://github.com/google/oss-fuzz] runs our fuzzer, it sets
-# LIB_FUZZING_ENGINE to libFuzzer [http://llvm.org/docs/LibFuzzer.html].
-# When running outside OSS-Fuzz, we link against our own stub fuzzrunner.
-LIB_FUZZING_ENGINE ?= tests/libfuzzrunner.la
-
+if !HAVE_LIBFUZZER
+# libfuzzrunner is a stub implementation of libFuzzer that calls the
+# LLVMFuzzerTestOneInput with the files passed to the fuzzer program.
 lib_LTLIBRARIES += tests/libfuzzrunner.la
 tests_libfuzzrunner_la_CFLAGS  = -Isrc/libespeak-ng ${AM_CFLAGS}
 tests_libfuzzrunner_la_SOURCES = tests/fuzzrunner.c
+endif
 
 noinst_bin_PROGRAMS += tests/ssml-fuzzer.test
-tests_ssml_fuzzer_test_LDADD   = src/libespeak-ng.la ${LIB_FUZZING_ENGINE}
+tests_ssml_fuzzer_test_LDADD   = src/libespeak-ng.la
 tests_ssml_fuzzer_test_SOURCES = tests/ssml-fuzzer.c
-tests_ssml_fuzzer_test_DEPENDENCIES = src/libespeak-ng.la tests/libfuzzrunner.la
+
+if HAVE_LIBFUZZER
+tests_ssml_fuzzer_test_CFLAGS  = -fsanitize=fuzzer
+tests_ssml_fuzzer_test_LDFLAGS = -fsanitize=fuzzer
+else
+tests_ssml_fuzzer_test_LDADD += tests/libfuzzrunner.la
+endif
 
 tests/ssml-fuzzer.check: tests/ssml-fuzzer.test
 	@echo "  TEST      $<"
diff --git a/README.md b/README.md
index 5f9021c7..7134ef5b 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,8 @@
   - [Dependencies](#dependencies)
   - [Building](#building-1)
     - [Cross Compilation](#cross-compilation)
-    - [Sanitizer](#sanitizer)
+    - [Sanitizer Flag Configuration](#sanitizer-flag-configuration)
+    - [LLVM Fuzzer Support](#llvm-fuzzer-support)
     - [eSpeak NG Feature Configuration](#espeak-ng-feature-configuration)
     - [Extended Dictionary Configuration](#extended-dictionary-configuration)
   - [Testing](#testing)
@@ -177,7 +178,7 @@ built it locally you can perform the cross compilation using:
 	./configure --build=... --host=... --target=...
 	make -B src/espeak-ng src/speak-ng
 
-#### Sanitizer
+#### Sanitizer Flag Configuration
 
 It is possible to build eSpeak NG with the gcc or clang sanitizer by passing
 the appropriate `CFLAGS` and `LDFLAGS` options to `configure`. For example:
@@ -188,6 +189,20 @@ the appropriate `CFLAGS` and `LDFLAGS` options to `configure`. For example:
 	make
 	make check
 
+__NOTE:__ The `-fsanitize=fuzzer` option does not work when using the above
+configuration method. This is because `clang` will use the `libFuzzer` library
+which defines its own `main` and requires `LLVMFuzzerTestOneInput` to be
+defined. This breaks the autoconf check to see if the C compiler works.
+
+#### LLVM Fuzzer Support
+
+To enable libFuzzer support you need clang 6.0 or later. It is enabled with
+the following:
+
+	CC=clang-6.0 ./configure --with-libfuzzer=yes
+	make
+	make check
+
 #### eSpeak NG Feature Configuration
 
 The following `configure` options control which eSpeak NG features are enabled:
diff --git a/configure.ac b/configure.ac
index 9fb64e41..8d35e170 100644
--- a/configure.ac
+++ b/configure.ac
@@ -86,6 +86,7 @@ fi
 dnl ================================================================
 dnl FreeBSD check.
 dnl ================================================================
+
 AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
 		   #if ! defined(__FreeBSD__)
 		   #error macro not defined
@@ -282,6 +283,22 @@ AX_CHECK_COMPILE_FLAG([-Wuninitialized],         [CFLAGS="-Wuninitialized $CFLAG
 AX_CHECK_COMPILE_FLAG([-Wunused],                [CFLAGS="-Wunused $CFLAGS"])
 AX_CHECK_COMPILE_FLAG([-Wunused-parameter],      [CFLAGS="-Wunused-parameter $CFLAGS"])
 
+dnl ================================================================
+dnl libFuzzer checks.
+dnl ================================================================
+
+AC_ARG_WITH([libfuzzer],
+    [AS_HELP_STRING([--with-libfuzzer], [enable libFuzzer in the fuzzer tests @<:@default=no@:>@])],
+    [])
+
+if test "$with_libfuzzer" = "yes" ; then
+	have_libfuzzer=yes
+else
+	have_libfuzzer=no
+fi
+
+AM_CONDITIONAL(HAVE_LIBFUZZER, [test x"$have_libfuzzer" = xyes])
+
 dnl ================================================================
 dnl Generate output.
 dnl ================================================================