schwa

Using LLVM's libfuzzer with Swift

Background

Of the many tools available for fuzzing, I've found that LLVM's libfuzzer is the easiest to use for Swift on macOS. Other tools seem to have a list of requirements taht are difficult to meet. libfuzzer on the other hand is built into LLVM and is available on macOS in the custom Swift toolchains: https://www.swift.org/download/

In this document I'll describe how to use libfuzzer with Swift and Swift Packages.

I used this setup to fuzz an SVG Renderer package that I am building. I was able to find and fix a number of bugs in my SVG parsing code using libfuzzer in basically no time at all.

BigZaphod

//
// A Swift property wrapper for adding "indirect" to struct properties.
// Enum supports this out of the box, but for some reason struct doesn't.
//
// This is useful when you want to do something recursive with structs like:
//
// struct Node {
//   var next: Node?
// }
//

jspahrsummers

//
//  GHReadWriteQueue.h
//  GitHub
//
//  Created by Justin Spahr-Summers on 2014-03-24.
//  Copyright (c) 2014 GitHub. All rights reserved.
//

#import <Foundation/Foundation.h>

kyleve

/**
 Provides the ability to verify key paths at compile time.
 
 If "keyPath" does not exist, a compile-time error will be generated.
 
 Example:
    // Verifies "isFinished" exists on "operation".
    NSString *key = SQKeyPath(operation, isFinished);
 
    // Verifies "isFinished" exists on self.

incanus

INFO=$( echo $TARGET_BUILD_DIR )/$( echo $INFOPLIST_PATH | sed -e 's/\.plist$//' )
echo $INFO
TAG=
COMMIT=
CURRENT=
CURRENT_BUILD=
GITPATH=/usr/bin:/usr/local/bin:/usr/local/git/bin
PATH=$PATH:$GITPATH; export PATH

if [ -z $( which git ) ]; then

steipete

///////////////////////////////////////////////////////////////////////////////////////////
#pragma mark - Warn if we KVO a weak property

// Doesn't support key paths.
static BOOL PSPDFIsWeakProperty(id object, NSString *keyPath) {
    objc_property_t property = class_getProperty([object class], keyPath.UTF8String);
    if (property) {
        // https://developer.apple.com/library/mac/documentation/cocoa/conceptual/objcruntimeguide/articles/ocrtpropertyintrospection.html
        const char *attributes = property_getAttributes(property);
        return attributes && strstr(attributes, ",W");

mattt

Generate the list yourself:

$ cd /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS*.sdk/System/Library/Frameworks/UIKit.framework/Headers
$ grep UI_APPEARANCE_SELECTOR ./*     | \
  sed 's/NS_AVAILABLE_IOS(.*)//g'     | \
  sed 's/NS_DEPRECATED_IOS(.*)//g'    | \
  sed 's/API_AVAILABLE(.*)//g'        | \
  sed 's/API_UNAVAILABLE(.*)//g'      | \
 sed 's/UI_APPEARANCE_SELECTOR//g' | \

steipete

// Convert an EXIF image orientation to an iOS one.
// reference see here: http://sylvana.net/jpegcrop/exif_orientation.html

+ (UIImageOrientation) exifOrientationToiOSOrientation:(int)exifOrientation {
    UIImageOrientation o = UIImageOrientationUp;
    switch (exifOrientation) {
        case 1: o = UIImageOrientationUp; break;
        case 3: o = UIImageOrientationDown; break;
        case 8: o = UIImageOrientationLeft; break;
        case 6: o = UIImageOrientationRight; break;

steipete

// Smart little helper to find main thread hangs. Enable in appDidFinishLaunching.
// Only available with source code in DEBUG mode.
@interface PSPDFHangDetector : NSObject
+ (void)startHangDetector;
@end


@implementation PSPDFHangDetector
+ (void)startHangDetector {
#ifdef DEBUG

adamawolf

i386 : iPhone Simulator
x86_64 : iPhone Simulator
arm64 : iPhone Simulator
iPhone1,1 : iPhone
iPhone1,2 : iPhone 3G
iPhone2,1 : iPhone 3GS
iPhone3,1 : iPhone 4
iPhone3,2 : iPhone 4 GSM Rev A
iPhone3,3 : iPhone 4 CDMA
iPhone4,1 : iPhone 4S