[Zucchini] Add ELF fuzzer

This CL introduces a fuzzer for the ELF disassemblers in Zucchini. I
have already uploaded some corpus files to the clusterfuzz-corpus
Google Storage bucket.

Achieves ~700 exec/s locally. This is on-par with the DEX and Win32
disassemblers as it requires a largish representative file to serve
as a test. (Recommendation is ~1000 exec/s).

Brings up coverage of ELF related code from 0-30% to 80-100%

I expect this will find quite a few crashes early on but should
stabilize within a couple of weeks; est. 1-2 bugfixes per day
based on how DEX and Win32 went. Mostly checked_casts and bounds
issues.

Bug: 1013641
Change-Id: I205135547cad2a95e59f99d7f040c13d72c45b59
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1856624
Commit-Queue: Calder Kitagawa <ckitagawa@chromium.org>
Reviewed-by: Etienne Pierre-Doray <etiennep@chromium.org>
Cr-Commit-Position: refs/heads/master@{#705245}
NOKEYCHECK=True
GitOrigin-RevId: b00aaabae0e86b84d0007f76f7736fe2db397aaf

1 files changed, 29 insertions, 2 deletions

diff --git a/fuzzers/BUILD.gn b/fuzzers/BUILD.gn
index e2720fc..effc22d 100644
--- a/fuzzers/BUILD.gn
+++ b/fuzzers/BUILD.gn
@@ -5,10 +5,21 @@
 import("//testing/libfuzzer/fuzzer_test.gni")
 import("//third_party/protobuf/proto_library.gni")
 
+static_library("zucchini_fuzz_utils") {
+  sources = [
+    "fuzz_utils.cc",
+    "fuzz_utils.h",
+  ]
+  deps = [
+    "//base",
+    "//components/zucchini:zucchini_lib",
+  ]
+}
+
 # To download the corpus for local fuzzing use:
 # gsutil -m rsync \
 #   gs://clusterfuzz-corpus/libfuzzer/zucchini_disassembler_dex_fuzzer \
-#   components/zucchini/fuzzing/testdata/disassembler_dex_fuzzer
+#   components/zucchini/fuzzing/testdata/disassembler_dex_fuzzer/
 fuzzer_test("zucchini_disassembler_dex_fuzzer") {
   sources = [
     "disassembler_dex_fuzzer.cc",
@@ -22,12 +33,28 @@ fuzzer_test("zucchini_disassembler_dex_fuzzer") {
 # To download the corpus for local fuzzing use:
 # gsutil -m rsync \
 #   gs://clusterfuzz-corpus/libfuzzer/zucchini_disassembler_win32_fuzzer \
-#   components/zucchini/fuzzing/testdata/disassembler_win32_fuzzer
+#   components/zucchini/fuzzing/testdata/disassembler_win32_fuzzer/
 fuzzer_test("zucchini_disassembler_win32_fuzzer") {
   sources = [
     "disassembler_win32_fuzzer.cc",
   ]
   deps = [
+    ":zucchini_fuzz_utils",
+    "//base",
+    "//components/zucchini:zucchini_lib",
+  ]
+}
+
+# To download the corpus for local fuzzing use:
+# gsutil -m rsync \
+#   gs://clusterfuzz-corpus/libfuzzer/zucchini_disassembler_elf_fuzzer \
+#   components/zucchini/fuzzing/testdata/disassembler_elf_fuzzer/
+fuzzer_test("zucchini_disassembler_elf_fuzzer") {
+  sources = [
+    "disassembler_elf_fuzzer.cc",
+  ]
+  deps = [
+    ":zucchini_fuzz_utils",
     "//base",
     "//components/zucchini:zucchini_lib",
   ]