# Copyright 2021 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Simple fuzz targets that demonstrate the Bazel extension functionality and
# serve as regression tests. Targets that are expected to crash or hang are
# disabled in the OSS-Fuzz integration using the "no-oss-fuzz" tag.

load("@rules_cc//cc:defs.bzl", "cc_binary")
load("//fuzzing:java_defs.bzl", "java_fuzz_test")

filegroup(
    name = "corpus",
    srcs = [
        "corpus_0.txt",
        "corpus_1.txt",
    ],
)

java_fuzz_test(
    name = "EmptyFuzzTest",
    size = "small",
    srcs = ["com/example/EmptyFuzzTest.java"],
    corpus = [
        "corpus_0.txt",
    ],
)

java_fuzz_test(
    name = "FuzzTest",
    timeout = "short",
    srcs = ["com/example/FuzzTest.java"],
    tags = [
        "no-oss-fuzz",
    ],
)

java_fuzz_test(
    name = "NativeFuzzTest",
    srcs = ["com/example/NativeFuzzTest.java"],
    corpus = [
        ":corpus",
    ],
    tags = [
        "no-oss-fuzz",
    ],
    # The JVM expects a native library on macOS to have the .dylib extension,
    # but due to a bug in Bazel the shared library extension defaults to .so
    # there. This can be worked around by specifying the desired extension in
    # the name of the rule and selecting the correct one based on the platform.
    # See https://github.com/bazelbuild/bazel/issues/11082.
    deps = select({
        "@platforms//os:macos": [":libnative.dylib"],
        "//conditions:default": [":native"],
    }),
)

# A Java fuzz test with a native library, both of which have declared data
# dependencies that they can access at runtime.
java_fuzz_test(
    name = "NativeRunfileFuzzTest",
    srcs = ["com/example/NativeRunfileFuzzTest.java"],
    data = [
        "corpus_0.txt",
    ],
    # See NativeFuzzTest for why this uses a select.
    deps = select({
        "@platforms//os:macos": [":libnative_runfile.dylib"],
        "//conditions:default": [":native_runfile"],
    }) + [
        "@bazel_tools//tools/java/runfiles",
    ],
)

# A Java fuzz test with a native library that calls a function through a pointer
# of an incorrect type, which is detected by UBSan.
java_fuzz_test(
    name = "NativeUbsanFuncPtrFuzzTest",
    srcs = ["com/example/NativeUbsanFuncPtrFuzzTest.java"],
    deps = select({
        "@platforms//os:macos": [":libnative_ubsan_func_ptr.dylib"],
        "//conditions:default": [":native_ubsan_func_ptr"],
    }),
)

# A native library that interfaces with Java through the JNI.
# It contains an out-of-bounds read is detected by ASan.
cc_binary(
    name = "native",
    # Build as a shared library that can be loaded by a Java application at
    # runtime via System.loadLibrary().
    linkshared = True,
    tags = ["manual"],
    deps = [
        ":native_lib",
    ],
)

# The same shared library as :native, but with the correct extension for macOS.
# See the comment on :NativeFuzzTest for why this is needed.
cc_binary(
    name = "libnative.dylib",
    linkshared = True,
    tags = ["manual"],
    deps = [
        ":native_lib",
    ],
)

# The implementation shared by :native and :libnative.dylib, which differ only
# in the name of the resulting shared library.
cc_library(
    name = "native_lib",
    srcs = [
        "com/example/NativeFuzzTest.cpp",
        "com/example/NativeFuzzTest.h",
    ],
    deps = [
        "@bazel_tools//tools/jdk:jni",
    ],
    # Required because :native and :libnative.dylib to not reference any symbols
    # of this library, which means that it wouldn't be linked at all without
    # this.
    alwayslink = True,
)

# A shared library that demonstrates that fuzz targets can find their Bazel
# data dependencies at runtime, both from Java and native code.
cc_binary(
    name = "native_runfile",
    linkshared = True,
    tags = ["manual"],
    deps = [
        ":native_runfile_lib",
    ],
)

# The same shared library as :native_runfile, but with the correct extension for
# macOS. See the comment on :NativeFuzzTest for why this is needed.
cc_binary(
    name = "libnative_runfile.dylib",
    linkshared = True,
    tags = ["manual"],
    deps = [
        ":native_runfile_lib",
    ],
)

cc_library(
    name = "native_runfile_lib",
    srcs = [
        "com/example/NativeRunfileFuzzTest.cpp",
        "com/example/NativeRunfileFuzzTest.h",
    ],
    data = [
        "corpus_1.txt",
    ],
    deps = [
        "@bazel_tools//tools/cpp/runfiles",
        "@bazel_tools//tools/jdk:jni",
    ],
    alwayslink = True,
)

cc_binary(
    name = "native_ubsan_func_ptr",
    linkshared = True,
    tags = ["manual"],
    deps = [
        ":native_ubsan_func_ptr_lib",
    ],
)

cc_binary(
    name = "libnative_ubsan_func_ptr.dylib",
    linkshared = True,
    tags = ["manual"],
    deps = [
        ":native_ubsan_func_ptr_lib",
    ],
)

cc_library(
    name = "native_ubsan_func_ptr_lib",
    srcs = [
        "com/example/NativeUbsanFuncPtrFuzzTest.cpp",
        "com/example/NativeUbsanFuncPtrFuzzTest.h",
    ],
    deps = [
        "@bazel_tools//tools/jdk:jni",
    ],
    alwayslink = True,
)