Allow tests to directly call loader internal functions

charles-lunarg · charles-lunarg · commit fb22e75ea5c1 · 2025-01-06T14:04:28.000-07:00
This allows the fuzz tests to faithfully recreate the calling environment
of OSS-Fuzz, meaning reproduction of failing fuzz tests can be done in the
repo for regression testing.

The implementation of this requires exporting several functions that the
fuzz tests need which is done with a new macro that is only active when
a specific compiler definition is set, which the build does when testing
is active.
diff --git a/loader/CMakeLists.txt b/loader/CMakeLists.txt
@@ -517,6 +517,10 @@ if (UNKNOWN_FUNCTIONS_SUPPORTED)
     add_dependencies(vulkan loader_asm_gen_files)
 endif()
 
+if (BUILD_TESTS)
+    target_compile_definitions(vulkan PRIVATE SHOULD_EXPORT_TEST_FUNCTIONS)
+endif()
+
 if (APPLE_STATIC_LOADER)
     # TLDR: This feature only exists at the request of Google for Chromium. No other project should use this!
     message(NOTICE "Apple STATIC lib: it will be built but not installed, and vulkan.pc and VulkanLoaderConfig.cmake won't be generated!")
diff --git a/loader/cJSON.c b/loader/cJSON.c
@@ -150,7 +150,7 @@ static cJSON *cJSON_New_Item(const VkAllocationCallbacks *pAllocator) {
 }
 
 /* Delete a cJSON structure. */
-CJSON_PUBLIC(void) loader_cJSON_Delete(cJSON *item) {
+TEST_FUNCTION_EXPORT CJSON_PUBLIC(void) loader_cJSON_Delete(cJSON *item) {
     cJSON *next = NULL;
     while (item != NULL) {
         next = item->next;
@@ -949,7 +949,9 @@ static unsigned char *print(const cJSON *const item, cJSON_bool format, bool *ou
 }
 
 /* Render a cJSON item/entity/structure to text. */
-CJSON_PUBLIC(char *) loader_cJSON_Print(const cJSON *item, bool *out_of_memory) { return (char *)print(item, true, out_of_memory); }
+TEST_FUNCTION_EXPORT CJSON_PUBLIC(char *) loader_cJSON_Print(const cJSON *item, bool *out_of_memory) {
+    return (char *)print(item, true, out_of_memory);
+}
 
 CJSON_PUBLIC(char *) loader_cJSON_PrintUnformatted(const cJSON *item, bool *out_of_memory) {
     return (char *)print(item, false, out_of_memory);
diff --git a/loader/cJSON.h b/loader/cJSON.h
@@ -88,6 +88,8 @@ then using the CJSON_API_VISIBILITY flag to "export" the same symbols the way CJ
 #include <stddef.h>
 #include <stdbool.h>
 
+#include "vk_loader_platform.h"
+
 /* cJSON Types: */
 #define cJSON_Invalid (0)
 #define cJSON_False (1 << 0)
@@ -163,7 +165,7 @@ loader_cJSON_ParseWithLengthOpts(const VkAllocationCallbacks *pAllocator, const
                                  const char **return_parse_end, cJSON_bool require_null_terminated, bool *out_of_memory);
 
 /* Render a cJSON entity to text for transfer/storage. */
-CJSON_PUBLIC(char *) loader_cJSON_Print(const cJSON *item, bool *out_of_memory);
+TEST_FUNCTION_EXPORT CJSON_PUBLIC(char *) loader_cJSON_Print(const cJSON *item, bool *out_of_memory);
 /* Render a cJSON entity to text for transfer/storage without any formatting. */
 CJSON_PUBLIC(char *) loader_cJSON_PrintUnformatted(const cJSON *item, bool *out_of_memory);
 /* Render a cJSON entity to text using a buffered strategy. prebuffer is a guess at the final size. guessing well reduces
@@ -177,7 +179,7 @@ loader_cJSON_PrintBuffered(const cJSON *item, int prebuffer, cJSON_bool fmt, boo
 CJSON_PUBLIC(cJSON_bool)
 loader_cJSON_PrintPreallocated(cJSON *item, char *buffer, const int length, const cJSON_bool format);
 /* Delete a cJSON entity and all subentities. */
-CJSON_PUBLIC(void) loader_cJSON_Delete(cJSON *item);
+TEST_FUNCTION_EXPORT CJSON_PUBLIC(void) loader_cJSON_Delete(cJSON *item);
 
 /* Returns the number of items in an array (or object). */
 CJSON_PUBLIC(int) loader_cJSON_GetArraySize(const cJSON *array);
diff --git a/loader/loader.c b/loader/loader.c
@@ -508,7 +508,8 @@ bool loader_find_layer_name_in_blacklist(const char *layer_name, struct loader_l
 }
 
 // Remove all layer properties entries from the list
-void loader_delete_layer_list_and_properties(const struct loader_instance *inst, struct loader_layer_list *layer_list) {
+TEST_FUNCTION_EXPORT void loader_delete_layer_list_and_properties(const struct loader_instance *inst,
+                                                                  struct loader_layer_list *layer_list) {
     uint32_t i;
     if (!layer_list) return;
 
diff --git a/loader/loader.h b/loader/loader.h
@@ -154,7 +154,8 @@ VkResult loader_add_device_extensions(const struct loader_instance *inst,
 VkResult loader_init_generic_list(const struct loader_instance *inst, struct loader_generic_list *list_info, size_t element_size);
 void loader_destroy_generic_list(const struct loader_instance *inst, struct loader_generic_list *list);
 void loader_destroy_pointer_layer_list(const struct loader_instance *inst, struct loader_pointer_layer_list *layer_list);
-void loader_delete_layer_list_and_properties(const struct loader_instance *inst, struct loader_layer_list *layer_list);
+TEST_FUNCTION_EXPORT void loader_delete_layer_list_and_properties(const struct loader_instance *inst,
+                                                                  struct loader_layer_list *layer_list);
 void loader_remove_layer_in_list(const struct loader_instance *inst, struct loader_layer_list *layer_list,
                                  uint32_t layer_to_remove);
 VkResult loader_init_scanned_icd_list(const struct loader_instance *inst, struct loader_icd_tramp_list *icd_tramp_list);
diff --git a/loader/loader_json.c b/loader/loader_json.c
@@ -136,7 +136,7 @@ VkResult loader_read_entire_file(const struct loader_instance *inst, const char
 }
 #endif
 
-VkResult loader_get_json(const struct loader_instance *inst, const char *filename, cJSON **json) {
+TEST_FUNCTION_EXPORT VkResult loader_get_json(const struct loader_instance *inst, const char *filename, cJSON **json) {
     char *json_buf = NULL;
     VkResult res = VK_SUCCESS;
 
diff --git a/loader/loader_json.h b/loader/loader_json.h
@@ -38,7 +38,7 @@ struct loader_string_list;
 //
 // @return -  A pointer to a cJSON object representing the JSON parse tree.
 //            This returned buffer should be freed by caller.
-VkResult loader_get_json(const struct loader_instance *inst, const char *filename, cJSON **json);
+TEST_FUNCTION_EXPORT VkResult loader_get_json(const struct loader_instance *inst, const char *filename, cJSON **json);
 
 // Given a cJSON object, find the string associated with the key and puts an pre-allocated string into out_string.
 // Length is given by out_str_len, and this function truncates the string with a null terminator if it the provided space isn't
diff --git a/loader/settings.c b/loader/settings.c
@@ -484,7 +484,7 @@ VkResult get_loader_settings(const struct loader_instance* inst, loader_settings
     return res;
 }
 
-VkResult update_global_loader_settings(void) {
+TEST_FUNCTION_EXPORT VkResult update_global_loader_settings(void) {
     loader_settings settings = {0};
     VkResult res = get_loader_settings(NULL, &settings);
     loader_platform_thread_lock_mutex(&global_loader_settings_lock);
@@ -538,8 +538,8 @@ void release_current_settings_lock(const struct loader_instance* inst) {
     }
 }
 
-VkResult get_settings_layers(const struct loader_instance* inst, struct loader_layer_list* settings_layers,
-                             bool* should_search_for_other_layers) {
+TEST_FUNCTION_EXPORT VkResult get_settings_layers(const struct loader_instance* inst, struct loader_layer_list* settings_layers,
+                                                  bool* should_search_for_other_layers) {
     VkResult res = VK_SUCCESS;
     *should_search_for_other_layers = true;  // default to true
 
diff --git a/loader/settings.h b/loader/settings.h
@@ -30,6 +30,7 @@
 #include "vulkan/vulkan_core.h"
 
 #include "log.h"
+#include "vk_loader_platform.h"
 
 struct loader_instance;
 struct loader_layer_list;
@@ -83,7 +84,7 @@ void free_loader_settings(const struct loader_instance* inst, loader_settings* l
 void log_settings(const struct loader_instance* inst, loader_settings* settings);
 
 // Every global function needs to call this at startup to insure that
-VkResult update_global_loader_settings(void);
+TEST_FUNCTION_EXPORT VkResult update_global_loader_settings(void);
 
 // Needs to be called during startup -
 void init_global_loader_settings(void);
@@ -94,8 +95,8 @@ bool should_skip_logging_global_messages(VkFlags msg_type);
 
 // Query the current settings (either global or per-instance) and return the list of layers contained within.
 // should_search_for_other_layers tells the caller if the settings file should be used exclusively for layer searching or not
-VkResult get_settings_layers(const struct loader_instance* inst, struct loader_layer_list* settings_layers,
-                             bool* should_search_for_other_layers);
+TEST_FUNCTION_EXPORT VkResult get_settings_layers(const struct loader_instance* inst, struct loader_layer_list* settings_layers,
+                                                  bool* should_search_for_other_layers);
 
 // Take the provided list of settings_layers and add in the layers from regular search paths
 // Only adds layers that aren't already present in the settings_layers and in the location of the
diff --git a/loader/vk_loader_platform.h b/loader/vk_loader_platform.h
@@ -89,6 +89,17 @@
 #define LOADER_EXPORT
 #endif
 
+// For testing purposes, we want to expose some functions not normally callable on the library
+#if defined(SHOULD_EXPORT_TEST_FUNCTIONS)
+#if defined(_WIN32)
+#define TEST_FUNCTION_EXPORT __declspec(dllexport)
+#else
+#define TEST_FUNCTION_EXPORT LOADER_EXPORT
+#endif
+#else
+#define TEST_FUNCTION_EXPORT
+#endif
+
 #define MAX_STRING_SIZE 1024
 
 // This is defined in vk_layer.h, but if there's problems we need to create the define
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
@@ -83,7 +83,6 @@ add_executable(
         loader_envvar_tests.cpp
         loader_get_proc_addr_tests.cpp
         loader_debug_ext_tests.cpp
-        loader_fuzz_tests.cpp
         loader_handle_validation_tests.cpp
         loader_layer_tests.cpp
         loader_regression_tests.cpp
@@ -95,6 +94,14 @@ add_executable(
 target_link_libraries(test_regression PUBLIC testing_dependencies)
 target_compile_definitions(test_regression PUBLIC VK_NO_PROTOTYPES)
 
+add_executable(
+    test_fuzzing
+        loader_testing_main.cpp
+        loader_fuzz_tests.cpp
+)
+target_link_libraries(test_fuzzing PUBLIC testing_dependencies vulkan)
+target_include_directories(test_fuzzing PUBLIC ${CMAKE_SOURCE_DIR}/loader ${CMAKE_SOURCE_DIR}/loader/generated)
+
 # Threading tests live in separate executabe just for threading tests as it'll need support
 # in the test harness to enable in CI, as thread sanitizer doesn't work with address sanitizer enabled.
 add_executable(
@@ -110,10 +117,10 @@ if (ENABLE_LIVE_VERIFICATION_TESTS)
 endif()
 
 if(WIN32)
-    # Copy the loader shared lib (if built) to the test application directory so the test app finds it.
+    # Copy vulkan-1.dll to the test_fuzzing build directory so that the test_fuzzing exe can find it.
     if(TARGET vulkan)
-        add_custom_command(TARGET test_regression POST_BUILD
-                           COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_FILE:vulkan> $<TARGET_FILE_DIR:test_regression>)
+        add_custom_command(TARGET test_fuzzing POST_BUILD
+                           COMMAND ${CMAKE_COMMAND} -E copy $<TARGET_FILE:vulkan> $<TARGET_FILE_DIR:test_fuzzing>)
     endif()
 endif()
 
@@ -128,8 +135,10 @@ endif()
 # must happen after the dll's get copied over
 if(NOT CMAKE_CROSSCOMPILING)
     gtest_discover_tests(test_regression PROPERTIES DISCOVERY_TIMEOUT 100)
+    gtest_discover_tests(test_fuzzing PROPERTIES DISCOVERY_TIMEOUT 100)
 else()
     gtest_add_tests(TARGET test_regression)
+    gtest_add_tests(TARGET test_fuzzing)
 endif()
 
 # When APPLE_STATIC_LOADER is ON installation is disabled
@@ -163,4 +172,5 @@ set_tests_properties(integration.find_package PROPERTIES DEPENDS integration.ins
 
 if (CODE_COVERAGE)
     target_code_coverage(test_regression AUTO ALL )
+    target_code_coverage(test_fuzzing AUTO ALL )
 endif()
diff --git a/tests/loader_fuzz_tests.cpp b/tests/loader_fuzz_tests.cpp
@@ -27,6 +27,12 @@
 
 #include "test_environment.h"
 
+extern "C" {
+#include "loader.h"
+#include "loader_json.h"
+#include "settings.h"
+}
+
 void execute_instance_enumerate_fuzzer(std::filesystem::path const& filename) {
     FrameworkEnvironment env{};
     env.write_file_from_source((std::filesystem::path(CLUSTERFUZZ_TESTCASE_DIRECTORY) / filename).string().c_str(),
@@ -75,22 +81,37 @@ void execute_instance_create_fuzzer(std::filesystem::path const& filename) {
     env.vulkan_functions.vkDestroyInstance(inst, NULL);
 }
 
-void execute_json_load_fuzzer(std::filesystem::path const& filename) {
+void execute_json_load_fuzzer(std::string const& filename) {
     FrameworkEnvironment env{};
 
-    env.write_file_from_source((std::filesystem::path(CLUSTERFUZZ_TESTCASE_DIRECTORY) / filename).string().c_str(),
-                               ManifestCategory::explicit_layer, ManifestLocation::explicit_layer, "complex_layer.json");
-    uint32_t count = 0;
-    env.vulkan_functions.vkEnumerateInstanceLayerProperties(&count, nullptr);
+    cJSON* json = NULL;
+    loader_get_json(NULL, filename.c_str(), &json);
+
+    if (json == NULL) {
+        return;
+    }
+    bool out_of_mem = false;
+    char* json_data = loader_cJSON_Print(json, &out_of_mem);
+
+    if (json_data != NULL) {
+        free(json_data);
+    }
+
+    if (json != NULL) {
+        loader_cJSON_Delete(json);
+    }
 }
 void execute_setting_fuzzer(std::filesystem::path const& filename) {
     FrameworkEnvironment env{};
 
     env.write_file_from_source((std::filesystem::path(CLUSTERFUZZ_TESTCASE_DIRECTORY) / filename).string().c_str(),
                                ManifestCategory::settings, ManifestLocation::settings_location, "vk_loader_settings.json");
 
-    uint32_t version = 0;
-    env.vulkan_functions.vkEnumerateInstanceVersion(&version);
+    update_global_loader_settings();
+    struct loader_layer_list settings_layers = {0};
+    bool should_search_for_other_layers = true;
+    get_settings_layers(NULL, &settings_layers, &should_search_for_other_layers);
+    loader_delete_layer_list_and_properties(NULL, &settings_layers);
 }
 
 TEST(BadJsonInput, ClusterFuzzTestCase_5599244505186304) {

Original file line number	Diff line number	Diff line change
`@@ -508,7 +508,8 @@ bool loader_find_layer_name_in_blacklist(const char *layer_name, struct loader_l`
`508`	`508`	`}`
`509`	`509`
`510`	`510`	`// Remove all layer properties entries from the list`
`511`		`-void loader_delete_layer_list_and_properties(const struct loader_instance inst, struct loader_layer_list layer_list) {`
	`511`	`+TEST_FUNCTION_EXPORT void loader_delete_layer_list_and_properties(const struct loader_instance *inst,`
	`512`	`+ struct loader_layer_list *layer_list) {`
`512`	`513`	`uint32_t i;`
`513`	`514`	`if (!layer_list) return;`
`514`	`515`
Original file line number	Diff line number	Diff line change
`@@ -136,7 +136,7 @@ VkResult loader_read_entire_file(const struct loader_instance *inst, const char`
`136`	`136`	`}`
`137`	`137`	`#endif`
`138`	`138`
`139`		`-VkResult loader_get_json(const struct loader_instance inst, const char filename, cJSON **json) {`
	`139`	`+TEST_FUNCTION_EXPORT VkResult loader_get_json(const struct loader_instance inst, const char filename, cJSON **json) {`
`140`	`140`	`char *json_buf = NULL;`
`141`	`141`	`VkResult res = VK_SUCCESS;`
`142`	`142`
Original file line number	Diff line number	Diff line change
`@@ -484,7 +484,7 @@ VkResult get_loader_settings(const struct loader_instance* inst, loader_settings`
`484`	`484`	`return res;`
`485`	`485`	`}`
`486`	`486`
`487`		`-VkResult update_global_loader_settings(void) {`
	`487`	`+TEST_FUNCTION_EXPORT VkResult update_global_loader_settings(void) {`
`488`	`488`	`loader_settings settings = {0};`
`489`	`489`	`VkResult res = get_loader_settings(NULL, &settings);`
`490`	`490`	`loader_platform_thread_lock_mutex(&global_loader_settings_lock);`
`@@ -538,8 +538,8 @@ void release_current_settings_lock(const struct loader_instance* inst) {`
`538`	`538`	`}`
`539`	`539`	`}`
`540`	`540`
`541`		`-VkResult get_settings_layers(const struct loader_instance* inst, struct loader_layer_list* settings_layers,`
`542`		`- bool* should_search_for_other_layers) {`
	`541`	`+TEST_FUNCTION_EXPORT VkResult get_settings_layers(const struct loader_instance* inst, struct loader_layer_list* settings_layers,`
	`542`	`+ bool* should_search_for_other_layers) {`
`543`	`543`	`VkResult res = VK_SUCCESS;`
`544`	`544`	`*should_search_for_other_layers = true; // default to true`
`545`	`545`