add cxa_demangle_fuzzer

Summary:
All easy-to-find bugs in cxa_demangle where fixed now
(https://bugs.chromium.org/p/chromium/issues/detail?id=606626)
except for one (https://llvm.org/bugs/show_bug.cgi?id=31031).
Now I'd like to properly integrate this fuzzer with the source tree
and then run the fuzzer continuously on https://github.com/google/oss-fuzz

Reviewers: compnerd, mclow.lists, mehdi_amini

Subscribers: cfe-commits, mgorny

Differential Revision: https://reviews.llvm.org/D28133

git-svn-id: https://llvm.org/svn/llvm-project/libcxxabi/trunk@290650 91177308-0d34-0410-b5e6-96231b3b80d8

CMakeLists.txt

@@ -432,4 +432,5 @@ if (LIBCXXABI_STANDALONE_BUILD AND NOT LIBCXXABI_ENABLE_SHARED)
                   "available!")
 else()
   add_subdirectory(test)
+  add_subdirectory(fuzz)
 endif()

fuzz/CMakeLists.txt

@@ -0,0 +1,11 @@
+# See http://llvm.org/docs/LibFuzzer.html
+if( LLVM_USE_SANITIZE_COVERAGE )
+  add_executable(cxa_demangle_fuzzer
+    cxa_demangle_fuzzer.cpp
+    ../src/cxa_demangle.cpp
+    )
+
+  target_link_libraries(cxa_demangle_fuzzer
+    LLVMFuzzer
+    )
+endif()

fuzz/cxa_demangle_fuzzer.cpp

@@ -0,0 +1,15 @@
+#include <stdint.h>
+#include <stddef.h>
+#include <string.h>
+#include <stdlib.h>
+extern "C" char *
+__cxa_demangle(const char *mangled_name, char *buf, size_t *n, int *status);
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  char *str = new char[size+1];
+  memcpy(str, data, size);
+  str[size] = 0;
+  free(__cxa_demangle(str, 0, 0, 0));
+  delete [] str;
+  return 0;
+}