Problem: no integration with fuzz testing

Solution: port the 2 new tests from oss-fuzz, and wire them up to
be ran manually with a static input in normal builds.
Add a specific configure option to use the external fuzzing engine
from oss-fuzz.

Makefile.am

@@ -1106,6 +1106,41 @@ tests_test_disconnect_msg_LDADD = ${TESTUTIL_LIBS} src/libzmq.la
 tests_test_disconnect_msg_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
 endif
 
+if FUZZING_ENGINE_LIB
+fuzzer_apps = tests/test_bind_null_fuzzer \
+	tests/test_connect_null_fuzzer
+
+tests_test_bind_null_fuzzer_DEPENDENCIES = src/libzmq.la
+tests_test_bind_null_fuzzer_SOURCES = tests/test_bind_null_fuzzer.cpp
+tests_test_bind_null_fuzzer_LDADD = ${TESTUTIL_LIBS} ${FUZZING_ENGINE_LIB} \
+		$(top_builddir)/src/.libs/libzmq.a \
+		${src_libzmq_la_LIBADD}
+tests_test_bind_null_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
+tests_test_bind_null_fuzzer_CXXFLAGS = -std=c++11
+
+tests_test_connect_null_fuzzer_DEPENDENCIES = src/libzmq.la
+tests_test_connect_null_fuzzer_SOURCES = tests/test_connect_null_fuzzer.cpp
+tests_test_connect_null_fuzzer_LDADD = ${TESTUTIL_LIBS} ${FUZZING_ENGINE_LIB} \
+		$(top_builddir)/src/.libs/libzmq.a \
+		${src_libzmq_la_LIBADD}
+tests_test_connect_null_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
+tests_test_connect_null_fuzzer_CXXFLAGS = -std=c++11
+
+FUZZINGdir = ${prefix}/${FUZZING_INSTALLDIR}
+FUZZING_PROGRAMS = ${fuzzer_apps}
+else
+test_apps += tests/test_bind_null_fuzzer \
+	tests/test_connect_null_fuzzer
+
+tests_test_bind_null_fuzzer_SOURCES = tests/test_bind_null_fuzzer.cpp
+tests_test_bind_null_fuzzer_LDADD = ${TESTUTIL_LIBS} src/libzmq.la
+tests_test_bind_null_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
+
+tests_test_connect_null_fuzzer_SOURCES = tests/test_connect_null_fuzzer.cpp
+tests_test_connect_null_fuzzer_LDADD = ${TESTUTIL_LIBS} src/libzmq.la
+tests_test_connect_null_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
+endif
+
 if ENABLE_STATIC
 # unit tests - these include individual source files and test the internal functions
 test_apps += \

configure.ac

@@ -1005,6 +1005,25 @@ AM_CONDITIONAL([WITH_CLANG_FORMAT], [$WITH_CLANG_FORMAT])
 # unittests will not build without the static libzmq.a
 AM_CONDITIONAL(ENABLE_STATIC, test "x$enable_static" = "xyes")
 
+# build using a fuzzing engine - fuzzers will be built separately and statically
+AC_ARG_WITH([fuzzing-engine], [AS_HELP_STRING([--with-fuzzing-engine],
+    [build libzmq with an exernal fuzzing engine [default=no]])],
+    [have_fuzzing_engine_ext=$withval],
+    [have_fuzzing_engine_ext=no])
+AC_ARG_WITH([fuzzing-installdir],
+    AS_HELP_STRING([--with-fuzzing-installdir=PATH],
+        [Path where to install fuzzer binaries]),
+    [fuzzing_installdir="$withval"])
+
+if test "x$have_fuzzing_engine_ext" != "xno" && test "x$fuzzing_installdir" != "x" && test "x$enable_static" = "xyes"; then
+    FUZZING_ENGINE_LIB="${have_fuzzing_engine_ext}"
+    FUZZING_INSTALLDIR="${fuzzing_installdir}"
+    AC_SUBST(FUZZING_ENGINE_LIB)
+    AC_SUBST(FUZZING_INSTALLDIR)
+    AC_DEFINE(ZMQ_USE_FUZZING_ENGINE, 1, [fuzz tests will be built with fuzzing engine])
+fi
+AM_CONDITIONAL(FUZZING_ENGINE_LIB, test "x$FUZZING_ENGINE_LIB" != "x")
+
 # clang 6 has a warning that does not make sense on multi-platform code
 AC_LANG_PUSH([C])
 AX_CHECK_COMPILE_FLAG([-Wno-tautological-constant-compare],

tests/CMakeLists.txt

@@ -75,7 +75,7 @@ set(tests
     test_mock_pub_sub)
 
 if(NOT WIN32)
-  list(APPEND tests test_security_gssapi test_socks)
+  list(APPEND tests test_security_gssapi test_socks test_connect_null_fuzzer test_bind_null_fuzzer)
 endif()
 
 if(ZMQ_HAVE_CURVE)

tests/test_bind_null_fuzzer.cpp

@@ -0,0 +1,76 @@
+/*
+    Copyright (c) 2020 Contributors as noted in the AUTHORS file
+
+    This file is part of libzmq, the ZeroMQ core engine in C++.
+
+    libzmq is free software; you can redistribute it and/or modify it under
+    the terms of the GNU Lesser General Public License (LGPL) as published
+    by the Free Software Foundation; either version 3 of the License, or
+    (at your option) any later version.
+
+    As a special exception, the Contributors give you permission to link
+    this library with independent modules to produce an executable,
+    regardless of the license terms of these independent modules, and to
+    copy and distribute the resulting executable under terms of your choice,
+    provided that you also meet, for each linked independent module, the
+    terms and conditions of the license of that module. An independent
+    module is a module which is not derived from or based on this library.
+    If you modify this library, you must extend this exception to your
+    version of the library.
+
+    libzmq is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+    FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public
+    License for more details.
+
+    You should have received a copy of the GNU Lesser General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifdef ZMQ_USE_FUZZING_ENGINE
+#include <fuzzer/FuzzedDataProvider.h>
+#endif
+
+#include "testutil.hpp"
+#include "testutil_unity.hpp"
+
+// Test that the ZMTP engine handles invalid handshake when binding
+// https://rfc.zeromq.org/spec/37/
+extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
+{
+    setup_test_context ();
+    char my_endpoint[MAX_SOCKET_STRING];
+    void *server = test_context_socket (ZMQ_PUB);
+    bind_loopback_ipv4 (server, my_endpoint, sizeof (my_endpoint));
+    fd_t client = connect_socket (my_endpoint);
+
+    for (ssize_t sent = 0; size > 0 && (sent != -1 || errno == EINTR);
+         size -= sent > 0 ? sent : 0, data += sent > 0 ? sent : 0)
+        sent = send (client, (const char *) data, size, MSG_NOSIGNAL);
+    msleep (250);
+
+    close (client);
+
+    test_context_socket_close_zero_linger (server);
+    teardown_test_context ();
+
+    return 0;
+}
+
+#ifndef ZMQ_USE_FUZZING_ENGINE
+void test_bind_null_fuzzer ()
+{
+    TEST_ASSERT_SUCCESS_ERRNO (
+      LLVMFuzzerTestOneInput (zmtp_greeting_null, sizeof (zmtp_greeting_null)));
+}
+
+int main (int argc, char **argv)
+{
+    setup_test_environment ();
+
+    UNITY_BEGIN ();
+    RUN_TEST (test_bind_null_fuzzer);
+
+    return UNITY_END ();
+}
+#endif

tests/test_connect_null_fuzzer.cpp

@@ -0,0 +1,80 @@
+/*
+    Copyright (c) 2020 Contributors as noted in the AUTHORS file
+
+    This file is part of libzmq, the ZeroMQ core engine in C++.
+
+    libzmq is free software; you can redistribute it and/or modify it under
+    the terms of the GNU Lesser General Public License (LGPL) as published
+    by the Free Software Foundation; either version 3 of the License, or
+    (at your option) any later version.
+
+    As a special exception, the Contributors give you permission to link
+    this library with independent modules to produce an executable,
+    regardless of the license terms of these independent modules, and to
+    copy and distribute the resulting executable under terms of your choice,
+    provided that you also meet, for each linked independent module, the
+    terms and conditions of the license of that module. An independent
+    module is a module which is not derived from or based on this library.
+    If you modify this library, you must extend this exception to your
+    version of the library.
+
+    libzmq is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+    FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public
+    License for more details.
+
+    You should have received a copy of the GNU Lesser General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifdef ZMQ_USE_FUZZING_ENGINE
+#include <fuzzer/FuzzedDataProvider.h>
+#endif
+
+#include "testutil.hpp"
+#include "testutil_unity.hpp"
+
+// Test that the ZMTP engine handles invalid handshake when connecting
+// https://rfc.zeromq.org/spec/37/
+extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
+{
+    setup_test_context ();
+    char my_endpoint[MAX_SOCKET_STRING];
+    fd_t server = bind_socket_resolve_port ("127.0.0.1", "0", my_endpoint);
+
+    void *client = test_context_socket (ZMQ_PUB);
+    TEST_ASSERT_SUCCESS_ERRNO (zmq_connect (client, my_endpoint));
+
+    fd_t server_accept =
+      TEST_ASSERT_SUCCESS_RAW_ERRNO (accept (server, NULL, NULL));
+    for (ssize_t sent = 0; size > 0 && (sent != -1 || errno == EINTR);
+         size -= sent > 0 ? sent : 0, data += sent > 0 ? sent : 0)
+        sent = send (server_accept, (const char *) data, size, MSG_NOSIGNAL);
+    msleep (250);
+
+    close (server_accept);
+    close (server);
+
+    test_context_socket_close_zero_linger (client);
+    teardown_test_context ();
+
+    return 0;
+}
+
+#ifndef ZMQ_USE_FUZZING_ENGINE
+void test_connect_null_fuzzer ()
+{
+    TEST_ASSERT_SUCCESS_ERRNO (
+      LLVMFuzzerTestOneInput (zmtp_greeting_null, sizeof (zmtp_greeting_null)));
+}
+
+int main (int argc, char **argv)
+{
+    setup_test_environment ();
+
+    UNITY_BEGIN ();
+    RUN_TEST (test_connect_null_fuzzer);
+
+    return UNITY_END ();
+}
+#endif

tests/testutil.hpp

@@ -88,6 +88,10 @@ const uint8_t zmtp_ready_sub[27] = {
 
 #undef NDEBUG
 
+#ifndef MSG_NOSIGNAL
+#define MSG_NOSIGNAL 0
+#endif
+
 // duplicated from fd.hpp
 #ifdef ZMQ_HAVE_WINDOWS
 #ifndef NOMINMAX