Lua C API tests

is a set of fuzzing tests for C implementations of Lua runtime (PUC Rio Lua and LuaJIT).

Building

CC=clang CXX=clang++ cmake -S . -B build -DUSE_LUA=ON [-DUSE_LUAJIT=ON]
cmake --build build --parallel

CMake options:

USE_LUA enables building PUC Rio Lua.
USE_LUAJIT enables building LuaJIT.
LUA_VERSION could be a Git branch, tag or commit. By default LUA_VERSION is master for PUC Rio Lua and v2.1 for LuaJIT.
ENABLE_ASAN enables AddressSanitizer.
ENABLE_UBSAN enables UndefinedBehaviorSanitizer.

Running

cmake --build build --target test

Update a seed corpus

$ ./build/tests/luaL_loadstring_test -set_cover_merge=1 corpus new_corpus
$ ./build/tests/luaL_loadstring_test -merge=1 corpus new_corpus

Collect code coverage

Compile and link with -fprofile-instr-generate -fcoverage-mapping options. When using -fsanitize=address, no .profraw will be written on crash or abort, so once the fuzzing test is finished, a second run is needed by passing only files in corpus, run: ./build/tests/luaL_loadstring_test -runs=0 ./<corpora minimized>:

$ CFLAGS="-fprofile-instr-generate -fcoverage-mapping" CC=clang CXX=clang++ cmake -S . -B build -G Ninja
$ cmake --build build --parallel
$ ./build/tests/luaL_loadstring_test -runs=0

Then to generate an html view:

$ llvm-profdata merge -sparse default.profraw -o default.profdata
$ llvm-cov show --format=html ./build/tests/luaL_loadstring_test -instr-profile=default.profdata > coverage.html

Show code coverage for a single function with a name luaL_loadstring:

$ llvm-cov show ./build/tests/luaL_loadstring_test -instr-profile=default.profdata -name=luaL_loadstring

References

License

ISC License, Sergey Bronnikov