NeoMutt has some support for Fuzzing.

• https://en.wikipedia.org/wiki/Fuzzing

Tests two functions that could be susceptible to remote attacks:

• mutt_rfc822_read_header();
• mutt_parse_part();

Tests the command line parser:

• cli_parse();

Tests the date parser:

• mutt_date_parse_date();

The fuzzing machinery uses a custom entry point to the code. Each fuzz target implements the LibFuzzer interface:

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)

To build the fuzzers, we need to build with clang and pass some extra flags:

# Set some environment variables
export EXTRA_CFLAGS="-fsanitize=fuzzer"
export CXXFLAGS="$EXTRA_CFLAGS"

# Configure and build
./configure CC=clang --disable-doc --quiet --fuzzing
make CC=clang CXX=clang fuzz

The fuzzers can be run simply:

fuzz/address-fuzz
fuzz/cli-fuzz
fuzz/date-fuzz

or they can be run against a corpus of test cases:

# Run the address fuzzer on sample data
git clone https://github.com/neomutt/corpus-address.git
fuzz/address-fuzz corpus-address

# Run the CLI fuzzer on sample data
git clone https://github.com/neomutt/corpus-cli.git
fuzz/cli-fuzz corpus-cli

To see some more options, run:

fuzz/address-fuzz -help=1

Adding the option -max_total_time=3600 will limit the run time to one hour.