Revision control
+ Fuzz targets for Qt Quick 3D, to be built and run with clang's libFuzzer.
+
+ The layout and the build recipe follow qtbase's tests/libfuzzer; see the README
+ there for the full instructions. As in qtbase there is no top level
+ CMakeLists.txt: each target is a standalone project, so none of this enters the
+ normal build and none of it costs anything in CI.
+
+ In short: configure a Qt with
+
+ configure -sanitize address -sanitize undefined -sanitize fuzzer-no-link
+
+ build qtquick3d against it, then build a target on its own with
+
+ <sanitized qt>/bin/qt-cmake -DCMAKE_CXX_COMPILER=clang++ \
+ -S utils/qssgmesh/read -B /tmp/meshfuzz \
+ && cmake --build /tmp/meshfuzz
+
+ and run it over a seed corpus:
+
+ /tmp/meshfuzz/read <corpus dir> \
+ -dict=utils/qssgmesh/read/read.dict \
+ -rss_limit_mb=2048 -malloc_limit_mb=512 -timeout=25
+
+ The seed corpus is whatever is to hand; the .mesh files under tests/ and
+ examples/ cover every supported version of the format and are a good start. It
+ is deliberately not duplicated here. Minimise any finding with
+ -minimize_crash=1 and commit it to tests/auto/utils/mesh/data/fuzz, where
+ tst_qssgmesh picks it up automatically as a regression test.
+
+ utils/qssgmesh/read
+ The whole .mesh path: the container footer and entry list, then the mesh
+ header, the buffers, the subsets and their names, and the morph target
+ reconstruction that older versions of the format need. Every count and
+ offset in the file is attacker controlled and most of them size an
+ allocation or bound a loop.