Merge pull request #5628 from arthurscchan/new-fuzzer

OSS-Fuzz: Add new fuzzer targets layout processing

Makefile.am

@@ -257,7 +257,8 @@ check_PROGRAMS = \
 	fuzz/input-fuzzer \
 	fuzz/cmd-parse-fuzzer \
 	fuzz/format-fuzzer \
-	fuzz/style-fuzzer
+	fuzz/style-fuzzer \
+	fuzz/layout-fuzzer
 fuzz_input_fuzzer_LDFLAGS = $(FUZZING_LIBS)
 fuzz_input_fuzzer_LDADD = $(LDADD) $(tmux_OBJECTS)
 fuzz_cmd_parse_fuzzer_LDFLAGS = $(FUZZING_LIBS)
@@ -266,6 +267,8 @@ fuzz_format_fuzzer_LDFLAGS = $(FUZZING_LIBS)
 fuzz_format_fuzzer_LDADD = $(LDADD) $(tmux_OBJECTS)
 fuzz_style_fuzzer_LDFLAGS = $(FUZZING_LIBS)
 fuzz_style_fuzzer_LDADD = $(LDADD) $(tmux_OBJECTS)
+fuzz_layout_fuzzer_LDFLAGS = $(FUZZING_LIBS)
+fuzz_layout_fuzzer_LDADD = $(LDADD) $(tmux_OBJECTS)
 endif
 
 # Install tmux.1 in the right format.

fuzz/layout-fuzzer.c

@@ -0,0 +1,111 @@
+/*
+ * Copyright (c) 2026 Arthur Chan <arthur.chan@adalogics.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF MIND, USE, DATA OR PROFITS, WHETHER
+ * IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Fuzz the custom layout parser.
+ *
+ * A layout string such as "bb62,80x24,0,0{40x24,0,0,1,39x24,41,0,2}" is
+ * accepted by select-layout and is what tmux stores and restores for a
+ * window, so it is parsed from configuration and from commands. It drives
+ * layout-custom.c (the string parser and the checksum), then layout.c, which
+ * resizes and assigns the cells.
+ *
+ * layout_parse() refuses a window with no panes, and refuses a layout whose
+ * cell count is smaller than the pane count, so the window is given a fixed
+ * number of panes. The count is fixed rather than derived from the input, so
+ * a mutation always means a different layout string.
+ */
+
+#include <sys/types.h>
+
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "tmux.h"
+
+#define FUZZER_MAXLEN 1024
+#define FUZZER_PANES 4
+
+struct event_base	*libevent;
+
+int
+LLVMFuzzerTestOneInput(const u_char *data, size_t size)
+{
+	struct window		*w;
+	struct window_pane	*wp;
+	char			*buf, *cause = NULL, *dump;
+	u_int			 i;
+
+	if (size == 0 || size > FUZZER_MAXLEN)
+		return 0;
+
+	/* layout_parse() takes a C string. */
+	buf = malloc(size + 1);
+	if (buf == NULL)
+		return 0;
+	memcpy(buf, data, size);
+	buf[size] = '\0';
+
+	w = window_create(80, 24, 0, 0);
+	if (w == NULL) {
+		free(buf);
+		return 0;
+	}
+	window_add_ref(w, __func__);
+
+	for (i = 0; i < FUZZER_PANES; i++) {
+		wp = window_add_pane(w, NULL, 0, 0);
+		if (w->active == NULL)
+			w->active = wp;
+	}
+
+	if (layout_parse(w, buf, &cause) == 0) {
+		dump = layout_dump(w, w->layout_root, 1);
+		free(dump);
+	}
+	free(cause);
+
+	window_remove_ref(w, __func__);
+
+	free(buf);
+	return 0;
+}
+
+int
+LLVMFuzzerInitialize(__unused int *argc, __unused char ***argv)
+{
+	const struct options_table_entry	*oe;
+
+	global_environ = environ_create();
+	global_options = options_create(NULL);
+	global_s_options = options_create(NULL);
+	global_w_options = options_create(NULL);
+	for (oe = options_table; oe->name != NULL; oe++) {
+		if (oe->scope & OPTIONS_TABLE_SERVER)
+			options_default(global_options, oe);
+		if (oe->scope & OPTIONS_TABLE_SESSION)
+			options_default(global_s_options, oe);
+		if (oe->scope & OPTIONS_TABLE_WINDOW)
+			options_default(global_w_options, oe);
+	}
+
+	libevent = osdep_event_init();
+
+	socket_path = xstrdup("dummy");
+
+	return 0;
+}

fuzz/layout-fuzzer.dict

@@ -0,0 +1,17 @@
+# tmux custom layout strings: "<checksum>,<sx>x<sy>,<x>,<y>{...}" / "[...]"
+","
+"x"
+"{"
+"}"
+"["
+"]"
+"0"
+"1"
+"80x24,0,0"
+"40x24,0,0"
+"bb62,"
+"cafe,"
+",0,0,0"
+",0,0{"
+",0,0["
+"@"

fuzz/layout-fuzzer.options

@@ -0,0 +1,2 @@
+[libfuzzer]
+max_len = 1024

regress/tty-margins-scrollbar.sh

@@ -1,117 +0,0 @@
-#!/bin/sh
-
-# A pane that doesn't span the terminal's full width - because
-# pane-scrollbars is on (the scrollbar occupies a column) or the pane is
-# one of a side-by-side split - needs DECSLRM (left/right margin) support
-# to use the fast native-scroll path (tty_cmd_linefeed()/scrollup()/
-# scrolldown()/reverseindex(), tty.c:
-# "(!tty_full_width(tty, ctx) && !tty_use_margin(tty))"). Without it, every
-# single scroll falls back to tty_redraw_region()'s full manual repaint of
-# the whole region - a real, confirmed source of flicker (and, separately,
-# of image content not surviving a scroll in branches with image support).
-#
-# tty_default_features() (tty-features.c) grants the "margins" feature to
-# several terminals it can positively identify via XTVERSION/DA2 (mintty,
-# iTerm2, WezTerm, ghostty, XTerm-as-VT420) - this checks the actual
-# server-side scroll decision via the -vv log for the underlying mechanism
-# those table entries all rely on, using the terminal-features option
-# directly (which any of them - or a user's own terminal-overrides -
-# ultimately feed into) rather than simulating any one terminal's
-# identification handshake.
-
-PATH=/bin:/usr/bin
-TERM=screen
-LC_ALL=C.UTF-8
-export PATH TERM LC_ALL
-
-[ -z "$TEST_TMUX" ] && TEST_TMUX=$(readlink -f ../tmux)
-
-DIR=$(mktemp -d) || exit 1
-cd "$DIR" || exit 1
-INNER="$TEST_TMUX -vv -Lmarginsscrollbar-inner-$$ -f/dev/null"
-OUTER="$TEST_TMUX -Lmarginsscrollbar-outer-$$ -f/dev/null"
-
-fail()
-{
-	echo "$*" >&2
-	exit 1
-}
-
-cleanup()
-{
-	$OUTER kill-server 2>/dev/null
-	$INNER kill-server 2>/dev/null
-	cd /
-	rm -rf "$DIR"
-}
-trap cleanup 0 1 15
-
-wait_for_client()
-{
-	i=0
-	while [ "$i" -lt 50 ]; do
-		CLIENT=$($INNER list-clients -F '#{client_name}' 2>/dev/null)
-		[ -n "$CLIENT" ] && return 0
-		sleep 0.1
-		i=$((i + 1))
-	done
-	fail "inner client did not attach"
-}
-
-run_scroll_phase()
-{
-	label=$1
-	margins=$2
-
-	rm -f tmux-server*.log
-
-	$INNER new-session -d -s inner -x 40 -y 6 'exec sh' || exit 1
-	$INNER set -g status off || exit 1
-	$INNER set -g window-size manual || exit 1
-	$INNER set -g pane-scrollbars on || exit 1
-	if [ "$margins" = "on" ]; then
-		$INNER set -as terminal-features ',*:margins' || exit 1
-	fi
-
-	$OUTER new-session -d -x 40 -y 6 || exit 1
-	OUTERPANE=$($OUTER list-panes -F '#{pane_id}') || exit 1
-	$OUTER set -g status off || exit 1
-	$OUTER set -g window-size manual || exit 1
-	$OUTER set -g default-terminal screen-256color || exit 1
-	$OUTER send-keys -t "$OUTERPANE" -l "$INNER attach -t inner" || exit 1
-	$OUTER send-keys -t "$OUTERPANE" Enter || exit 1
-	sleep 1
-
-	wait_for_client
-
-	i=0
-	while [ "$i" -lt 8 ]; do
-		$INNER send-keys -t inner Enter || exit 1
-		sleep 0.2
-		i=$((i + 1))
-	done
-	sleep 0.3
-
-	LOG=$(ls tmux-server*.log 2>/dev/null | head -1)
-	[ -n "$LOG" ] || fail "$label: sanity: no server -vv log was produced"
-
-	n=$(grep -c "tty_redraw_region.*large region redraw" "$LOG")
-
-	$OUTER kill-server 2>/dev/null
-	$INNER kill-server 2>/dev/null
-
-	echo "$n"
-}
-
-# Phase 1: margins granted - must never fall back to a full region redraw.
-n_with=$(run_scroll_phase "with margins" "on")
-[ "$n_with" -eq 0 ] ||
-	fail "with margins granted, scrolling a scrollbar-enabled pane still fell back to a full region redraw ($n_with times)"
-
-# Phase 2: sanity check - without margins, the same scenario must actually
-# hit the fallback, proving phase 1 wasn't accidentally trivial.
-n_without=$(run_scroll_phase "without margins" "off")
-[ "$n_without" -gt 0 ] ||
-	fail "sanity: without margins, scrolling a scrollbar-enabled pane never fell back to a full region redraw - this scenario no longer exercises the bug this test checks for"
-
-exit 0

tty-features.c

@@ -637,7 +637,6 @@ tty_default_features(struct client *c, const char *name, u_int version)
 			      "extkeys,"
 			      "focus,"
 		  	      "hyperlinks,"
-			      "margins,"
 			      "usstyle"
 		},
 		{ .name = "ghostty",
@@ -646,7 +645,6 @@ tty_default_features(struct client *c, const char *name, u_int version)
 			      "cstyle,"
 			      "extkeys,"
 			      "focus,"
-			      "margins,"
 			      "overline,"
 			      "hyperlinks,"
 			      "osc7,"
@@ -677,7 +675,7 @@ tty_default_features(struct client *c, const char *name, u_int version)
 			      "cstyle,"
 			      "extkeys,"
 			      "focus"
-		},
+		}
 	};
 	u_int	i;