Run fuzzer in CI

Signed-off-by: AdamKorcz <[email protected]>

.clusterfuzzlite/Dockerfile

@@ -0,0 +1,6 @@
+FROM gcr.io/oss-fuzz-base/base-builder
+RUN apt-get update && apt-get install -y make autoconf automake libtool \
+  pkg-config
+COPY . $SRC/trezor-firmware
+WORKDIR $SRC/trezor-firmware/crypto
+COPY .clusterfuzzlite/build.sh $SRC/

.clusterfuzzlite/build.sh

@@ -0,0 +1,5 @@
+# reset sanitizer and optimization flags to avoid interfering with $CFLAGS
+export SANFLAGS=""
+export OPTFLAGS="-O3 -march=native -gline-tables-only"
+FUZZER=1 VALGRIND=0 make -j$(nproc) fuzzer
+mv fuzzer/fuzzer $OUT/

.clusterfuzzlite/project.yaml

@@ -0,0 +1 @@
+language: c

.github/workflows/cflite.yml

@@ -0,0 +1,29 @@
+name: ClusterFuzzLite PR fuzzing
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - '**'
+permissions: read-all
+jobs:
+  PR:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer: [address]
+    steps:
+      - name: Build Fuzzers (${{ matrix.sanitizer }})
+        id: build
+        uses: google/clusterfuzzlite/actions/build_fuzzers@v1
+        with:
+          sanitizer: ${{ matrix.sanitizer }}
+          language: c
+      - name: Run Fuzzers (${{ matrix.sanitizer }})
+        id: run
+        uses: google/clusterfuzzlite/actions/run_fuzzers@v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          fuzz-seconds: 400
+          mode: 'code-change'
+          sanitizer: ${{ matrix.sanitizer }}