README.md 1.76 KB
Newer Older
1 2 3 4 5 6 7 8
# Fuzzers

These are fuzzers designed for use with `libFuzzer` or `afl`. They can
be used to run on Google's OSS-Fuzz (https://github.com/google/oss-fuzz/).

The convention used here is that the initial values for each parser fuzzer
are taken from the $NAME.in directory.

Tim Rühsen's avatar
Tim Rühsen committed
9 10 11 12 13 14 15 16 17 18 19
Crash reproducers from OSS-Fuzz are put into $NAME.repro directory for
regression testing with top dir 'make check' or 'make check-valgrind'.

The ./configure runs below are for libidn2.


# Running a fuzzer using clang

Use the following commands on top dir:
```
export CC=clang-5.0
20
export CFLAGS="-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=undefined,integer,nullability -fsanitize=address -fsanitize-address-use-after-scope -fsanitize-coverage=trace-pc-guard,trace-cmp"
Tim Rühsen's avatar
Tim Rühsen committed
21 22 23 24 25
ASAN_OPTIONS=detect_leaks=0 ./configure --enable-static --disable-doc --disable-gcc-warnings
make clean
make -j$(nproc)
cd fuzz

Tim Rühsen's avatar
Tim Rühsen committed
26
# build and run fuzzer
Tim Rühsen's avatar
Tim Rühsen committed
27 28 29 30
./run-clang.sh libidn2_to_ascii_8z_fuzzer
```


31 32 33 34 35
# Running a fuzzer using AFL

Use the following commands on top dir:

```
Tim Rühsen's avatar
Tim Rühsen committed
36 37
$ CC=afl-clang-fast ./configure --disable-doc
$ make -j$(nproc) clean all
38
$ cd fuzz
Tim Rühsen's avatar
Tim Rühsen committed
39
$ ./run-afl.sh libidn2_to_ascii_8z_fuzzer
40 41
```

Tim Rühsen's avatar
Tim Rühsen committed
42 43 44 45 46 47 48 49 50 51
# Fuzz code coverage using the corpus directories *.in/

Code coverage reports currently work best with gcc+lcov+genhtml.

In the top directory:
```
CC=gcc CFLAGS="-O0 -g" ./configure --disable-doc
make coverage
xdg-open doc/coverage/index.html
```
52

Tim Rühsen's avatar
Tim Rühsen committed
53 54 55 56 57 58 59 60
Each fuzzer target has it's own functions to cover, e.g.
`libidn2_to_ascii_8z_fuzzer` covers idn2_to_ascii_8z().

To work on corpora for better coverage, `cd fuzz` and use e.g.
`./view-coverage.sh libidn_toascii_fuzzer`.


# Enhancing the testsuite for issues found
61

Tim Rühsen's avatar
Tim Rühsen committed
62 63
Each reproducer file should be dropped into the appropriate *.repro/
directory.