Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 # libFuzzer and ClusterFuzz Integration | 1 # libFuzzer and ClusterFuzz Integration |
| 2 | 2 |
| 3 *** note | 3 *** note |
| 4 Most links on this page are private. | 4 Most links on this page are private. |
| 5 *** | 5 *** |
| 6 | 6 |
| 7 ClusterFuzz is a distributed fuzzing infrastructure | 7 ClusterFuzz is a distributed fuzzing infrastructure |
| 8 ([go/clusterfuzz](https://goto.google.com/clusterfuzz)) that automatically | 8 ([go/clusterfuzz](https://goto.google.com/clusterfuzz)) that automatically |
| 9 executes libFuzzer tests on scale. | 9 executes libFuzzer tests on scale. |
| 10 | 10 |
| (...skipping 17 matching lines...) Expand all Loading... | |
| 28 * ClusterFuzz downloads new binaries once a day and runs fuzzers continuously. | 28 * ClusterFuzz downloads new binaries once a day and runs fuzzers continuously. |
| 29 * Fuzzer run logs are uploaded to [ClusterFuzz libFuzzer Logs] GCS bucket. | 29 * Fuzzer run logs are uploaded to [ClusterFuzz libFuzzer Logs] GCS bucket. |
| 30 * Fuzzing corpus is maintained for each fuzzer in [Corpus GCS Bucket]. Once a da y | 30 * Fuzzing corpus is maintained for each fuzzer in [Corpus GCS Bucket]. Once a da y |
| 31 corpus is minimized to reduce number of duplicates and/or reduce effect of | 31 corpus is minimized to reduce number of duplicates and/or reduce effect of |
| 32 parasitic coverage. | 32 parasitic coverage. |
| 33 * [ClusterFuzz Fuzzer Status] displays fuzzer runtime | 33 * [ClusterFuzz Fuzzer Status] displays fuzzer runtime |
| 34 metrics as well as provides links to crashes and coverage reports. The informati on | 34 metrics as well as provides links to crashes and coverage reports. The informati on |
| 35 is collected every 30 minutes. | 35 is collected every 30 minutes. |
| 36 | 36 |
| 37 | 37 |
| 38 ## Upload Corpus | |
| 39 ClusterFuzz uses two corpus types with libFuzzer: | |
| 40 | |
| 41 1) **Seed** (or **static**) corpus: files manually uploaded by developers. | |
| 42 ClusterFuzz uses these files for fuzzing but doesn't delete/overwrite them. | |
| 43 | |
| 44 2) **General** (or **working**) corpus: files generated by fuzzers themselves. | |
| 45 These corpus files are frequently modified during fuzzing sessions and can be | |
| 46 deleted during corpus minimization. | |
| 47 | |
| 48 A fuzzer has two input corpus directories, seed and general, but its output | |
| 49 goes into general corpus directory. Seed corpus is read-only. | |
| 50 | |
| 51 ClusterFuzz supports two sources of seed corpus. | |
| 52 | |
| 53 #### Chromium repository | |
|
aizatsky
2016/04/19 18:42:43
Let's move this section to efficient_fuzzing.
mmoroz
2016/04/20 12:38:20
Done.
| |
| 54 | |
| 55 To use corpus stored in the repository you need to add `seed_corpus` attribute | |
| 56 to fuzzer target: | |
| 57 | |
| 58 ``` | |
| 59 fuzzer_test("my_protocol_fuzzer") { | |
| 60 ... | |
| 61 seed_corpus = "src/fuzz/testcases" | |
| 62 ... | |
| 63 } | |
| 64 ``` | |
| 65 | |
| 66 #### Google Cloud Storage | |
| 67 | |
| 68 If you don't want to store seed corpus in Chromium repository, you can upload | |
| 69 it into Google Cloud Storage bucket: | |
| 70 | |
| 71 | |
| 72 1) go to [Corpus GCS Bucket] | |
| 73 | |
| 74 2) open directory named `%YOUR_FUZZER_NAME%_static` | |
| 75 | |
| 76 3) upload corpus files into the directory | |
| 77 | |
| 78 | |
| 79 Alternative way is to use `gsutil` tool: | |
| 80 ```bash | |
| 81 gsutil -m rsync <corpus_dir_on_disk> gs://clusterfuzz-corpus/libfuzzer/%YOUR_FUZ ZER_NAME%_static | |
| 82 ``` | |
| 83 | |
| 38 [Buildbot]: https://goto.google.com/libfuzzer-clusterfuzz-buildbot | 84 [Buildbot]: https://goto.google.com/libfuzzer-clusterfuzz-buildbot |
| 39 [fuzzer_test.gni]: https://code.google.com/p/chromium/codesearch#chromium/src/te sting/libfuzzer/fuzzer_test.gni | 85 [fuzzer_test.gni]: https://code.google.com/p/chromium/codesearch#chromium/src/te sting/libfuzzer/fuzzer_test.gni |
| 40 [chromium_libfuzzer.py]: https://code.google.com/p/chromium/codesearch#chromium/ build/scripts/slave/recipes/chromium_libfuzzer.py | 86 [chromium_libfuzzer.py]: https://code.google.com/p/chromium/codesearch#chromium/ build/scripts/slave/recipes/chromium_libfuzzer.py |
| 41 [ClusterFuzz Fuzzer Status]: https://goto.google.com/libfuzzer-clusterfuzz-statu s | 87 [ClusterFuzz Fuzzer Status]: https://goto.google.com/libfuzzer-clusterfuzz-statu s |
| 42 [ClusterFuzz libFuzzer Logs]: https://goto.google.com/libfuzzer-clusterfuzz-logs | 88 [ClusterFuzz libFuzzer Logs]: https://goto.google.com/libfuzzer-clusterfuzz-logs |
| 43 [Corpus GCS Bucket]: https://goto.google.com/libfuzzer-clusterfuzz-corpus | 89 [Corpus GCS Bucket]: https://goto.google.com/libfuzzer-clusterfuzz-corpus |
| OLD | NEW |