| OLD | NEW |
| 1 # Getting Started with libFuzzer in Chrome | 1 # Getting Started with libFuzzer in Chrome |
| 2 | 2 |
| 3 *** note | 3 *** note |
| 4 **Prerequisites:** libFuzzer in Chrome is supported with GN on Linux only. | 4 **Prerequisites:** libFuzzer in Chrome is supported with GN on Linux only. |
| 5 *** | 5 *** |
| 6 | 6 |
| 7 This document will walk you through: | 7 This document will walk you through: |
| 8 | 8 |
| 9 * setting up your build enviroment. | 9 * setting up your build enviroment. |
| 10 * creating your first fuzzer. | 10 * creating your first fuzzer. |
| 11 * running the fuzzer and verifying its vitals. | 11 * running the fuzzer and verifying its vitals. |
| 12 | 12 |
| 13 ## Configure Build | 13 ## Configure Build |
| 14 | 14 |
| 15 Use `use_libfuzzer` GN argument together with sanitizer to generate build files: | 15 Use `use_libfuzzer` GN argument together with sanitizer to generate build files: |
| 16 | 16 |
| 17 ```bash | 17 ```bash |
| 18 # With address sanitizer | 18 # With address sanitizer |
| 19 gn gen out/libfuzzer '--args=use_libfuzzer=true is_asan=true enable_nacl=false'
--check | 19 gn gen out/libfuzzer '--args=use_libfuzzer=true is_asan=true enable_nacl=false'
--check |
| 20 ``` | 20 ``` |
| 21 | 21 |
| 22 Supported sanitizer configurations are: | 22 Supported sanitizer configurations are: |
| 23 | 23 |
| 24 | GN Argument | Description | | 24 | GN Argument | Description | |
| 25 |--------------|----| | 25 |--------------|----| |
| 26 | is_asan=true | enables [Address Sanitizer] to catch problems like buffer overr
uns. | | 26 | is_asan=true | enables [Address Sanitizer] to catch problems like buffer overr
uns. | |
| 27 | is_msan=true | enables [Memory Sanitizer] to catch problems like uninitialed r
eads. | | 27 | is_msan=true | enables [Memory Sanitizer] to catch problems like uninitialed r
eads. | |
| 28 | is_ubsan_security=true | enables [Undefined Behavior Sanitizer] to catch undef
ined behavior like integer overflow. | |
| 28 | 29 |
| 29 | 30 |
| 30 ## Write Fuzzer Function | 31 ## Write Fuzzer Function |
| 31 | 32 |
| 32 Create a new .cc file and define a `LLVMFuzzerTestOneInput` function: | 33 Create a new .cc file and define a `LLVMFuzzerTestOneInput` function: |
| 33 | 34 |
| 34 ```cpp | 35 ```cpp |
| 35 extern "C" int LLVMFuzzerTestOneInput(const unsigned char *data, size_t size) { | 36 extern "C" int LLVMFuzzerTestOneInput(const unsigned char *data, size_t size) { |
| 36 // put your fuzzing code here and use data+size as input. | 37 // put your fuzzing code here and use data+size as input. |
| 37 return 0; | 38 return 0; |
| (...skipping 57 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 95 ## Next Steps | 96 ## Next Steps |
| 96 | 97 |
| 97 * After your fuzzer is submitted, you should check its [ClusterFuzz status] in | 98 * After your fuzzer is submitted, you should check its [ClusterFuzz status] in |
| 98 a day or two. | 99 a day or two. |
| 99 * Check the [Efficient Fuzzer Guide] to better understand your fuzzer | 100 * Check the [Efficient Fuzzer Guide] to better understand your fuzzer |
| 100 performance and for optimization hints. | 101 performance and for optimization hints. |
| 101 | 102 |
| 102 | 103 |
| 103 [Address Sanitizer]: http://clang.llvm.org/docs/AddressSanitizer.html | 104 [Address Sanitizer]: http://clang.llvm.org/docs/AddressSanitizer.html |
| 104 [Memory Sanitizer]: http://clang.llvm.org/docs/MemorySanitizer.html | 105 [Memory Sanitizer]: http://clang.llvm.org/docs/MemorySanitizer.html |
| 106 [Undefined Behavior Sanitizer]: http://clang.llvm.org/docs/UndefinedBehaviorSani
tizer.html |
| 105 [url_parse_fuzzer.cc]: https://code.google.com/p/chromium/codesearch#chromium/sr
c/testing/libfuzzer/fuzzers/url_parse_fuzzer.cc | 107 [url_parse_fuzzer.cc]: https://code.google.com/p/chromium/codesearch#chromium/sr
c/testing/libfuzzer/fuzzers/url_parse_fuzzer.cc |
| 106 [ClusterFuzz status]: clusterfuzz.md#Status-Links | 108 [ClusterFuzz status]: clusterfuzz.md#Status-Links |
| 107 [Efficient Fuzzer Guide]: efficient_fuzzer.md | 109 [Efficient Fuzzer Guide]: efficient_fuzzer.md |
| 108 [crbug/598448]: https://bugs.chromium.org/p/chromium/issues/detail?id=598448 | 110 [crbug/598448]: https://bugs.chromium.org/p/chromium/issues/detail?id=598448 |
| OLD | NEW |