Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 # libFuzzer Integration Reference | 1 # libFuzzer Integration Reference |
| 2 | 2 |
| 3 ## Supported Platforms and Configurations | |
| 4 | |
| 5 ### Linux | |
| 6 | |
| 7 Linux is fully supported by libFuzzer and ClusterFuzz with following sanitizer | |
| 8 configurations: | |
| 9 | |
| 10 | GN Argument | Description | | |
| 11 |--------------|----| | |
| 12 | is_asan=true | enables [Address Sanitizer] to catch problems like buffer overr uns. | | |
| 13 | is_msan=true | enables [Memory Sanitizer] to catch problems like uninitialed r eads. | | |
| 14 | is_ubsan_security=true | enables [Undefined Behavior Sanitizer] to catch<sup>\ [[1](#Notes)\]</sup> undefined behavior like integer overflow. | | |
| 15 | |
| 16 Configuration example: | |
| 17 | |
| 18 ```bash | |
| 19 # With address sanitizer | |
| 20 gn gen out/libfuzzer '--args=use_libfuzzer=true is_asan=true enable_nacl=false' --check | |
| 21 ``` | |
| 22 | |
| 23 ### Mac | |
| 24 | |
| 25 Mac is experimentally supported by libFuzzer with `is_asan` configuration. Mac | |
| 26 support is not provided by ClusterFuzz, | |
|
Oliver Chang
2016/05/13 18:28:23
s/ClusterFuzz,/Clusterfuzz./ ?
aizatsky
2016/05/13 18:31:58
Done.
| |
| 27 | |
| 28 Configuration example: | |
| 29 | |
| 30 ```bash | |
| 31 gn gen out/libfuzzer '--args=use_libfuzzer=true is_asan=true enable_nacl=false m ac_deployment_target="10.7"' --check | |
| 32 ``` | |
| 33 | |
| 34 | |
| 3 ## fuzzer_test GN Template | 35 ## fuzzer_test GN Template |
| 4 | 36 |
| 5 Use `fuzzer_test` to define libFuzzer targets: | 37 Use `fuzzer_test` to define libFuzzer targets: |
| 6 | 38 |
| 7 ``` | 39 ``` |
| 8 fuzzer_test("my_fuzzer") { | 40 fuzzer_test("my_fuzzer") { |
| 9 ... | 41 ... |
| 10 } | 42 } |
| 11 ``` | 43 ``` |
| 12 | 44 |
| (...skipping 34 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 47 fuzzer_test("my_fuzzer") { | 79 fuzzer_test("my_fuzzer") { |
| 48 ... | 80 ... |
| 49 libfuzzer_options = [ | 81 libfuzzer_options = [ |
| 50 "max_len=2048", | 82 "max_len=2048", |
| 51 "use_traces=1", | 83 "use_traces=1", |
| 52 ] | 84 ] |
| 53 } | 85 } |
| 54 ``` | 86 ``` |
| 55 | 87 |
| 56 [libFuzzer Usage]: http://llvm.org/docs/LibFuzzer.html#usage | 88 [libFuzzer Usage]: http://llvm.org/docs/LibFuzzer.html#usage |
| 89 [Address Sanitizer]: http://clang.llvm.org/docs/AddressSanitizer.html | |
| 90 [Memory Sanitizer]: http://clang.llvm.org/docs/MemorySanitizer.html | |
| 91 [Undefined Behavior Sanitizer]: http://clang.llvm.org/docs/UndefinedBehaviorSani tizer.html | |
| 57 | 92 |
| 58 | |
| OLD | NEW |