| Index: testing/libfuzzer/efficient_fuzzer.md
|
| diff --git a/testing/libfuzzer/efficient_fuzzer.md b/testing/libfuzzer/efficient_fuzzer.md
|
| index cad61311d59ddaf7bf71db7ca3fbf44a40f73626..e2e8b113a33d98fda8cc76030dfe00f0cd141a40 100644
|
| --- a/testing/libfuzzer/efficient_fuzzer.md
|
| +++ b/testing/libfuzzer/efficient_fuzzer.md
|
| @@ -74,6 +74,19 @@ resources used for fuzzing. If large inputs make fuzzer too slow you have to
|
| adjust value of `-max_len` and find a trade-off between coverage and execution
|
| speed.
|
|
|
| +*Note:* ClusterFuzz runs two different fuzzing engines (**LibFuzzer** and
|
| +**AFL**) using the same target functions. AFL doesn't support `-max_len`
|
| +parameter and may provide input of any length to the target. If your target has
|
| +an input length limit that you would like to *strictly enforce*, it's
|
| +recommended to add a sanity check to the beginning of your target function:
|
| +
|
| +```
|
| +if (size > kSizeLimit)
|
| + return 0;
|
| +```
|
| +
|
| +For more information check out the discussion in [issue 638836].
|
| +
|
|
|
| ## Corpus Size
|
|
|
| @@ -222,3 +235,4 @@ Other options may be passed through `libfuzzer_options` property.
|
| [AFL]: http://lcamtuf.coredump.cx/afl/
|
| [ClusterFuzz status]: clusterfuzz.md#Status-Links
|
| [Corpus GCS Bucket]: https://goto.google.com/libfuzzer-clusterfuzz-corpus
|
| +[issue 638836]: https://bugs.chromium.org/p/chromium/issues/detail?id=638836
|
|
|