Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(951)

Unified Diff: testing/libfuzzer/efficient_fuzzer.md

Issue 2282703002: [libfuzzer] Add a note to the documentation about AFL and max_len parameter. (Closed)
Patch Set: Small fixes (writing in English isn't my best skill). Created 4 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: testing/libfuzzer/efficient_fuzzer.md
diff --git a/testing/libfuzzer/efficient_fuzzer.md b/testing/libfuzzer/efficient_fuzzer.md
index cad61311d59ddaf7bf71db7ca3fbf44a40f73626..e2e8b113a33d98fda8cc76030dfe00f0cd141a40 100644
--- a/testing/libfuzzer/efficient_fuzzer.md
+++ b/testing/libfuzzer/efficient_fuzzer.md
@@ -74,6 +74,19 @@ resources used for fuzzing. If large inputs make fuzzer too slow you have to
adjust value of `-max_len` and find a trade-off between coverage and execution
speed.
+*Note:* ClusterFuzz runs two different fuzzing engines (**LibFuzzer** and
+**AFL**) using the same target functions. AFL doesn't support `-max_len`
+parameter and may provide input of any length to the target. If your target has
+an input length limit that you would like to *strictly enforce*, it's
+recommended to add a sanity check to the beginning of your target function:
+
+```
+if (size > kSizeLimit)
+ return 0;
+```
+
+For more information check out the discussion in [issue 638836].
+
## Corpus Size
@@ -222,3 +235,4 @@ Other options may be passed through `libfuzzer_options` property.
[AFL]: http://lcamtuf.coredump.cx/afl/
[ClusterFuzz status]: clusterfuzz.md#Status-Links
[Corpus GCS Bucket]: https://goto.google.com/libfuzzer-clusterfuzz-corpus
+[issue 638836]: https://bugs.chromium.org/p/chromium/issues/detail?id=638836
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698