OLD | NEW |
---|---|
1 # Getting Started with libFuzzer in Chrome | 1 # Getting Started with libFuzzer in Chrome |
2 | 2 |
3 *** note | 3 *** note |
4 **Prerequisites:** libFuzzer in Chrome is supported with GN on Linux only. | 4 **Prerequisites:** libFuzzer in Chrome is supported with GN on Linux only. |
5 *** | 5 *** |
6 | 6 |
7 This document will walk you through: | 7 This document will walk you through: |
8 | 8 |
9 * setting up your build enviroment. | 9 * setting up your build enviroment. |
10 * creating your first fuzzer. | 10 * creating your first fuzzer. |
(...skipping 86 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
97 of the biggest testcase in corpus if corpus is not empty. ClusterFuzz takes | 97 of the biggest testcase in corpus if corpus is not empty. ClusterFuzz takes |
98 random value in range from `1` to `10000` for each fuzzing session and passes | 98 random value in range from `1` to `10000` for each fuzzing session and passes |
99 that value to libFuzzers. If corpus contains testcases of size greater than | 99 that value to libFuzzers. If corpus contains testcases of size greater than |
100 `max_len`, libFuzzer will use only first `max_len` bytes of such testcases. | 100 `max_len`, libFuzzer will use only first `max_len` bytes of such testcases. |
101 | 101 |
102 | 102 |
103 You can specify custom `max_len` value to be used by ClusterFuzz. For more | 103 You can specify custom `max_len` value to be used by ClusterFuzz. For more |
104 information check out [Maximum Testcase Length] section of the [Efficient Fuzzer | 104 information check out [Maximum Testcase Length] section of the [Efficient Fuzzer |
105 Guide]. | 105 Guide]. |
106 | 106 |
107 ## Remove error message logging | |
inferno
2016/08/30 15:57:39
s/Remove/Disable noisy
robert.bradford
2016/08/30 16:16:51
Done.
| |
108 | |
109 If the code that you are a fuzzing generates error messages when encountering | |
110 incorrect or invalid data then you need to silence those errors in the fuzzer. | |
111 The best way to do that is to override the environment used for logging in your | |
mmoroz
2016/08/30 15:54:00
I think it's worth to clarify "If the target uses
robert.bradford
2016/08/30 16:16:51
Done.
| |
112 fuzzer: | |
113 | |
114 ```cpp | |
115 struct Environment { | |
116 Environment() { | |
117 logging::SetMinLogLevel(logging::LOG_FATAL); | |
118 } | |
119 }; | |
120 | |
121 Environment* env = new Environment(); | |
122 ``` | |
123 | |
107 ## Submitting Fuzzer to ClusterFuzz | 124 ## Submitting Fuzzer to ClusterFuzz |
108 | 125 |
109 ClusterFuzz builds and executes all `fuzzer_test` targets in the source tree. | 126 ClusterFuzz builds and executes all `fuzzer_test` targets in the source tree. |
110 The only thing you should do is to submit a fuzzer into Chrome. | 127 The only thing you should do is to submit a fuzzer into Chrome. |
111 | 128 |
112 ## Next Steps | 129 ## Next Steps |
113 | 130 |
114 * After your fuzzer is submitted, you should check its [ClusterFuzz status] in | 131 * After your fuzzer is submitted, you should check its [ClusterFuzz status] in |
115 a day or two. | 132 a day or two. |
116 * Check the [Efficient Fuzzer Guide] to better understand your fuzzer | 133 * Check the [Efficient Fuzzer Guide] to better understand your fuzzer |
(...skipping 15 matching lines...) Expand all Loading... | |
132 | 149 |
133 | 150 |
134 [Address Sanitizer]: http://clang.llvm.org/docs/AddressSanitizer.html | 151 [Address Sanitizer]: http://clang.llvm.org/docs/AddressSanitizer.html |
135 [Memory Sanitizer]: http://clang.llvm.org/docs/MemorySanitizer.html | 152 [Memory Sanitizer]: http://clang.llvm.org/docs/MemorySanitizer.html |
136 [Undefined Behavior Sanitizer]: http://clang.llvm.org/docs/UndefinedBehaviorSani tizer.html | 153 [Undefined Behavior Sanitizer]: http://clang.llvm.org/docs/UndefinedBehaviorSani tizer.html |
137 [ClusterFuzz status]: clusterfuzz.md#Status-Links | 154 [ClusterFuzz status]: clusterfuzz.md#Status-Links |
138 [crbug/598448]: https://bugs.chromium.org/p/chromium/issues/detail?id=598448 | 155 [crbug/598448]: https://bugs.chromium.org/p/chromium/issues/detail?id=598448 |
139 [Efficient Fuzzer Guide]: efficient_fuzzer.md | 156 [Efficient Fuzzer Guide]: efficient_fuzzer.md |
140 [Maximum Testcase Length]: efficient_fuzzer.md#Maximum-Testcase-Length | 157 [Maximum Testcase Length]: efficient_fuzzer.md#Maximum-Testcase-Length |
141 [url_parse_fuzzer.cc]: https://code.google.com/p/chromium/codesearch#chromium/sr c/testing/libfuzzer/fuzzers/url_parse_fuzzer.cc | 158 [url_parse_fuzzer.cc]: https://code.google.com/p/chromium/codesearch#chromium/sr c/testing/libfuzzer/fuzzers/url_parse_fuzzer.cc |
OLD | NEW |