Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 # Getting Started with libFuzzer in Chrome | 1 # Getting Started with libFuzzer in Chrome |
| 2 | 2 |
| 3 *** note | 3 *** note |
| 4 **Prerequisites:** libFuzzer in Chrome is supported with GN on Linux only. | 4 **Prerequisites:** libFuzzer in Chrome is supported with GN on Linux only. |
| 5 *** | 5 *** |
| 6 | 6 |
| 7 This document will walk you through: | 7 This document will walk you through: |
| 8 | 8 |
| 9 * setting up your build enviroment. | 9 * setting up your build enviroment. |
| 10 * creating your first fuzzer. | 10 * creating your first fuzzer. |
| (...skipping 86 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 97 of the biggest testcase in corpus if corpus is not empty. ClusterFuzz takes | 97 of the biggest testcase in corpus if corpus is not empty. ClusterFuzz takes |
| 98 random value in range from `1` to `10000` for each fuzzing session and passes | 98 random value in range from `1` to `10000` for each fuzzing session and passes |
| 99 that value to libFuzzers. If corpus contains testcases of size greater than | 99 that value to libFuzzers. If corpus contains testcases of size greater than |
| 100 `max_len`, libFuzzer will use only first `max_len` bytes of such testcases. | 100 `max_len`, libFuzzer will use only first `max_len` bytes of such testcases. |
| 101 | 101 |
| 102 | 102 |
| 103 You can specify custom `max_len` value to be used by ClusterFuzz. For more | 103 You can specify custom `max_len` value to be used by ClusterFuzz. For more |
| 104 information check out [Maximum Testcase Length] section of the [Efficient Fuzzer | 104 information check out [Maximum Testcase Length] section of the [Efficient Fuzzer |
| 105 Guide]. | 105 Guide]. |
| 106 | 106 |
| 107 ## Remove error message logging | |
|
inferno
2016/08/30 15:57:39
s/Remove/Disable noisy
robert.bradford
2016/08/30 16:16:51
Done.
| |
| 108 | |
| 109 If the code that you are a fuzzing generates error messages when encountering | |
| 110 incorrect or invalid data then you need to silence those errors in the fuzzer. | |
| 111 The best way to do that is to override the environment used for logging in your | |
|
mmoroz
2016/08/30 15:54:00
I think it's worth to clarify "If the target uses
robert.bradford
2016/08/30 16:16:51
Done.
| |
| 112 fuzzer: | |
| 113 | |
| 114 ```cpp | |
| 115 struct Environment { | |
| 116 Environment() { | |
| 117 logging::SetMinLogLevel(logging::LOG_FATAL); | |
| 118 } | |
| 119 }; | |
| 120 | |
| 121 Environment* env = new Environment(); | |
| 122 ``` | |
| 123 | |
| 107 ## Submitting Fuzzer to ClusterFuzz | 124 ## Submitting Fuzzer to ClusterFuzz |
| 108 | 125 |
| 109 ClusterFuzz builds and executes all `fuzzer_test` targets in the source tree. | 126 ClusterFuzz builds and executes all `fuzzer_test` targets in the source tree. |
| 110 The only thing you should do is to submit a fuzzer into Chrome. | 127 The only thing you should do is to submit a fuzzer into Chrome. |
| 111 | 128 |
| 112 ## Next Steps | 129 ## Next Steps |
| 113 | 130 |
| 114 * After your fuzzer is submitted, you should check its [ClusterFuzz status] in | 131 * After your fuzzer is submitted, you should check its [ClusterFuzz status] in |
| 115 a day or two. | 132 a day or two. |
| 116 * Check the [Efficient Fuzzer Guide] to better understand your fuzzer | 133 * Check the [Efficient Fuzzer Guide] to better understand your fuzzer |
| (...skipping 15 matching lines...) Expand all Loading... | |
| 132 | 149 |
| 133 | 150 |
| 134 [Address Sanitizer]: http://clang.llvm.org/docs/AddressSanitizer.html | 151 [Address Sanitizer]: http://clang.llvm.org/docs/AddressSanitizer.html |
| 135 [Memory Sanitizer]: http://clang.llvm.org/docs/MemorySanitizer.html | 152 [Memory Sanitizer]: http://clang.llvm.org/docs/MemorySanitizer.html |
| 136 [Undefined Behavior Sanitizer]: http://clang.llvm.org/docs/UndefinedBehaviorSani tizer.html | 153 [Undefined Behavior Sanitizer]: http://clang.llvm.org/docs/UndefinedBehaviorSani tizer.html |
| 137 [ClusterFuzz status]: clusterfuzz.md#Status-Links | 154 [ClusterFuzz status]: clusterfuzz.md#Status-Links |
| 138 [crbug/598448]: https://bugs.chromium.org/p/chromium/issues/detail?id=598448 | 155 [crbug/598448]: https://bugs.chromium.org/p/chromium/issues/detail?id=598448 |
| 139 [Efficient Fuzzer Guide]: efficient_fuzzer.md | 156 [Efficient Fuzzer Guide]: efficient_fuzzer.md |
| 140 [Maximum Testcase Length]: efficient_fuzzer.md#Maximum-Testcase-Length | 157 [Maximum Testcase Length]: efficient_fuzzer.md#Maximum-Testcase-Length |
| 141 [url_parse_fuzzer.cc]: https://code.google.com/p/chromium/codesearch#chromium/sr c/testing/libfuzzer/fuzzers/url_parse_fuzzer.cc | 158 [url_parse_fuzzer.cc]: https://code.google.com/p/chromium/codesearch#chromium/sr c/testing/libfuzzer/fuzzers/url_parse_fuzzer.cc |
| OLD | NEW |