OLD | NEW |
1 # Getting Started with libFuzzer in Chrome | 1 # Getting Started with libFuzzer in Chrome |
2 | 2 |
3 *** note | 3 *** note |
4 **Prerequisites:** libFuzzer in Chrome is supported with GN on Linux only. | 4 **Prerequisites:** libFuzzer in Chrome is supported with GN on Linux only. |
5 *** | 5 *** |
6 | 6 |
7 This document will walk you through: | 7 This document will walk you through: |
8 | 8 |
9 * setting up your build enviroment. | 9 * setting up your build enviroment. |
10 * creating your first fuzzer. | 10 * creating your first fuzzer. |
(...skipping 86 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
97 of the biggest testcase in corpus if corpus is not empty. ClusterFuzz takes | 97 of the biggest testcase in corpus if corpus is not empty. ClusterFuzz takes |
98 random value in range from `1` to `10000` for each fuzzing session and passes | 98 random value in range from `1` to `10000` for each fuzzing session and passes |
99 that value to libFuzzers. If corpus contains testcases of size greater than | 99 that value to libFuzzers. If corpus contains testcases of size greater than |
100 `max_len`, libFuzzer will use only first `max_len` bytes of such testcases. | 100 `max_len`, libFuzzer will use only first `max_len` bytes of such testcases. |
101 | 101 |
102 | 102 |
103 You can specify custom `max_len` value to be used by ClusterFuzz. For more | 103 You can specify custom `max_len` value to be used by ClusterFuzz. For more |
104 information check out [Maximum Testcase Length] section of the [Efficient Fuzzer | 104 information check out [Maximum Testcase Length] section of the [Efficient Fuzzer |
105 Guide]. | 105 Guide]. |
106 | 106 |
| 107 ## Disable noisy error message logging |
| 108 |
| 109 If the code that you are a fuzzing generates error messages when encountering |
| 110 incorrect or invalid data then you need to silence those errors in the fuzzer. |
| 111 |
| 112 If the target uses the Chromium logging APIs, the best way to do that is to |
| 113 override the environment used for logging in your fuzzer: |
| 114 |
| 115 ```cpp |
| 116 struct Environment { |
| 117 Environment() { |
| 118 logging::SetMinLogLevel(logging::LOG_FATAL); |
| 119 } |
| 120 }; |
| 121 |
| 122 Environment* env = new Environment(); |
| 123 ``` |
| 124 |
107 ## Submitting Fuzzer to ClusterFuzz | 125 ## Submitting Fuzzer to ClusterFuzz |
108 | 126 |
109 ClusterFuzz builds and executes all `fuzzer_test` targets in the source tree. | 127 ClusterFuzz builds and executes all `fuzzer_test` targets in the source tree. |
110 The only thing you should do is to submit a fuzzer into Chrome. | 128 The only thing you should do is to submit a fuzzer into Chrome. |
111 | 129 |
112 ## Next Steps | 130 ## Next Steps |
113 | 131 |
114 * After your fuzzer is submitted, you should check its [ClusterFuzz status] in | 132 * After your fuzzer is submitted, you should check its [ClusterFuzz status] in |
115 a day or two. | 133 a day or two. |
116 * Check the [Efficient Fuzzer Guide] to better understand your fuzzer | 134 * Check the [Efficient Fuzzer Guide] to better understand your fuzzer |
(...skipping 15 matching lines...) Expand all Loading... |
132 | 150 |
133 | 151 |
134 [Address Sanitizer]: http://clang.llvm.org/docs/AddressSanitizer.html | 152 [Address Sanitizer]: http://clang.llvm.org/docs/AddressSanitizer.html |
135 [Memory Sanitizer]: http://clang.llvm.org/docs/MemorySanitizer.html | 153 [Memory Sanitizer]: http://clang.llvm.org/docs/MemorySanitizer.html |
136 [Undefined Behavior Sanitizer]: http://clang.llvm.org/docs/UndefinedBehaviorSani
tizer.html | 154 [Undefined Behavior Sanitizer]: http://clang.llvm.org/docs/UndefinedBehaviorSani
tizer.html |
137 [ClusterFuzz status]: clusterfuzz.md#Status-Links | 155 [ClusterFuzz status]: clusterfuzz.md#Status-Links |
138 [crbug/598448]: https://bugs.chromium.org/p/chromium/issues/detail?id=598448 | 156 [crbug/598448]: https://bugs.chromium.org/p/chromium/issues/detail?id=598448 |
139 [Efficient Fuzzer Guide]: efficient_fuzzer.md | 157 [Efficient Fuzzer Guide]: efficient_fuzzer.md |
140 [Maximum Testcase Length]: efficient_fuzzer.md#Maximum-Testcase-Length | 158 [Maximum Testcase Length]: efficient_fuzzer.md#Maximum-Testcase-Length |
141 [url_parse_fuzzer.cc]: https://code.google.com/p/chromium/codesearch#chromium/sr
c/testing/libfuzzer/fuzzers/url_parse_fuzzer.cc | 159 [url_parse_fuzzer.cc]: https://code.google.com/p/chromium/codesearch#chromium/sr
c/testing/libfuzzer/fuzzers/url_parse_fuzzer.cc |
OLD | NEW |