| OLD | NEW |
| 1 # Efficient Fuzzer | 1 # Efficient Fuzzer |
| 2 | 2 |
| 3 This document describes ways to determine your fuzzer efficiency and ways | 3 This document describes ways to determine your fuzzer efficiency and ways |
| 4 to improve it. | 4 to improve it. |
| 5 | 5 |
| 6 ## Overview | 6 ## Overview |
| 7 | 7 |
| 8 Being a coverage-driven fuzzer, libFuzzer considers a certain input *interesting
* | 8 Being a coverage-driven fuzzer, libFuzzer considers a certain input *interesting
* |
| 9 if it results in new coverage. The set of all interesting inputs is called | 9 if it results in new coverage. The set of all interesting inputs is called |
| 10 *corpus*. | 10 *corpus*. |
| (...skipping 40 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 51 `seed_corpus` attribute to fuzzer target: | 51 `seed_corpus` attribute to fuzzer target: |
| 52 | 52 |
| 53 ``` | 53 ``` |
| 54 fuzzer_test("my_protocol_fuzzer") { | 54 fuzzer_test("my_protocol_fuzzer") { |
| 55 ... | 55 ... |
| 56 seed_corpus = "src/fuzz/testcases" | 56 seed_corpus = "src/fuzz/testcases" |
| 57 ... | 57 ... |
| 58 } | 58 } |
| 59 ``` | 59 ``` |
| 60 | 60 |
| 61 You may specify multiple seed corpus directories via `seed_corpuses` attribute: |
| 62 |
| 63 ``` |
| 64 fuzzer_test("my_protocol_fuzzer") { |
| 65 ... |
| 66 seed_corpuses = [ "src/fuzz/testcases", "src/unittest/data" ] |
| 67 ... |
| 68 } |
| 69 ``` |
| 70 |
| 71 All files found in the directories and their subdirectories will be archived |
| 72 into `%YOUR_FUZZER_NAME%_seed_corpus.zip` output archive. |
| 73 |
| 61 If you don't want to store seed corpus in Chromium repository, you can upload | 74 If you don't want to store seed corpus in Chromium repository, you can upload |
| 62 corpus to Google Cloud Storage bucket used by ClusterFuzz: | 75 corpus to Google Cloud Storage bucket used by ClusterFuzz: |
| 63 | 76 |
| 64 | 77 |
| 65 1) go to [Corpus GCS Bucket] | 78 1) go to [Corpus GCS Bucket] |
| 66 | 79 |
| 67 2) open directory named `%YOUR_FUZZER_NAME%_static` | 80 2) open directory named `%YOUR_FUZZER_NAME%_static` |
| 68 | 81 |
| 69 3) upload corpus files into the directory | 82 3) upload corpus files into the directory |
| 70 | 83 |
| (...skipping 174 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 245 ``` | 258 ``` |
| 246 | 259 |
| 247 Please note that `dict` parameter should be provided [separately](#Fuzzer-Dictio
nary). | 260 Please note that `dict` parameter should be provided [separately](#Fuzzer-Dictio
nary). |
| 248 Other options may be passed through `libfuzzer_options` property. | 261 Other options may be passed through `libfuzzer_options` property. |
| 249 | 262 |
| 250 | 263 |
| 251 [AFL]: http://lcamtuf.coredump.cx/afl/ | 264 [AFL]: http://lcamtuf.coredump.cx/afl/ |
| 252 [ClusterFuzz status]: clusterfuzz.md#Status-Links | 265 [ClusterFuzz status]: clusterfuzz.md#Status-Links |
| 253 [Corpus GCS Bucket]: https://goto.google.com/libfuzzer-clusterfuzz-corpus | 266 [Corpus GCS Bucket]: https://goto.google.com/libfuzzer-clusterfuzz-corpus |
| 254 [issue 638836]: https://bugs.chromium.org/p/chromium/issues/detail?id=638836 | 267 [issue 638836]: https://bugs.chromium.org/p/chromium/issues/detail?id=638836 |
| OLD | NEW |