mirror of
https://github.com/radareorg/radare2.git
synced 2024-12-02 18:27:18 +00:00
| .. | ||
| scripts | ||
| fuzz_bin_demangle.c | ||
| fuzz_bin.c | ||
| fuzz_pdb_parse.c | ||
| fuzz_pkcs7_parse.c | ||
| fuzz_protobuf_decode.c | ||
| fuzz_punycode_decode.c | ||
| fuzz_run_parseline.c | ||
| fuzz_x509_parse.c | ||
| meson.build | ||
| README.md | ||
libFuzzer tests
Setup
Get libFuzzer-capable clang
# Linux
export CC=clang-14
# macOS
export CC="$(brew --prefix llvm@14)/bin/clang"
Clean project
rm -rf build
Build project with libFuzzer and sanitizers
# If you want to debug crashes
export CFLAGS="-g"
# Build project with test/fuzz
python3 ./sys/meson.py --fuzz --sanitize address,leak
Run
Refer to https://llvm.org/docs/LibFuzzer.html
Show help
./build/test/fuzz/fuzz_r_run_parseline -help=1
Run fuzzer
mkdir corpus_parseline
./build/test/fuzz/fuzz_r_run_parseline \
-workers=1 -runs=50000 -timeout=3 \
corpus_parseline
Replay crashes
./build/test/fuzz/fuzz_r_run_parseline crash-*
Adding a new target
- add your test to /test/fuzz/meson.build
- add
/test/fuzz/fuzz_<name>.cfile- add system setup to
LLVMFuzzerInitialize(disable logging, enable sandbox, etc) - add fuzz target to
LLVMFuzzerTestOneInput - make sure input is short (ideally no longer than 256 bytes)
- make sure no memory leaks are present
- add system setup to
-close_fd_mask=2(mute stderr) if your target is spammy-ignore_ooms-fork=16if you're likely to OOM