1Fuzz targets used by [oss-fuzz](https://github.com/google/oss-fuzz/). 2 3Useful links: [Dashboard](https://oss-fuzz.com/) _(requires access)_, [Build logs](https://oss-fuzz-build-logs.storage.googleapis.com/index.html), [Coverage](https://oss-fuzz.com/coverage-report/job/libfuzzer_asan_glib/latest) 4 5## How to add new targets 6 7Add **fuzz_target_name.c** and edit `meson.build` accordingly. 8 9New targets are picked up by oss-fuzz automatically within a day. Targets must not be renamed once added. 10 11Add (optional) **fuzz_target_name.dict** containing keywords and magic bytes. 12 13Add (optional) **fuzz_target_name.corpus** with file names on separate lines. Wildcards `?`, `*` and `**` are supported. Examples below. 14 15```bash 16glib/* # all files in directory glib 17glib/** # all files in directory glib and sub-directories 18**.xbel # all files ending with .xbel in the repository 19``` 20 21Recommended reading: [Fuzz Target](https://llvm.org/docs/LibFuzzer.html#fuzz-target), [Dictionaries](https://llvm.org/docs/LibFuzzer.html#dictionaries), [Corpus](https://llvm.org/docs/LibFuzzer.html#corpus) 22 23## How to reproduce oss-fuzz bugs locally 24 25Build with at least the following flags, choosing a sanitizer as needed. A somewhat recent version of [clang](http://clang.llvm.org/) is recommended. 26 27```bash 28$ CC=clang CXX=clang++ meson DIR -Db_sanitize=<address|undefined> -Db_lundef=false 29``` 30 31Afterwards run the affected target against the provided test case. 32 33```bash 34$ DIR/fuzzing/fuzz_target_name FILE 35``` 36 37#### FAQs 38 39###### What about Memory Sanitizer (MSAN)? 40 41Correct MSAN instrumentation is [difficult to achieve](https://clang.llvm.org/docs/MemorySanitizer.html#handling-external-code) locally, so false positives are very likely to mask the actual bug. 42 43If need be, [you can still reproduce](https://github.com/google/oss-fuzz/blob/master/docs/reproducing.md#building-using-docker) those bugs with the oss-fuzz provided docker images. 44 45###### There are no file/function names in the stack trace. 46 47`llvm-symbolizer` must be in `PATH`. 48 49###### UndefinedBehavior Sanitizer (UBSAN) doesn't provide a stack trace. 50 51Set environment variable `UBSAN_OPTIONS` to `print_stacktrace=1` prior to running the target. 52