1# Fuzzers 2 3These are fuzzers designed for use with `libFuzzer` or `afl`. They can 4be used to run on Google's OSS-Fuzz (https://github.com/google/oss-fuzz/). 5 6The convention used here is that the initial values for each parser fuzzer 7are taken from the $NAME.in directory. 8 9Crash reproducers from OSS-Fuzz are put into $NAME.repro directory for 10regression testing with top dir 'make check' or 'make check-valgrind'. 11 12The ./configure runs below are for libidn2. 13To test libicu replace 'libidn2' with 'libicu', to test with 14libidn replace 'libidn2' by 'libidn'. 15 16 17# Running a fuzzer using clang 18 19Use the following commands on top dir: 20``` 21export CC=clang-5.0 22export CFLAGS="-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=address -fsanitize-address-use-after-scope -fsanitize-coverage=trace-pc-guard,trace-cmp" 23./configure --enable-static --disable-gtk-doc --enable-runtime=libidn2 --enable-builtin=libidn2 24make clean 25make -j$(nproc) 26cd fuzz 27 28# build and run libpsl_fuzzer 29./run-clang.sh libpsl_fuzzer 30``` 31 32 33# Running a fuzzer using AFL 34 35Use the following commands on top dir: 36 37``` 38$ CC=afl-clang-fast ./configure --disable-gtk-doc --enable-runtime=libidn2 --enable-builtin=libidn2 39$ make -j$(nproc) clean all 40$ cd fuzz 41$ ./run-afl.sh libpsl_fuzzer 42``` 43 44# Fuzz code coverage using the corpus directories *.in/ 45 46Code coverage reports currently work best with gcc+lcov+genhtml. 47 48In the top directory: 49``` 50CC=gcc CFLAGS="-O0 -g" ./configure --disable-gtk-doc --enable-runtime=libidn2 --enable-builtin=libidn2 51make fuzz-coverage 52xdg-open lcov/index.html 53``` 54 55Each fuzzer target has it's own functions to cover, e.g. 56`libpsl_fuzzer` covers psl_is_public_suffix. 57 58To work on corpora for better coverage, `cd fuzz` and use e.g. 59`./view-coverage.sh libpsl_fuzzer`. 60 61 62# Enhancing the testsuite for issues found 63 64Each reproducer file should be dropped into the appropriate *.repro/ 65directory. 66 67 68# Clang CFI instrumentation 69``` 70CC=clang-5.0 CFLAGS="-B/usr/bin/gold -O0 -fsanitize=cfi -flto -fvisibility=default -fno-sanitize-trap=all" ./configure 71make clean 72make 73make check 74``` 75