Google Git
Sign in
fuchsia / third_party / capstone / refs/heads/upstream/next / . / suite / fuzz
tree: b6a420e037eb1f9f3159829411d93d54945e3173 [path history] [tgz]
  1. driverbin.c
  2. drivermc.c
  3. fuzz_decode_platform.c
  4. fuzz_diff.c
  5. fuzz_disasm.c
  6. fuzz_disasm.options
  7. fuzz_harness.c
  8. fuzz_llvm.cpp
  9. fuzzit.sh
  10. fuzzitid.txt
  11. Makefile
  12. onefile.c
  13. platform.c
  14. platform.h
  15. README
  16. README.md
suite/fuzz/README.md

Fuzzing

Build the fuzz target

To build the fuzz target, you can simply run make with appropriate flags set :

ASAN_OPTIONS=detect_leaks=0 CXXFLAGS="-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=address -fsanitize=fuzzer-no-link" CFLAGS="-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=address -fsanitize=fuzzer-no-link" LDFLAGS="-fsanitize=address" make

You can replace address with another sanitizer : memory or undefined The fuzz target is then suite/fuzz/fuzz_bindisasm2

You can find this in travis configuration .travis.yml

Another way is to use oss-fuzz, see https://github.com/google/oss-fuzz/blob/master/projects/capstone/build.sh

Troubleshooting

If you get cc: error: unrecognized argument to ‘-fsanitize=’ option: ‘fuzzer’ check if you have a workable version of libfuzz installed. Also try to build with CC=clang make

Fuzz drivers

There are custom drivers :

  • driverbin.c : prints cstool command before running one input
  • drivermc.c : converts MC test data to raw binary data before running as many inputs as there are lines in a file
  • onefile.c : simple one file driver

For libfuzzer, the preferred main function is now to use linker option -fsanitize=fuzzer

Fuzzit integration

Travis will build the fuzz target with the different sanitizers. Then, Travis will launch sanity fuzzit jobs as part of continuous integration (for each of the sanitizers) The fuzzit target ids are stored in a configuration file fuzzitid.txt and used by fuzzit.sh