| # Fuzzing in Chromium |
| |
| [go/chrome-fuzzing](https://goto.google.com/chrome-fuzzing) |
| |
| *** note |
| **Just got a bug report from ClusterFuzz?:** If you want to reproduce a |
| ClusterFuzz crash locally, see [How to Reproduce a Crash from ClusterFuzz]. |
| *** |
| |
| [Fuzzing] is an automated software testing technique that provides invalid, |
| unexpected, or random data as inputs to a program to find bugs. |
| |
| **Why fuzz?** Fuzzing finds thousands of security and stability issues before |
| they reach users (see [go/fuzzing-success]). For more information about the |
| benefits of fuzzing, see [go/why-fuzz]. |
| |
| **Where to fuzz?** Fuzz code that parses, decodes, or manipulates input from |
| untrusted sources, such as the web. |
| |
| [TOC] |
| |
| ## Getting started |
| |
| In Chromium, you can create and submit fuzz targets that run continuously at |
| scale on [ClusterFuzz]. Prefer FuzzTest for all new fuzz targets. Use libFuzzer |
| only to maintain existing targets. |
| |
| ### FuzzTest (recommended) |
| |
| FuzzTest integrates with the gtest framework and tests code that accepts |
| structured, typed inputs, such as `int`, `std::string`, `std::vector`, or custom |
| classes. |
| |
| * To write your first FuzzTest, see [Getting Started with FuzzTest]. |
| * To visualize the impact of your fuzzer, see |
| [Generating local code coverage reports for FuzzTests]. |
| |
| ### libFuzzer (deprecated) |
| |
| [libFuzzer] tests APIs that consume raw byte buffers, such as image decoders and |
| JSON or XML parsers. |
| |
| * To write, build, and run a basic libFuzzer target, see |
| [Getting Started with libFuzzer]. |
| * To make your fuzzer more effective using seed corpuses and dictionaries, |
| see [Improving fuzz target efficiency]. |
| |
| ## Advanced topics |
| |
| * [Getting Started with libprotobuf-mutator (LPM)] - Fuzz code that expects a |
| protobuf, has multiple inputs, or is defined by a grammar. |
| |
| * [Fuzzing mojo interfaces] - A guide for using LPM to fuzz Mojo interfaces. |
| |
| * [Fuzzing in Chrome OS] - Writing fuzzers for the non-browser parts of Chrome |
| OS. |
| |
| * [Fuzzing browsertests] - For fuzzing multiple Chrome subsystems that require |
| a full browser environment. |
| |
| * [libFuzzer Integration Details] - The specifics of how libFuzzer integrates |
| with Chromium and ClusterFuzz. |
| |
| * [libfuzzer Technical References] - A detailed reference for build arguments |
| (GN), sanitizer configurations, platform support, and ClusterFuzz options. |
| |
| * [Blackbox fuzzing] - Fuzz large, slow, or non-deterministic targets without |
| coverage guidance. To learn how to generate and view a code |
| coverage report for your blackbox fuzzer, see [Local Code Coverage for blackbox fuzzers] |
| |
| ## Getting help |
| |
| If you have questions or encounter issues, |
| |
| * email `chrome-fuzzing-core@google.com` or |
| * file a bug using the **Chrome > Security > Fuzzing** component. |
| |
| ## View dashboard and stats |
| |
| * [go/chrome-fuzzing-dashboard] - View the code coverage achieved by fuzzers |
| in Chromium. |
| * [ClusterFuzz Stats] - Performance statistics for fuzzers. |
| |
| [Blackbox fuzzing]: https://google.github.io/clusterfuzz/reference/coverage-guided-vs-blackbox/#blackbox-fuzzing |
| [ClusterFuzz]: https://clusterfuzz.com/ |
| [ClusterFuzz Stats]: https://clusterfuzz.com/fuzzer-stats/ |
| [Fuzzing]: https://en.wikipedia.org/wiki/Fuzzing |
| [Fuzzing browsertests]: fuzzing_browsertests.md |
| [Fuzzing in Chrome OS]: https://www.chromium.org/chromium-os/developer-library/guides/testing/fuzzing/ |
| [Fuzzing mojo interfaces]: ../../mojo/docs/mojolpm.md |
| [Generating local code coverage reports for FuzzTests]: fuzz_test_coverage.md |
| [Getting Started with FuzzTest]: getting_started.md |
| [Getting Started with libfuzzer]: getting_started_with_libfuzzer.md |
| [Getting Started with libprotobuf-mutator (LPM)]: libprotobuf-mutator.md |
| [go/chrome-fuzzing-dashboard]: https://analysis.chromium.org/coverage/p/chromium?platform=fuzz&test_suite_type=any&path=%2F%2F&project=chromium%2Fsrc&path=%2F%2F&host=chromium.googlesource.com&ref=refs%2Fheads%2Fmain&modifier_id=0 |
| [go/fuzzing-success]: http://go/fuzzing-success |
| [go/why-fuzz]: http://go/why-fuzz |
| [How to Reproduce a Crash from ClusterFuzz]: reproducing.md |
| [Improving fuzz target efficiency]: efficient_fuzzing.md |
| [libFuzzer]: http://llvm.org/docs/LibFuzzer.html |
| [libFuzzer Integration Details]: libFuzzer_integration.md |
| [libFuzzer technical references]: reference.md |
| [Local Code Coverage for blackbox fuzzers]: blackbox_coverage.md |
