Google Git
Sign in
chromium / chromium / src / testing / libfuzzer / 6620e1393282b404963340b26b4e1873937e6906
commit6620e1393282b404963340b26b4e1873937e6906[log] [tgz]
authorTom Anderson <thomasanderson@chromium.org>Wed Jun 13 22:30:42 2018
committerCommit Bot <commit-bot@chromium.org>Wed Jun 13 22:30:42 2018
treedbc5364b0b79f0fe1c2370637045a5238eaadec4
parent959201983529569b079fa3e6fdc0407d2009090f [diff]
Remove absolute paths from build files

This CL removes all absolute paths to src and all usages of the out directory
name from all ninja files on most Linux builds.

This means it's possible to mount your src directory at different locations and
still have incremental builds work.  You can also rename your out directory.

BUG=None
R=dpranke,caitkp,rockot

Change-Id: I5ff5b0d2d60110755dde64e876c7f1a09d814b1a
Reviewed-on: https://chromium-review.googlesource.com/1091457
Reviewed-by: Cait Phillips <caitkp@chromium.org>
Reviewed-by: Ken Rockot <rockot@chromium.org>
Reviewed-by: Dirk Pranke <dpranke@chromium.org>
Commit-Queue: Thomas Anderson <thomasanderson@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#567020}
Cr-Mirrored-From: https://chromium.googlesource.com/chromium/src
Cr-Mirrored-Commit: 8dbc0c8285460d36e204f7da9f4ddbaed792947d
1 file changed
tree: dbc5364b0b79f0fe1c2370637045a5238eaadec4
  1. fuzzers/
  2. proto/
  3. tests/
  4. archive_corpus.py
  5. BUILD.gn
  6. clusterfuzz.md
  7. dictionary_generator.py
  8. drfuzz_main.cc
  9. efficient_fuzzer.md
  10. fuzzer_test.gni
  11. gen_fuzzer_config.py
  12. gen_fuzzer_owners.py
  13. getting_started.md
  14. libfuzzer_exports.h
  15. libprotobuf-mutator.md
  16. OWNERS
  17. README.md
  18. reference.md
  19. unittest_main.cc
  20. zip_sources.py
README.md

libFuzzer in Chromium

go/libfuzzer-chromium (Googler only)

Getting Started | Buildbot | ClusterFuzz Status | Cover Bug

This directory contains integration between libFuzzer and Chromium. LibFuzzer is an in-process coverage-driven evolutionary fuzzing engine. It helps engineers to uncover potential security & stability problems earlier.

Requirements: libFuzzer in Chromium is supported with Linux and Mac only.

Integration Status

Fuzzer tests are well-integrated with Chromium build system and distributed ClusterFuzz fuzzing system. Cover bug: crbug.com/539572.

Documentation

  • Getting Started Guide walks you through all the steps necessary to create your fuzz target and submit it to ClusterFuzz.
  • Efficient Fuzzer Guide explains how to measure fuzz target effectiveness and ways to improve it.
  • Guide to libprotobuf-mutator walks through the steps necessary to create a fuzz target that expects a protobuf as input (instead of a byte stream). In addition to fuzzing code that accepts protobufs, it can be used to fuzz code that requires multiple mutated inputs, or to generate inputs defined by a grammar.
  • ClusterFuzz Integration describes integration between ClusterFuzz and libFuzzer.
  • Reproducing contains information on how to reproduce bugs reported by ClusterFuzz.
  • Reference contains detailed references for different integration parts.

Trophies

  • ClusterFuzz Bugs - issues found and automatically filed by ClusterFuzz.
  • Manual Bugs - issues that were filed manually after running fuzz targets.
  • Pdfium Bugs - bugs found in pdfium by manual fuzzing.
  • OSS Trophies - bugs found with libFuzzer in open-source projects.

Blog Posts

Project Links