Google Git
Sign in
chromium / chromium / src / testing / libfuzzer / 83c21600a7870f70eacdb844638400e3b1f4a1c3
commit83c21600a7870f70eacdb844638400e3b1f4a1c3[log] [tgz]
authorJonathan Metzman <metzman@chromium.org>Mon May 06 22:44:02 2019
committerCommit Bot <commit-bot@chromium.org>Mon May 06 22:44:02 2019
tree0fdd19cb6b823c65de6bac1f8580e01f7f841196
parent8ebd031d59545d393a3be58ad732fcc131476ef3 [diff]
[libFuzzer] Fix condition so that seed corpus is built if specified

Change-Id: I054de85834ae17f3066e482c2cd9c88abcc0eb36
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1596851
Commit-Queue: Jonathan Metzman <metzman@chromium.org>
Commit-Queue: Abhishek Arya <inferno@chromium.org>
Auto-Submit: Jonathan Metzman <metzman@chromium.org>
Reviewed-by: Abhishek Arya <inferno@chromium.org>
Reviewed-by: Max Moroz <mmoroz@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#657002}
Cr-Mirrored-From: https://chromium.googlesource.com/chromium/src
Cr-Mirrored-Commit: d116138e15577b0b5bd0d7c2e7fe48d1e8925706
1 file changed
tree: 0fdd19cb6b823c65de6bac1f8580e01f7f841196
  1. fuzzers/
  2. proto/
  3. tests/
  4. AFL.md
  5. archive_corpus.py
  6. BUILD.gn
  7. clusterfuzz.md
  8. dictionary_generator.py
  9. efficient_fuzzer.md
  10. fuzzer_test.gni
  11. gen_fuzzer_config.py
  12. gen_fuzzer_owners.py
  13. getting_started.md
  14. libfuzzer_exports.h
  15. libprotobuf-mutator.md
  16. OWNERS
  17. README.md
  18. reference.md
  19. reproducing.md
  20. unittest_main.cc
  21. zip_sources.py
README.md

libFuzzer in Chromium

go/libfuzzer-chromium (Googler only)

Getting Started | Buildbot | ClusterFuzz Stats | Cover Bug

This directory contains integration between libFuzzer and Chromium. LibFuzzer is an in-process coverage-driven evolutionary fuzzing engine. It helps engineers to uncover potential security & stability problems.

Requirements: libFuzzer in Chromium is supported with Linux, Chrome OS, Mac, and Windows.

Integration Status

Fuzzer tests are well-integrated with Chromium build system and distributed ClusterFuzz fuzzing system. Cover bug: crbug.com/539572.

Documentation

  • Getting Started Guide walks you through all the steps necessary to create your fuzz target and submit it to ClusterFuzz.
  • Efficient Fuzzer Guide explains how to measure fuzz target effectiveness and ways to improve it.
  • Guide to libprotobuf-mutator (LPM) walks through the steps necessary to create a fuzz target that expects a protobuf as input (instead of a byte stream). In addition to fuzzing code that accepts protobufs, it can be used to fuzz code that requires multiple mutated inputs, or to generate inputs defined by a grammar.
  • ClusterFuzz Integration describes integration between ClusterFuzz and libFuzzer.
  • Reproducing Bugs describes how to reproduce bugs found by libFuzzer/AFL and reported by ClusterFuzz.
  • Fuzzing on Chrome OS describes how to write fuzzers for the non-browser parts of Chrome OS.
  • AFL Integration describes AFL's integration with Chromium and ClusterFuzz.
  • Reference contains detailed references for different integration parts.

Trophies

  • ClusterFuzz Bugs - issues found and automatically filed by ClusterFuzz.
  • Manual Bugs - issues that were filed manually after running fuzz targets.
  • Pdfium Bugs - bugs found in pdfium by manual fuzzing.
  • OSS Trophies - bugs found with libFuzzer in open-source projects.

Blog Posts

Project Links