diff options
| author | MarcoFalke <falke.marco@gmail.com> | 2021-05-26 07:34:50 +0200 |
|---|---|---|
| committer | MarcoFalke <falke.marco@gmail.com> | 2021-05-26 07:35:01 +0200 |
| commit | 35b83e6e43159d50179d3e054a6a3de2a690b333 (patch) | |
| tree | 2796389ec4164641c42653191600bc977e2d01bf | |
| parent | 2e7c3461c0142ca989440d5d7abaed054c7b1e7a (diff) | |
| parent | d8f1ea7227260e51c340271fc9a43866799b8ac4 (diff) | |
| download | bitcoin-35b83e6e43159d50179d3e054a6a3de2a690b333.tar.xz | |
Merge bitcoin/bitcoin#22056: doc: describe in fuzzing.md how to reproduce a CI crash
d8f1ea7227260e51c340271fc9a43866799b8ac4 doc: describe in fuzzing.md how to reproduce a CI crash (Jon Atack)
Pull request description:
Not sure if this is 100% accurate or missing any pertinent info, but I misremembered how to do this today and it seems like useful information to provide.
ACKs for top commit:
practicalswift:
ACK d8f1ea7227260e51c340271fc9a43866799b8ac4
Tree-SHA512: 1b74e4187e6ea13b04eb03b3c6e2615c4eb18cc38cce215ad1645f8b135c5c31a243748eb313ccec05f1f62187ba33d550119acf07088968d2d2c1c09bc4c653
| -rw-r--r-- | doc/fuzzing.md | 18 |
1 files changed, 17 insertions, 1 deletions
diff --git a/doc/fuzzing.md b/doc/fuzzing.md index e086840fe6..6fc9077e4c 100644 --- a/doc/fuzzing.md +++ b/doc/fuzzing.md @@ -16,7 +16,7 @@ $ FUZZ=process_message src/test/fuzz/fuzz # abort fuzzing using ctrl-c ``` -## Fuzzing harnesses, fuzzing output and fuzzing corpora +## Fuzzing harnesses and output [`process_message`](https://github.com/bitcoin/bitcoin/blob/master/src/test/fuzz/process_message.cpp) is a fuzzing harness for the [`ProcessMessage(...)` function (`net_processing`)](https://github.com/bitcoin/bitcoin/blob/master/src/net_processing.cpp). The available fuzzing harnesses are found in [`src/test/fuzz/`](https://github.com/bitcoin/bitcoin/tree/master/src/test/fuzz). @@ -64,6 +64,8 @@ block^@M-^?M-^?M-^?M-^?M-^?nM-^?M-^? In this case the fuzzer managed to create a `block` message which when passed to `ProcessMessage(...)` increased coverage. +## Fuzzing corpora + The project's collection of seed corpora is found in the [`bitcoin-core/qa-assets`](https://github.com/bitcoin-core/qa-assets) repo. To fuzz `process_message` using the [`bitcoin-core/qa-assets`](https://github.com/bitcoin-core/qa-assets) seed corpus: @@ -81,6 +83,20 @@ INFO: seed corpus: files: 991 min: 1b max: 1858b total: 288291b rss: 150Mb … ``` +## Reproduce a fuzzer crash reported by the CI + +- `cd` into the `qa-assets` directory and update it with `git pull qa-assets` +- locate the crash case described in the CI output, e.g. `Test unit written to + ./crash-1bc91feec9fc00b107d97dc225a9f2cdaa078eb6` +- make sure to compile with all sanitizers, if they are needed (fuzzing runs + more slowly with sanitizers enabled, but a crash should be reproducible very + quickly from a crash case) +- run the fuzzer with the case number appended to the seed corpus path: + `FUZZ=process_message src/test/fuzz/fuzz + qa-assets/fuzz_seed_corpus/process_message/1bc91feec9fc00b107d97dc225a9f2cdaa078eb6` + +## Submit improved coverage + If you find coverage increasing inputs when fuzzing you are highly encouraged to submit them for inclusion in the [`bitcoin-core/qa-assets`](https://github.com/bitcoin-core/qa-assets) repo. Every single pull request submitted against the Bitcoin Core repo is automatically tested against all inputs in the [`bitcoin-core/qa-assets`](https://github.com/bitcoin-core/qa-assets) repo. Contributing new coverage increasing inputs is an easy way to help make Bitcoin Core more robust. |