diff options
| author | MarcoFalke <falke.marco@gmail.com> | 2019-01-10 12:59:56 -0500 |
|---|---|---|
| committer | MarcoFalke <falke.marco@gmail.com> | 2019-01-10 13:00:14 -0500 |
| commit | b68bac83d9ead9e8893785a58fbed6d09cba4b5c (patch) | |
| tree | 312b63023c08b119632675f222d1878f47c2b51d /doc | |
| parent | 68dddccdaa6f55210a8798c8ccbc942ecec55429 (diff) | |
| parent | fad058a79fe6f8d85e408d1c1954de8b86944039 (diff) | |
| download | bitcoin-b68bac83d9ead9e8893785a58fbed6d09cba4b5c.tar.xz | |
Merge #15047: build: Allow to configure --with-sanitizers=fuzzer
fad058a79f build: Allow to configure --with-sanitizers=fuzzer (MarcoFalke)
Pull request description:
Tree-SHA512: 67b775577da03639ee11826dccb14c82e78d239fe3bcbb753082b254cec52ca8bda071a8161f2f3bc284a7cdc303bbf1b649a1854a42973b1d53cd0ffb516214
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/fuzzing.md | 34 |
1 files changed, 25 insertions, 9 deletions
diff --git a/doc/fuzzing.md b/doc/fuzzing.md index 5dedcb51c8..dff9e71bba 100644 --- a/doc/fuzzing.md +++ b/doc/fuzzing.md @@ -3,10 +3,11 @@ Fuzz-testing Bitcoin Core A special test harness `test_bitcoin_fuzzy` is provided to provide an easy entry point for fuzzers and the like. In this document we'll describe how to -use it with AFL. +use it with AFL and libFuzzer. -Building AFL -------------- +## AFL + +### Building AFL It is recommended to always use the latest version of afl: ``` @@ -17,8 +18,7 @@ make export AFLPATH=$PWD ``` -Instrumentation ----------------- +### Instrumentation To build Bitcoin Core using AFL instrumentation (this assumes that the `AFLPATH` was set as above): @@ -39,8 +39,7 @@ compiling using `afl-clang-fast`/`afl-clang-fast++` the resulting features "persistent mode" and "deferred forkserver" can be used. See https://github.com/mcarpenter/afl/tree/master/llvm_mode for details. -Preparing fuzzing ------------------- +### Preparing fuzzing AFL needs an input directory with examples, and an output directory where it will place examples that it found. These can be anywhere in the file system, @@ -60,8 +59,7 @@ Example inputs are available from: Extract these (or other starting inputs) into the `inputs` directory before starting fuzzing. -Fuzzing --------- +### Fuzzing To start the actual fuzzing use: ``` @@ -70,3 +68,21 @@ $AFLPATH/afl-fuzz -i ${AFLIN} -o ${AFLOUT} -m52 -- test/test_bitcoin_fuzzy You may have to change a few kernel parameters to test optimally - `afl-fuzz` will print an error and suggestion if so. + +## libFuzzer + +A recent version of `clang`, the address sanitizer and libFuzzer is needed (all +found in the `compiler-rt` runtime libraries package). + +To build the `test/test_bitcoin_fuzzy` executable run + +``` +./configure --disable-ccache --with-sanitizers=fuzzer,address CC=clang CXX=clang++ +make +``` + +The fuzzer needs some inputs to work on, but the inputs or seeds can be used +interchangably between libFuzzer and AFL. + +See https://llvm.org/docs/LibFuzzer.html#running on how to run the libFuzzer +instrumented executable. |