diff options
| author | Frantisek Sumsal <frantisek@sumsal.cz> | 2023-10-14 17:47:10 +0200 |
|---|---|---|
| committer | Frantisek Sumsal <frantisek@sumsal.cz> | 2023-10-14 17:55:29 +0200 |
| commit | d04af6aaca2994acd728b49eaf7173f257f27776 (patch) | |
| tree | 2beb0ff63861782aa9660cdc3ac341797c455786 /docs | |
| parent | test: update Ubuntu CI instructions (diff) | |
| download | systemd-d04af6aaca2994acd728b49eaf7173f257f27776.tar.xz systemd-d04af6aaca2994acd728b49eaf7173f257f27776.zip | |
docs: update fuzzers docs
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/HACKING.md | 23 |
1 files changed, 21 insertions, 2 deletions
diff --git a/docs/HACKING.md b/docs/HACKING.md index 09bc5b5fff..fb7caac93c 100644 --- a/docs/HACKING.md +++ b/docs/HACKING.md @@ -147,8 +147,27 @@ corpus should be built and exported as `$OUT/fuzz-foo_seed_corpus.zip` in `tools/oss-fuzz.sh`. The fuzzers can be built locally if you have libFuzzer installed by running -`tools/oss-fuzz.sh`. You should also confirm that the fuzzers can be built and -run using +`tools/oss-fuzz.sh`, or by running: + +``` +CC=clang CXX=clang++ \ +meson setup build-libfuzz -Dllvm-fuzz=true -Db_sanitize=address,undefined -Db_lundef=false \ + -Dc_args='-fno-omit-frame-pointer -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION' +ninja -C build-libfuzz fuzzers +``` + +Each fuzzer then can be then run manually together with a directory containing +the initial corpus: + +``` +export UBSAN_OPTIONS=print_stacktrace=1:print_summary=1:halt_on_error=1 +build-libfuzz/fuzz-varlink-idl test/fuzz/fuzz-varlink-idl/ +``` + +Note: the `halt_on_error=1` UBSan option is especially important, otherwise +the fuzzer won't crash when undefined behavior is triggered. + +You should also confirm that the fuzzers can be built and run using [the OSS-Fuzz toolchain](https://google.github.io/oss-fuzz/advanced-topics/reproducing/#building-using-docker): ``` |