Skip to content

Commit 1c5279e

Browse files
Add documentation for adding a new libfuzzer fuzzer.
1 parent 07789d4 commit 1c5279e

File tree

2 files changed

+108
-0
lines changed

2 files changed

+108
-0
lines changed

.github/.wordlist.txt

+1
Original file line numberDiff line numberDiff line change
@@ -568,6 +568,7 @@ fsync
568568
ftd
569569
fullclean
570570
fuzzer
571+
fuzzers
571572
FW
572573
gbl
573574
gcloud

docs/testing/fuzz_testing.md

+107
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
# Fuzz testing (Fuzzing)
2+
3+
### Simple Fuzz test Setup
4+
5+
The following example demonstrates how to use libfuzzer to write a simple fuzz
6+
test. Each fuzzer function is defined using
7+
`LLVMFuzzerTestOneInput(const uint8_t * data, size_t len)`.
8+
9+
The Fuzzer must be located in a Test Folder : `src/some_directory/tests/`
10+
11+
```
12+
#include <cstddef>
13+
#include <cstdint>
14+
15+
/**
16+
* @file
17+
* This file describes a Fuzzer for ...
18+
*/
19+
20+
extern "C" int LLVMFuzzerTestOneInput(const uint8_t * data, size_t len)
21+
{
22+
23+
// Instantiate values as needed
24+
// Call target function for the fuzzer with the fuzzing input (data and len)
25+
26+
return 0;
27+
}
28+
29+
```
30+
31+
See
32+
[FuzzBase38Decode.cpp](https://github.com/project-chip/connectedhomeip/blob/master/src/setup_payload/tests/FuzzBase38Decode.cpp)
33+
for an example of a simple fuzz test.
34+
35+
## Compiling and running
36+
37+
- Add to `src/some_directory/tests/BUILD.gn`
38+
39+
- Example
40+
41+
```
42+
import("${chip_root}/build/chip/fuzz_test.gni")
43+
44+
if (enable_fuzz_test_targets) {
45+
chip_fuzz_target("FuzzTargetName1") {
46+
sources = [ "Fuzzer1.cpp" ]
47+
public_deps = [
48+
// Dependencies go here.
49+
]
50+
}
51+
chip_fuzz_target("FuzzTargetName2") {
52+
sources = [ "Fuzzer2.cpp" ]
53+
public_deps = [
54+
// Dependencies go here.
55+
]
56+
}
57+
}
58+
```
59+
60+
- CHIP_FUZZ_TARGET : the name of the fuzz target
61+
- SOURCES : file in the test folder containing the fuzzer
62+
implementation
63+
- PUBLIC_DEPS : Code Dependencies needed to build fuzzer
64+
65+
- Another example:
66+
[src/setup_payload/tests/BUILD.gn](https://github.com/project-chip/connectedhomeip/blob/b367512f519e5e109346e81a0d84fd85cd9192f7/src/setup_payload/tests/BUILD.gn#L43)
67+
68+
- Add to `src/BUILD.gn`
69+
70+
- Add the Fuzzing Target in this part of the code :
71+
[src/BUILD.gn](https://github.com/project-chip/connectedhomeip/blob/b367512f519e5e109346e81a0d84fd85cd9192f7/BUILD.gn#L52)
72+
73+
- Add Fuzzing Target like that
74+
75+
```
76+
if (enable_fuzz_test_targets) {
77+
group("fuzz_tests") {
78+
deps = [
79+
"${chip_root}/src/credentials/tests:fuzz-chip-cert",
80+
"${chip_root}/src/lib/core/tests:fuzz-tlv-reader",
81+
"${chip_root}/src/lib/dnssd/minimal_mdns/tests:fuzz-minmdns-packet-parsing",
82+
"${chip_root}/src/lib/format/tests:fuzz-payload-decoder",
83+
"${chip_root}/src/setup_payload/tests:fuzz-setup-payload-base38",
84+
"${chip_root}/src/setup_payload/tests:fuzz-setup-payload-base38-decode",
85+
// ADD HERE YOUR FUZZING TARGET
86+
"${chip_root}/some_directory/tests:FuzzTargetName"
87+
]
88+
}
89+
}
90+
```
91+
92+
- Build all fuzzers
93+
```
94+
./scripts/build/build_examples.py --target <host>-<compiler>-tests-asan-libfuzzer-clang build
95+
```
96+
e.g.
97+
```
98+
./scripts/build/build_examples.py --target darwin-arm64-tests-asan-libfuzzer-clang build
99+
```
100+
\*\* Make sure to put the right host and compiler
101+
- Fuzzers binaries are compiled into:
102+
103+
- `out/<host>-<compiler>-tests-asan-libfuzzer-clang/tests`
104+
- e.g. `darwin-arm64-tests-asan-libfuzzer-clang`
105+
106+
- Running the fuzzer with a corpus
107+
- `path_to_fuzzer_in_test_folder path_to_corpus`

0 commit comments

Comments
 (0)