|
| 1 | +# Fuzz testing (Fuzzing) |
| 2 | + |
| 3 | +### Simple Fuzz test Setup |
| 4 | + |
| 5 | +The following example demonstrates how to use libfuzzer to write a simple |
| 6 | +fuzz test. Each fuzzer function is defined using `LLVMFuzzerTestOneInput(const uint8_t * data, size_t len)`. |
| 7 | + |
| 8 | +The Fuzzer must be located in a Test Folder : `src/some_directory/tests/` |
| 9 | + |
| 10 | +``` |
| 11 | +#include <cstddef> |
| 12 | +#include <cstdint> |
| 13 | +
|
| 14 | +/** |
| 15 | + * @file |
| 16 | + * This file describes a Fuzzer for ... |
| 17 | + */ |
| 18 | +
|
| 19 | +extern "C" int LLVMFuzzerTestOneInput(const uint8_t * data, size_t len) |
| 20 | +{ |
| 21 | +
|
| 22 | + // Instantiate values as needed |
| 23 | + // Call target function for the fuzzer with the fuzzing input (data and len) |
| 24 | +
|
| 25 | + return 0; |
| 26 | +} |
| 27 | +
|
| 28 | +``` |
| 29 | + |
| 30 | +See |
| 31 | +[FuzzBase38Decode.cpp](https://github.com/project-chip/connectedhomeip/blob/master/src/setup_payload/tests/FuzzBase38Decode.cpp) |
| 32 | +for an example of a simple fuzz test. |
| 33 | + |
| 34 | + |
| 35 | +## Compiling and running |
| 36 | + |
| 37 | +- Add to `src/some_directory/tests/BUILD.gn` |
| 38 | + |
| 39 | + - Example |
| 40 | + |
| 41 | + ``` |
| 42 | +
|
| 43 | + import("${chip_root}/build/chip/fuzz_test.gni") |
| 44 | +
|
| 45 | +
|
| 46 | + if (enable_fuzz_test_targets) { |
| 47 | + chip_fuzz_target("FuzzTargetName1") { |
| 48 | + sources = [ "Fuzzer1.cpp" ] |
| 49 | + public_deps = [ |
| 50 | + // Dependencies go here. |
| 51 | + ] |
| 52 | + } |
| 53 | + chip_fuzz_target("FuzzTargetName2") { |
| 54 | + sources = [ "Fuzzer2.cpp" ] |
| 55 | + public_deps = [ |
| 56 | + // Dependencies go here. |
| 57 | + ] |
| 58 | + } |
| 59 | + } |
| 60 | + ``` |
| 61 | +
|
| 62 | + - CHIP_FUZZ_TARGET : the name of the fuzz target |
| 63 | + - SOURCES : file in the test folder containing the fuzzer implementation |
| 64 | + - PUBLIC_DEPS : Code Dependencies needed to build fuzzer |
| 65 | +
|
| 66 | + - Another example: |
| 67 | + [src/setup_payload/tests/BUILD.gn](https://github.com/project-chip/connectedhomeip/blob/b367512f519e5e109346e81a0d84fd85cd9192f7/src/setup_payload/tests/BUILD.gn#L43) |
| 68 | +
|
| 69 | +- Add to `src/BUILD.gn` |
| 70 | + - Add the Fuzzing Target in this part of the code : |
| 71 | + [src/BUILD.gn](https://github.com/project-chip/connectedhomeip/blob/b367512f519e5e109346e81a0d84fd85cd9192f7/BUILD.gn#L52) |
| 72 | +
|
| 73 | + - Add Fuzzing Target like that |
| 74 | +
|
| 75 | + ``` |
| 76 | + if (enable_fuzz_test_targets) { |
| 77 | + group("fuzz_tests") { |
| 78 | + deps = [ |
| 79 | + "${chip_root}/src/credentials/tests:fuzz-chip-cert", |
| 80 | + "${chip_root}/src/lib/core/tests:fuzz-tlv-reader", |
| 81 | + "${chip_root}/src/lib/dnssd/minimal_mdns/tests:fuzz-minmdns-packet-parsing", |
| 82 | + "${chip_root}/src/lib/format/tests:fuzz-payload-decoder", |
| 83 | + "${chip_root}/src/setup_payload/tests:fuzz-setup-payload-base38", |
| 84 | + "${chip_root}/src/setup_payload/tests:fuzz-setup-payload-base38-decode", |
| 85 | + // ADD HERE YOUR FUZZING TARGET |
| 86 | + "${chip_root}/some_directory/tests:FuzzTargetName" |
| 87 | + ] |
| 88 | + } |
| 89 | + } |
| 90 | + ``` |
| 91 | +
|
| 92 | +- Build all fuzzers |
| 93 | + ``` |
| 94 | + ./scripts/build/build_examples.py --target <host>-<compiler>-tests-asan-libfuzzer-clang build |
| 95 | + ``` |
| 96 | + e.g. |
| 97 | + ``` |
| 98 | + ./scripts/build/build_examples.py --target darwin-arm64-tests-asan-libfuzzer-clang build |
| 99 | + ``` |
| 100 | + ** Make sure to put the right host and compiler |
| 101 | +- Fuzzers binaries are compiled into: |
| 102 | + - `out/<host>-<compiler>-tests-asan-libfuzzer-clang/tests` |
| 103 | + - e.g. `darwin-arm64-tests-asan-libfuzzer-clang` |
| 104 | +
|
| 105 | +- Running the fuzzer with a corpus |
| 106 | + - ```path_to_fuzzer_in_test_folder path_to_corpus ``` |
| 107 | +
|
| 108 | +
|
0 commit comments