Skip to content

Commit c300800

Browse files
Add documentation for adding a new libfuzzer fuzzer.
1 parent 07789d4 commit c300800

File tree

1 file changed

+108
-0
lines changed

1 file changed

+108
-0
lines changed

docs/testing/fuzz_testing.md

+108
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
# Fuzz testing (Fuzzing)
2+
3+
### Simple Fuzz test Setup
4+
5+
The following example demonstrates how to use libfuzzer to write a simple
6+
fuzz test. Each fuzzer function is defined using `LLVMFuzzerTestOneInput(const uint8_t * data, size_t len)`.
7+
8+
The Fuzzer must be located in a Test Folder : `src/some_directory/tests/`
9+
10+
```
11+
#include <cstddef>
12+
#include <cstdint>
13+
14+
/**
15+
* @file
16+
* This file describes a Fuzzer for ...
17+
*/
18+
19+
extern "C" int LLVMFuzzerTestOneInput(const uint8_t * data, size_t len)
20+
{
21+
22+
// Instantiate values as needed
23+
// Call target function for the fuzzer with the fuzzing input (data and len)
24+
25+
return 0;
26+
}
27+
28+
```
29+
30+
See
31+
[FuzzBase38Decode.cpp](https://github.com/project-chip/connectedhomeip/blob/master/src/setup_payload/tests/FuzzBase38Decode.cpp)
32+
for an example of a simple fuzz test.
33+
34+
35+
## Compiling and running
36+
37+
- Add to `src/some_directory/tests/BUILD.gn`
38+
39+
- Example
40+
41+
```
42+
43+
import("${chip_root}/build/chip/fuzz_test.gni")
44+
45+
46+
if (enable_fuzz_test_targets) {
47+
chip_fuzz_target("FuzzTargetName1") {
48+
sources = [ "Fuzzer1.cpp" ]
49+
public_deps = [
50+
// Dependencies go here.
51+
]
52+
}
53+
chip_fuzz_target("FuzzTargetName2") {
54+
sources = [ "Fuzzer2.cpp" ]
55+
public_deps = [
56+
// Dependencies go here.
57+
]
58+
}
59+
}
60+
```
61+
62+
- CHIP_FUZZ_TARGET : the name of the fuzz target
63+
- SOURCES : file in the test folder containing the fuzzer implementation
64+
- PUBLIC_DEPS : Code Dependencies needed to build fuzzer
65+
66+
- Another example:
67+
[src/setup_payload/tests/BUILD.gn](https://github.com/project-chip/connectedhomeip/blob/b367512f519e5e109346e81a0d84fd85cd9192f7/src/setup_payload/tests/BUILD.gn#L43)
68+
69+
- Add to `src/BUILD.gn`
70+
- Add the Fuzzing Target in this part of the code :
71+
[src/BUILD.gn](https://github.com/project-chip/connectedhomeip/blob/b367512f519e5e109346e81a0d84fd85cd9192f7/BUILD.gn#L52)
72+
73+
- Add Fuzzing Target like that
74+
75+
```
76+
if (enable_fuzz_test_targets) {
77+
group("fuzz_tests") {
78+
deps = [
79+
"${chip_root}/src/credentials/tests:fuzz-chip-cert",
80+
"${chip_root}/src/lib/core/tests:fuzz-tlv-reader",
81+
"${chip_root}/src/lib/dnssd/minimal_mdns/tests:fuzz-minmdns-packet-parsing",
82+
"${chip_root}/src/lib/format/tests:fuzz-payload-decoder",
83+
"${chip_root}/src/setup_payload/tests:fuzz-setup-payload-base38",
84+
"${chip_root}/src/setup_payload/tests:fuzz-setup-payload-base38-decode",
85+
// ADD HERE YOUR FUZZING TARGET
86+
"${chip_root}/some_directory/tests:FuzzTargetName"
87+
]
88+
}
89+
}
90+
```
91+
92+
- Build all fuzzers
93+
```
94+
./scripts/build/build_examples.py --target <host>-<compiler>-tests-asan-libfuzzer-clang build
95+
```
96+
e.g.
97+
```
98+
./scripts/build/build_examples.py --target darwin-arm64-tests-asan-libfuzzer-clang build
99+
```
100+
** Make sure to put the right host and compiler
101+
- Fuzzers binaries are compiled into:
102+
- `out/<host>-<compiler>-tests-asan-libfuzzer-clang/tests`
103+
- e.g. `darwin-arm64-tests-asan-libfuzzer-clang`
104+
105+
- Running the fuzzer with a corpus
106+
- ```path_to_fuzzer_in_test_folder path_to_corpus ```
107+
108+

0 commit comments

Comments
 (0)