diff --git a/configure.ac b/configure.ac --- a/configure.ac +++ b/configure.ac @@ -280,7 +280,14 @@ AX_CHECK_LINK_FLAG( [[-fsanitize=$use_sanitizers]], [[SANITIZER_LDFLAGS=-fsanitize=$use_sanitizers]], - [AC_MSG_ERROR([linker did not accept requested flags, you are missing required libraries])]) + [AC_MSG_ERROR([linker did not accept requested flags, you are missing required libraries])], + [], + [AC_LANG_PROGRAM([[ + #include + #include + extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { return 0; } + __attribute__((weak)) // allow for libFuzzer linking + ]],[[]])]) fi ERROR_CXXFLAGS= diff --git a/doc/fuzzing.md b/doc/fuzzing.md --- a/doc/fuzzing.md +++ b/doc/fuzzing.md @@ -3,10 +3,11 @@ A special test harness `test_bitcoin_fuzzy` is provided to provide an easy entry point for fuzzers and the like. In this document we'll describe how to -use it with AFL. +use it with AFL and libFuzzer. -Building AFL -------------- +## AFL + +### Building AFL It is recommended to always use the latest version of afl: ``` @@ -17,15 +18,14 @@ export AFLPATH=$PWD ``` -Instrumentation ----------------- +### Instrumentation To build Bitcoin ABC using AFL instrumentation (this assumes that the `AFLPATH` was set as above): ``` mkdir -p buildFuzzer cd buildFuzzer -cmake -GNinja .. -CCACHE=OFF -DCMAKE_C_COMPILER=afl-gcc -DCMAKE_CXX_COMPILER=afl-g++ +cmake -GNinja .. -DCCACHE=OFF -DCMAKE_C_COMPILER=afl-gcc -DCMAKE_CXX_COMPILER=afl-g++ export AFL_HARDEN=1 ninja test_bitcoin_fuzzy ``` @@ -41,8 +41,7 @@ features "persistent mode" and "deferred forkserver" can be used. See https://github.com/mcarpenter/afl/tree/master/llvm_mode for details. -Preparing fuzzing ------------------- +### Preparing fuzzing AFL needs an input directory with examples, and an output directory where it will place examples that it found. These can be anywhere in the file system, @@ -61,8 +60,7 @@ Extract these (or other starting inputs) into the `inputs` directory before starting fuzzing. -Fuzzing --------- +### Fuzzing To start the actual fuzzing use: ``` @@ -71,3 +69,27 @@ You may have to change a few kernel parameters to test optimally - `afl-fuzz` will print an error and suggestion if so. + +## libFuzzer + +A recent version of `clang`, the address sanitizer and libFuzzer is needed (all +found in the `compiler-rt` runtime libraries package). + +To build the `test/test_bitcoin_fuzzy` executable run + +``` +mkdir -p buildFuzzer +cd buildFuzzer +cmake -GNinja .. \ + -DCCACHE=OFF \ + -DCMAKE_C_COMPILER=clang \ + -DCMAKE_CXX_COMPILER=clang++ \ + -DENABLE_SANITIZERS="fuzzer;address" +ninja test_bitcoin_fuzzy +``` + +The fuzzer needs some inputs to work on, but the inputs or seeds can be used +interchangably between libFuzzer and AFL. + +See https://llvm.org/docs/LibFuzzer.html#running on how to run the libFuzzer +instrumented executable.