|
@@ -11,14 +11,19 @@ tool `honggfuzz` and its related files are located in `fuzz/honggfuzz`.
|
|
|
cargo install cargo-fuzz
|
|
cargo install cargo-fuzz
|
|
|
```
|
|
```
|
|
|
|
|
|
|
|
|
|
+You will also need Rust's nightly toolchain installed.
|
|
|
|
|
+```sh
|
|
|
|
|
+rustup toolchain install nightly
|
|
|
|
|
+```
|
|
|
|
|
+
|
|
|
## Usage
|
|
## Usage
|
|
|
```sh
|
|
```sh
|
|
|
# List available targets
|
|
# List available targets
|
|
|
-$ cargo fuzz list
|
|
|
|
|
|
|
+$ cargo +nightly fuzz list
|
|
|
# Run fuzzer on a target
|
|
# Run fuzzer on a target
|
|
|
-# format: cargo fuzz run TARGET
|
|
|
|
|
|
|
+# format: cargo +nightly fuzz run TARGET
|
|
|
# e.g. if `serial` is your target:
|
|
# e.g. if `serial` is your target:
|
|
|
-$ cargo fuzz run serial
|
|
|
|
|
|
|
+$ cargo +nightly fuzz run serial
|
|
|
```
|
|
```
|
|
|
|
|
|
|
|
This process will run infinitely until a crash occurs or until it is cancelled by the user.
|
|
This process will run infinitely until a crash occurs or until it is cancelled by the user.
|
|
@@ -55,7 +60,7 @@ We store dictionaries in the `dictionaries/` directory.
|
|
|
A more efficient way to fuzz safe Rust code is the following:
|
|
A more efficient way to fuzz safe Rust code is the following:
|
|
|
|
|
|
|
|
```sh
|
|
```sh
|
|
|
-cargo fuzz run --jobs $(nproc) -s none --all-features TARGET -- -dict=dictionaries/SOMEDICT.dict
|
|
|
|
|
|
|
+cargo +nightly fuzz run --jobs $(nproc) -s none --all-features TARGET -- -dict=dictionaries/SOMEDICT.dict
|
|
|
```
|
|
```
|
|
|
|
|
|
|
|
## Fuzzing Corpora
|
|
## Fuzzing Corpora
|
|
@@ -82,8 +87,8 @@ easier to share corpora between libfuzzer and honggfuzz.)
|
|
|
e.g. scenario: while testing ZkBinary's decode() function, you find
|
|
e.g. scenario: while testing ZkBinary's decode() function, you find
|
|
|
that an empty input causes a panic.
|
|
that an empty input causes a panic.
|
|
|
|
|
|
|
|
-* Identify your fuzz target (`cargo fuzz list` or whatever you used
|
|
|
|
|
-for `cargo fuzz run TARGET`
|
|
|
|
|
|
|
+* Identify your fuzz target (`cargo +nightly fuzz list` or whatever
|
|
|
|
|
+you used for `cargo +nightly fuzz run TARGET`)
|
|
|
* Examine the fuzzing artifacts: `ls artifacts/TARGET/`
|
|
* Examine the fuzzing artifacts: `ls artifacts/TARGET/`
|
|
|
* `cat` the file and check that it matches the error message from
|
|
* `cat` the file and check that it matches the error message from
|
|
|
the fuzzer. The filename's prefix will match the kind of error
|
|
the fuzzer. The filename's prefix will match the kind of error
|
|
@@ -124,7 +129,7 @@ It is possible to increase the amount of memory libFuzzer is allowed to use by p
|
|
|
to it via libFuzzer like so:
|
|
to it via libFuzzer like so:
|
|
|
|
|
|
|
|
```sh
|
|
```sh
|
|
|
-cargo fuzz run --all-features zkas-decoder -- "-rss_limit_mb=4096"
|
|
|
|
|
|
|
+cargo +nightly fuzz run --all-features zkas-decoder -- "-rss_limit_mb=4096"
|
|
|
```
|
|
```
|
|
|
|
|
|
|
|
To disable memory limits entirely, pass the argument:
|
|
To disable memory limits entirely, pass the argument:
|
|
@@ -165,7 +170,7 @@ rustup component add llvm-tools-preview
|
|
|
|
|
|
|
|
# Generate coverage files. Run this from fuzz/
|
|
# Generate coverage files. Run this from fuzz/
|
|
|
# This step will be faster if you minimize the corpus first.
|
|
# This step will be faster if you minimize the corpus first.
|
|
|
-cargo fuzz coverage zkas-compile
|
|
|
|
|
|
|
+cargo +nightly fuzz coverage zkas-compile
|
|
|
|
|
|
|
|
# Manually create a .profdata file. (One is generated by the above command, but it appears to be broken)
|
|
# Manually create a .profdata file. (One is generated by the above command, but it appears to be broken)
|
|
|
llvm-profdata merge -sparse coverage/zkas-compile/raw/* -o zkas-compile.profdata
|
|
llvm-profdata merge -sparse coverage/zkas-compile/raw/* -o zkas-compile.profdata
|