History

Kurt Roeckx d69d8f904c Make the fuzzers more reproducible We want to be in the same global state each time we come in FuzzerTestOneInput(). There are various reasons why we might not be that include: - Initialization that happens on first use. This is mostly the RUN_ONCE() things, or loading of error strings. - Results that get cached. For instance a stack that is sorted, RSA blinding that has been set up, ... So I try to trigger as much as possible in FuzzerInitialize(), and for things I didn't find out how to trigger this it needs to happen in FuzzerTestOneInput(). Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #2023		2016-12-03 00:14:15 +01:00
..
corpora	Update fuzz corpora	2016-11-12 16:54:51 +01:00
asn1.c	Add a FuzzerClean() function	2016-12-03 00:14:14 +01:00
asn1parse.c	Make the fuzzers more reproducible	2016-12-03 00:14:15 +01:00
bignum.c	bignum fuzzer: move new and free calls to the init and cleanup function.	2016-12-03 00:14:14 +01:00
bndiv.c	Make the fuzzers more reproducible	2016-12-03 00:14:15 +01:00
build.info	Fix no-ct	2016-07-25 08:18:14 +01:00
cms.c	Make the fuzzers more reproducible	2016-12-03 00:14:15 +01:00
conf.c	Make the fuzzers more reproducible	2016-12-03 00:14:15 +01:00
crl.c	Make the fuzzers more reproducible	2016-12-03 00:14:15 +01:00
ct.c	Make the fuzzers more reproducible	2016-12-03 00:14:15 +01:00
driver.c	Add a FuzzerClean() function	2016-12-03 00:14:14 +01:00
fuzzer.h	Add a FuzzerClean() function	2016-12-03 00:14:14 +01:00
helper.py	Add final(?) set of copyrights.	2016-06-01 11:27:25 -04:00
README.md	Move libfuzzer sanitizer options to README	2016-12-03 00:14:15 +01:00
server.c	Make the fuzzers more reproducible	2016-12-03 00:14:15 +01:00
test-corpus.c	Add a FuzzerClean() function	2016-12-03 00:14:14 +01:00
x509.c	Make the fuzzers more reproducible	2016-12-03 00:14:15 +01:00

README.md

I Can Haz Fuzz?

LibFuzzer

Or, how to fuzz OpenSSL with libfuzzer.

Starting from a vanilla+OpenSSH server Ubuntu install.

Use Chrome's handy recent build of clang. Older versions may also work.

$ sudo apt-get install git
$ mkdir git-work
$ git clone https://chromium.googlesource.com/chromium/src/tools/clang
$ clang/scripts/update.py

You may want to git pull and re-run the update from time to time.

Update your path:

$ PATH=~/third_party/llvm-build/Release+Asserts/bin/:$PATH

Get and build libFuzzer (there is a git mirror at https://github.com/llvm-mirror/llvm/tree/master/lib/Fuzzer if you prefer):

$ cd
$ sudo apt-get install subversion
$ mkdir svn-work
$ cd svn-work
$ svn co http://llvm.org/svn/llvm-project/llvm/trunk/lib/Fuzzer
$ cd Fuzzer
$ clang++ -c -g -O2 -std=c++11 *.cpp
$ ar r libFuzzer.a *.o
$ ranlib libFuzzer.a

Configure for fuzzing:

$ CC=clang ./config enable-fuzz-libfuzzer \
        --with-fuzzer-include=../../svn-work/Fuzzer \
        --with-fuzzer-lib=../../svn-work/Fuzzer/libFuzzer \
        -DPEDANTIC enable-asan enable-ubsan no-shared \
        -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION \
    -fsanitize-coverage=edge,indirect-calls,8bit-counters
$ sudo apt-get install make
$ LDCMD=clang++ make -j
$ fuzz/helper.py $FUZZER

Where $FUZZER is one of the executables in fuzz/.

If you get a crash, you should find a corresponding input file in fuzz/corpora/$FUZZER-crash/. You can reproduce the crash with

$ fuzz/$FUZZER <crashfile>

AFL

Configure for fuzzing:

$ sudo apt-get install afl-clang
$ CC=afl-clang-fast ./config enable-fuzz-afl no-shared
$ make

Run one of the fuzzers:

$ afl-fuzz -i fuzz/corpora/$FUZZER -o fuzz/corpora/$FUZZER/out fuzz/$FUZZER

Where $FUZZER is one of the executables in fuzz/.