fuzz: updates README

Uses main oss-fuzz repository

More complete flags proposition for direct compilation
pull/6424/head
Philippe Antoine 4 years ago committed by Victor Julien
parent cb30772372
commit 066a3d619e

@ -2,12 +2,11 @@ How to run fuzzing ?
1) With oss-fuzz
- install docker
- run git clone --branch suricata --depth 1 https://github.com/catenacyber/oss-fuzz
(we will use the original google repo once we merge this)
- run git clone --depth 1 https://github.com/google/oss-fuzz
- change directory into cloned repository : cd oss-fuzz
- run python infra/helper.py build_image suricata
- run python infra/helper.py build_fuzzers --sanitizer address suricata
You can use undefined sanitizer (memory sanitizer does not work yet see https://github.com/google/oss-fuzz/issues/2145#issuecomment-485781098
You can use undefined sanitizer
- run python infra/helper.py run_fuzzer suricata fuzz_siginit
(or another fuzz target, try ls build/out/suricata/fuzz_*)
@ -19,11 +18,16 @@ To generate coverage :
2) With libfuzzer
To compile the fuzz targets, you should do the following :
To compile the fuzz targets, you can do the following.
These flags are just one option and you are welcome to change them when you know what you are doing.
```
export CFLAGS="-g -fsanitize=address,fuzzer-no-link"
export LDFLAGS="-g -fsanitize=address"
export CFLAGS="-g -O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=address -fsanitize-address-use-after-scope -fsanitize=fuzzer-no-link"
export CXXFLAGS="-g -O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=address -fsanitize-address-use-after-scope -fsanitize=fuzzer-no-link -stdlib=libc++"
export RUSTFLAGS="--cfg fuzzing -Cdebuginfo=1 -Cforce-frame-pointers"
export RUSTFLAGS="$RUSTFLAGS -Cpasses=sancov -Cllvm-args=-sanitizer-coverage-level=4 -Cllvm-args=-sanitizer-coverage-trace-compares -Cllvm-args=-sanitizer-coverage-inline-8bit-counters -Cllvm-args=-sanitizer-coverage-trace-geps -Cllvm-args=-sanitizer-coverage-prune-blocks=0 -Cllvm-args=-sanitizer-coverage-pc-table -Clink-dead-code -Cllvm-args=-sanitizer-coverage-stack-depth"
export LIB_FUZZING_ENGINE=-fsanitize=fuzzer
export CC=clang
export CXX=clang++
./configure --enable-fuzztargets
make
```

Loading…
Cancel
Save