Rough support for fuzzing with libFuzzer

For AFL++ and Honggfuzz, our approach is to build a standard fuzzpuzz
binary with extra hooks for interacting with an external fuzzer.  This
works well for AFL++ and tolerably for Honggfuzz.  LibFuzzer, though,
provides its own main() so that the resulting program has a very
different command-line interface from the normal one.  Also, since
libFuzzer is a standard part of Clang, we can't decide whether to use it
based on the behaviour of the compiler.

So what I've done, at least for now, is to have CMake detect when we're
using Clang and in that case build a separate binary called
"fuzzpuzz-libfuzzer" which is built with -fsanitize=fuzzer, while the
ordinary fuzzpuzz is built without.  I'm not sure if this is the right
approach, though.
This commit is contained in:
Ben Harris
2023-02-20 21:51:18 +00:00
parent ecd868ac6e
commit 5ba227031c
2 changed files with 53 additions and 0 deletions

View File

@ -282,6 +282,16 @@ if(build_cli_programs)
cliprogram(fuzzpuzz fuzzpuzz.c list.c ${puzzle_sources}
COMPILE_DEFINITIONS COMBINED $<$<BOOL:${HAVE_HF_ITER}>:HAVE_HF_ITER>)
target_include_directories(fuzzpuzz PRIVATE ${generated_include_dir})
if(CMAKE_C_COMPILER_ID MATCHES "Clang")
cliprogram(fuzzpuzz-libfuzzer fuzzpuzz.c list.c ${puzzle_sources}
COMPILE_DEFINITIONS COMBINED OMIT_MAIN)
target_include_directories(fuzzpuzz-libfuzzer
PRIVATE ${generated_include_dir})
target_compile_options(fuzzpuzz-libfuzzer PRIVATE -fsanitize=fuzzer)
set_target_properties(fuzzpuzz-libfuzzer
PROPERTIES LINK_FLAGS -fsanitize=fuzzer)
endif()
endif()
build_extras()