blob: bf07f867d1dcf957a73256422d6ca947d749bdbc (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
|
# Libfuzzer Integration Reference
## fuzzer_test GN Template
Use `fuzzer_test` to define libfuzzer targets:
```
fuzzer_test("my_fuzzer") {
...
}
```
Following arguments are supported:
| Argument | Description |
|----------|-------------|
| sources | **required** list of fuzzer test source files. |
| deps | fuzzer dependencies |
| additional_configs | additional GN configurations to be used for compilation |
| dict | a dictionary file for the fuzzer |
| libfuzzer_options | runtime options file for the fuzzer. See [Fuzzer Runtime Options](Fuzzer-Options) |
## Fuzzer Runtime Options
There are many different runtime options supported by libfuzzer. Options
are passed as command line arguments:
```
./fuzzer [-flag1=val1 [-flag2=val2 ...] ] [dir1 [dir2 ...] ]
```
Most common flags are:
| Flag | Description |
|------|-------------|
| max_len | Maximum length of test input. |
| timeout | Timeout of seconds. Units slower than this value will be reported as bugs. |
A fuller list of options can be found at [Libfuzzer Usage] page and by running
the binary with `-help=1`.
To specify these options for Clusterfuzz, create `<my_fuzzer>.options` file:
```
[libfuzzer]
max_len=500
```
and specify the file in `libfuzzer_options` target attribute.
[Libfuzzer Usage]: http://llvm.org/docs/LibFuzzer.html#usage
|
