mirror of https://github.com/google/oss-fuzz.git
66 lines
1.9 KiB
Plaintext
66 lines
1.9 KiB
Plaintext
|
#!/bin/bash -u
|
||
|
|
# Copyright 2020 Google Inc.
|
||
|
|
#
|
||
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||
|
|
# you may not use this file except in compliance with the License.
|
||
|
|
# You may obtain a copy of the License at
|
||
|
|
#
|
||
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||
|
|
#
|
||
|
|
# Unless required by applicable law or agreed to in writing, software
|
||
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||
|
|
# See the License for the specific language governing permissions and
|
||
|
|
# limitations under the License.
|
||
|
|
#
|
||
|
|
################################################################################
|
||
|
|
cd $OUT
|
||
|
|
|
||
|
|
if (( $# > 0 )); then
|
||
|
|
FUZZ_TARGETS="$@"
|
||
|
|
else
|
||
|
|
FUZZ_TARGETS="$(find . -maxdepth 1 -type f -executable -printf '%P\n')"
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Timeout for running a single fuzz target.
|
||
|
|
TIMEOUT=1h
|
||
|
|
|
||
|
|
# Number of CPUs available, this is needed for running targets in parallel.
|
||
|
|
NPROC=$(nproc)
|
||
|
|
|
||
|
|
function run_one_target {
|
||
|
|
local target=$1
|
||
|
|
local corpus="/corpus/${target}"
|
||
|
|
local traces="$OUT/${target}_dft"
|
||
|
|
|
||
|
|
# Put the logs in $OUT as well for debugging purposes.
|
||
|
|
local log="$OUT/${target}_dft.log"
|
||
|
|
|
||
|
|
rm -rf $traces && mkdir -p $traces
|
||
|
|
|
||
|
|
timeout $TIMEOUT dataflow_tracer.py $OUT/$target $corpus $traces &> $log
|
||
|
|
if (( $? != 0 )); then
|
||
|
|
echo "Error occured while collecting data flow traces for $target:"
|
||
|
|
cat $log
|
||
|
|
fi
|
||
|
|
}
|
||
|
|
|
||
|
|
# Run each fuzz target, write data flow traces into corresponding dir in $OUT.
|
||
|
|
for fuzz_target in $FUZZ_TARGETS; do
|
||
|
|
# Skip binaries that do not seem to be fuzz targets.
|
||
|
|
grep "LLVMFuzzerTestOneInput" $fuzz_target > /dev/null 2>&1 || continue
|
||
|
|
|
||
|
|
echo "Running $fuzz_target"
|
||
|
|
run_one_target $fuzz_target &
|
||
|
|
|
||
|
|
# Do not spawn more processes than the number of CPUs available.
|
||
|
|
n_child_proc=$(jobs -rp | wc -l)
|
||
|
|
while [ "$n_child_proc" -eq "$NPROC" ]; do
|
||
|
|
sleep 4
|
||
|
|
n_child_proc=$(jobs -rp | wc -l)
|
||
|
|
done
|
||
|
|
done
|
||
|
|
|
||
|
|
# Wait for background processes to finish.
|
||
|
|
wait
|