#!/bin/bash -eu # Copyright 2016 Google Inc. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # ################################################################################ # Fuzzer runner. Appends .options arguments and seed corpus to users args. # Usage: $0 export PATH=$OUT:$PATH cd $OUT FUZZER=$1 shift rm -rf /tmp/input/ && mkdir /tmp/input/ CORPUS= SEED_CORPUS="${FUZZER}_seed_corpus.zip" if [ -f $SEED_CORPUS ]; then echo "Using seed corpus: $SEED_CORPUS" unzip -d /tmp/input/ $SEED_CORPUS > /dev/null CORPUS=/tmp/input fi if [[ "$FUZZING_ENGINE" = afl ]]; then # https://chromium.googlesource.com/chromium/src/+/master/third_party/afl/src/docs/env_variables.txt export ASAN_OPTIONS="$ASAN_OPTIONS:abort_on_error=1:symbolize=0" export MSAN_OPTIONS="$MSAN_OPTIONS:exit_code=86:symbolize=0" export UBSAN_OPTIONS="$UBSAN_OPTIONS:symbolize=0" export AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1 export AFL_SKIP_CPUFREQ=1 rm -rf /tmp/afl_output && mkdir /tmp/afl_output # AFL expects at least 1 file in the input dir. echo input > /tmp/input/input CMD_LINE="$OUT/afl-fuzz $AFL_FUZZER_ARGS -i /tmp/input -o /tmp/afl_output $@ $OUT/$FUZZER" else CMD_LINE="$OUT/$FUZZER $FUZZER_ARGS $@ $CORPUS" OPTIONS_FILE="${FUZZER}.options" if [ -f $OPTIONS_FILE ]; then OPTIONS_ARGS=$(grep "=" $OPTIONS_FILE | sed 's/\(\w*\)\W*=\W*\(.*\)/-\1=\2 /g' | tr '\n' ' ') CMD_LINE="$CMD_LINE $OPTIONS_ARGS" fi fi echo $CMD_LINE bash -c "$CMD_LINE"