oss-fuzz

History

Kostya Serebryany 469212c094 Update README.md		2017-05-15 18:43:27 -07:00
..
do_stuff_test_data	add an 'example' project (#603 )	2017-05-13 13:24:17 -07:00
Makefile	Update Makefile	2017-05-15 17:36:20 -07:00
README.md	Update README.md	2017-05-15 18:43:27 -07:00
do_stuff_fuzzer.cpp	[example] Fix a typo in "example" project from #603 .	2017-05-14 12:56:09 +02:00
do_stuff_fuzzer.dict	Create do_stuff_fuzzer.dict	2017-05-15 17:51:38 -07:00
do_stuff_fuzzer.options	Create do_stuff_fuzzer.options	2017-05-15 17:49:16 -07:00
do_stuff_unittest.cpp	add an 'example' project (#603 )	2017-05-13 13:24:17 -07:00
my_api.cpp	add an 'example' project (#603 )	2017-05-13 13:24:17 -07:00
my_api.h	add an 'example' project (#603 )	2017-05-13 13:24:17 -07:00
standalone_fuzz_taget_runner.cpp	[example] Fix a typo in "example" project from #603 .	2017-05-14 12:56:09 +02:00

This directory contains an example software project that has most of the traits of ideal support for fuzzing.

Files in my-api-repo

Imagine that these files reside in your project's repository:

my_api.h: and my_api.cpp implement the API we want to test/fuzz. The function DoStuff() inside my_api.cpp: contains a bug. (Find it!)
do_stuff_unittest.cpp: is a unit test for DoStuff(). Unit tests are not necessary for fuzzing, but are generally a good practice.
do_stuff_fuzzer.cpp: is a fuzz target for DoStuff().
standalone_fuzz_taget_runner.cpp: is a simple standalone runnner for fuzz targets. You may use it to execute a fuzz target on given files w/o having to link in libFuzzer or other fuzzing engine.
do_stuff_test_data: corpus directory for do_stuff_fuzzer.cpp.
do_stuff_fuzzer.dict: a fuzzing dictionary file for DoStuff(). Optional, but may improve fuzzing in many cases.
do_stuff_fuzzer.options: optional file with flags specific to fuzzing engines, e.g. to pass the dictionary file to libFuzzer.
Makefile: is a build file (the same can be done with other build systems):
- accepts external compiler flags via $CC, $CXX, $CFLAGS, $CXXFLAGS
- accepts external fuzzing engine via $LIB_FUZZING_ENGINE, by default uses standalone_fuzz_taget_runner.cpp
- builds the fuzz target(s) and their corpus archive(s)
- make check executes do_stuff_fuzzer.cpp on do_stuff_test_data/*, thus ensures that the fuzz target is up to date and uses it as a regression test.

oss-fuzz/projects/example
- Dockerfile: sets up the build environment
- build.sh: builds the fuzz target(s). The smaller this file the better, most of the logic should be inside the project's build system).
- project.yaml: short project description and contact info.