libFuzzer Integration Reference

Additional Sanitizer Configuration

MSan

Memory Sanitizer (MSan) in Chromium only supports Ubuntu Precise/Trusty and not Rodete. Thus, ourreproduce tool cannot reproduce bugs found using MSan. You can try to reproduce them manually by usingthese instructions on how to run MSan-instrumented code in docker.

UBSan

By default, UBSan does not crash when undefined behavior is detected. To make it crash, the following option needs to be set in environment:

UBSAN_OPTIONS=halt_on_error=1./fuzzer<corpus_directory_or_single_testcase_path>

Other useful options are (also used by ClusterFuzz):

UBSAN_OPTIONS=symbolize=1:halt_on_error=1:print_stacktrace=1./fuzzer<corpus_directory_or_single_testcase_path>

Supported Platforms and Configurations

Builder configurations

The exact GN arguments that are used on our builders can be generated by running (from Chromium'ssrc directory):

Linux

Linux is fully supported by libFuzzer and ClusterFuzz with following sanitizer configurations:

Configuration example:

# With address sanitizergn gen out/libfuzzer'--args=use_libfuzzer=true is_asan=true'--check

Linux x86 (32-bit)

Fuzzing targets built for x86 can discover bugs that are not found by x64 builds. Linux x86 is supported by libFuzzer withis_asan configuration.

Configuration example:

gn gen out/libfuzzer--args="use_libfuzzer=true is_asan=true host_cpu=\"x86\" target_cpu=\"x86\""--check

Chrome OS

Chrome OS is supported by libFuzzer withis_asan configuration.

Configuration example:

gn gen out/libfuzzer'--args=use_libfuzzer=true is_asan=true target_os="chromeos"'--check

To do a Chrome OS build on Linux (not just for libFuzzer), your.gclient file must be configured appropriately, see theChrome OS build docs for more details.

Mac

Mac is supported by libFuzzer withis_asan configuration.

Configuration example:

gn gen out/libfuzzer'--args=use_libfuzzer=true is_asan=true mac_deployment_target="10.7"'--check

Windows

Windows is supported by libFuzzer withis_asan configuration.

Configuration example:

gn gen out/libfuzzer"--args=use_libfuzzer=true is_asan=true is_debug=false is_component_build=false"--check

On Windows you must useis_component_build=false as libFuzzer does not support component builds on Windows. If you are usingis_asan=true then you must useis_debug=false as ASan does not support debug builds on Windows. You may also want to consider usingsymbol_level=1 which will reduce build size by reducing symbol level to the level necessary for libFuzzer (useful if building many fuzz targets).

ARM and ARM64

The V8 ARM and ARM64 simulators are supported by libFuzzer withis_asan configuration. Note that there is nothing special about these builds for non-V8 fuzz targets.

ARM configuration example:

gn gen out/libfuzzer--args="use_libfuzzer=true is_asan=true host_cpu=\"x86\" target_cpu=\"x86\" v8_target_cpu=\"arm\""--check

ARM64 configuration example:

gn gen out/libfuzzer--args="use_libfuzzer=true is_asan=true target_cpu=\"x64\" v8_target_cpu=\"arm64\""--check

fuzzer_test GN Template

Usefuzzer_test to define libFuzzer targets:

fuzzer_test("my_fuzzer") {  ...}

Following arguments are supported:

Fuzzer Runtime Options

There are many different runtime options supported by libFuzzer. Options are passed as command line arguments:

./fuzzer [-flag1=val1 [-flag2=val2 ...] ] [dir1 [dir2 ...] ]

Most common flags are:

Full list of options can be found atlibFuzzer options page and by running the binary with-help=1.

To specify these options for ClusterFuzz, list all parameters inlibfuzzer_options target attribute:

fuzzer_test("my_fuzzer") {  ...  libfuzzer_options = [    # Suppress stdout and stderr output (not recommended, as it may silence useful info).    "close_fd_mask=3",  ]}