@@ -6,7 +6,9 @@ honggfuzz.
6
6
To run the fuzz-tests as in CI -- briefly fuzzing every target -- simply
7
7
run
8
8
9
- ./fuzz.sh
9
+ ``` bash
10
+ ./fuzz.sh
11
+ ```
10
12
11
13
in this directory.
12
14
@@ -16,11 +18,13 @@ recently-released binutils 2.39 has changed their API in a breaking way.
16
18
17
19
On Nix, you can obtain these libraries by running
18
20
19
- nix-shell -p libopcodes_2_38 -p libunwind
21
+ ``` bash
22
+ nix-shell -p libopcodes_2_38 -p libunwind
23
+ ```
20
24
21
- and then run fuzz.sh as above.
25
+ and then run ` fuzz.sh ` as above.
22
26
23
- # Fuzzing with weak cryptography
27
+ ## Fuzzing with weak cryptography
24
28
25
29
You may wish to replace the hashing and signing code with broken crypto,
26
30
which will be faster and enable the fuzzer to do otherwise impossible
@@ -35,35 +39,43 @@ Please let us know if you are interested in taking this on!
35
39
Meanwhile, to use the broken crypto, simply compile (and run the fuzzing
36
40
scripts) with
37
41
38
- RUSTFLAGS="--cfg=hashes_fuzz --cfg=secp256k1_fuzz"
42
+ ``` bash
43
+ RUSTFLAGS=" --cfg=hashes_fuzz --cfg=secp256k1_fuzz"
44
+ ```
39
45
40
46
which will replace the hashing library with broken hashes, and the
41
- secp256k1 library with broken cryptography.
47
+ ` secp256k1 ` library with broken cryptography.
42
48
43
49
Needless to say, NEVER COMPILE REAL CODE WITH THESE FLAGS because if a
44
50
fuzzer can break your crypto, so can anybody.
45
51
46
- # Long-term fuzzing
52
+ ## Long-term fuzzing
47
53
48
54
To see the full list of targets, the most straightforward way is to run
49
55
50
- source ./fuzz-util.sh
51
- listTargetNames
56
+ ``` bash
57
+ source ./fuzz-util.sh
58
+ listTargetNames
59
+ ```
52
60
53
61
To run each of them for an hour, run
54
62
55
- ./cycle.sh
63
+ ``` bash
64
+ ./cycle.sh
65
+ ```
56
66
57
67
To run a single fuzztest indefinitely, run
58
68
59
- HFUZZ_BUILD_ARGS='--features honggfuzz_fuzz' cargo hfuzz run <target>
69
+ ``` bash
70
+ HFUZZ_BUILD_ARGS=' --features honggfuzz_fuzz' cargo hfuzz run < target>
71
+ ```
60
72
61
73
This script uses the ` chrt ` utility to try to reduce the priority of the
62
74
jobs. If you would like to run for longer, the most straightforward way
63
75
is to edit ` cycle.sh ` before starting. To run the fuzz-tests in parallel,
64
76
you will need to implement a custom harness.
65
77
66
- # Adding fuzz tests
78
+ ## Adding fuzz tests
67
79
68
80
All fuzz tests can be found in the ` fuzz_target/ ` directory. Adding a new
69
81
one is as simple as copying an existing one and editing the ` do_test `
@@ -78,21 +90,25 @@ it to the generated `Cargo.toml`.
78
90
Once you've added a fuzztest, regenerate the ` Cargo.toml ` and CI job by
79
91
running
80
92
81
- ./generate-files.sh
93
+ ``` bash
94
+ ./generate-files.sh
95
+ ```
82
96
83
97
Then to test your fuzztest, run
84
98
85
- ./fuzz.sh <target>
99
+ ``` bash
100
+ ./fuzz.sh < target>
101
+ ```
86
102
87
103
If it is working, you will see a rapid stream of data for many seconds
88
104
(you can hit Ctrl+C to stop it early). If not, you should quickly see
89
105
an error.
90
106
91
- # Reproducing Failures
107
+ ## Reproducing Failures
92
108
93
109
If a fuzztest fails, it will exit with a summary which looks something like
94
110
95
- ```
111
+ ``` text
96
112
...
97
113
fuzzTarget : hfuzz_target/x86_64-unknown-linux-gnu/release/hashes_sha256
98
114
CRASH:
@@ -108,8 +124,9 @@ The final line is a hex-encoded version of the input that caused the crash. You
108
124
can test this directly by editing the ` duplicate_crash ` test to copy/paste the
109
125
hex output into the call to ` extend_vec_from_hex ` . Then run the test with
110
126
111
- cargo test
127
+ ``` bash
128
+ cargo test
129
+ ```
112
130
113
131
Note that if you set your ` RUSTFLAGS ` while fuzzing (see above) you must make
114
132
sure they are set the same way when running ` cargo test ` .
115
-
0 commit comments