Index: docs/LibFuzzer.rst =================================================================== --- docs/LibFuzzer.rst +++ docs/LibFuzzer.rst @@ -86,22 +86,12 @@ * Ideally, it should not modify any global state (although that's not strict). * Usually, the narrower the target the better. E.g. if your target can parse several data formats, split it into several targets, one per format. +Fuzzer Usage +------------ -Building --------- - -Next, build the libFuzzer library as a static archive, without any sanitizer -options. Note that the libFuzzer library contains the ``main()`` function: - -.. code-block:: console - - svn co http://llvm.org/svn/llvm-project/llvm/trunk/lib/Fuzzer # or git clone https://chromium.googlesource.com/chromium/llvm-project/llvm/lib/Fuzzer - ./Fuzzer/build.sh # Produces libFuzzer.a - -Then build the fuzzing target function and the library under test using -the SanitizerCoverage_ option, which instruments the code so that the fuzzer -can retrieve code coverage information (to guide the fuzzing). Linking with -the libFuzzer code then gives a fuzzer executable. +Recent versions of Clang include libFuzzer, and no installation is necessary. +In order to fuzz your binary, use the `-fsanitize=fuzzer` flag during the compilation. +This option links libfuzzer, enables SanitizerCoverage_, and links `libcxx`. You should also enable one or more of the *sanitizers*, which help to expose latent bugs by making incorrect behavior generate errors at runtime: @@ -115,9 +105,9 @@ contents that have not been initialized to a specific value. Use `-fsanitize=memory`. MSAN can not be combined with other sanirizers and should be used as a seprate build. -Finally, link with ``libFuzzer.a``:: +The whole command line to fuzz a target called `mytarget.c` using address sanitizer is:: - clang -fsanitize-coverage=trace-pc-guard -fsanitize=address your_lib.cc fuzz_target.cc libFuzzer.a -o my_fuzzer + clang -fsanitize=fuzzer -fsanitize=fuzzer,address mytarget.c Corpus ------