diff --git a/testing/libfuzzer/AFL.md b/testing/libfuzzer/AFL_integration.md similarity index 100% rename from testing/libfuzzer/AFL.md rename to testing/libfuzzer/AFL_integration.md diff --git a/testing/libfuzzer/README.md b/testing/libfuzzer/README.md index 1c48fd7f756dde..a93060dc04024f 100644 --- a/testing/libfuzzer/README.md +++ b/testing/libfuzzer/README.md @@ -1,77 +1,77 @@ -# libFuzzer in Chromium +# Fuzzing in Chromium -[go/libfuzzer-chromium](https://goto.google.com/libfuzzer-chromium) (Googler only) +[go/chrome-fuzzing](https://goto.google.com/chrome-fuzzing) (Googler only) -*** aside -[Getting Started](getting_started.md) -| [Buildbot] -| [ClusterFuzz Stats] -| [Cover Bug] -*** +[Fuzzing] is a testing technique that feeds randomized inputs to a target code +in an attempt to crash it. It's one of the most effective methods we have for +finding security and stability issues ([go/fuzzing-success]). -This directory contains integration between [libFuzzer] and Chromium. -LibFuzzer is an in-process coverage-driven evolutionary fuzzing engine. It helps -engineers to uncover potential security & stability problems. +This documentation covers the in-process guided fuzzing approach employed by +different fuzzing engines, such as [libFuzzer] or [AFL]. To learn more about +out-of-process fuzzers, please refer to the [Blackbox fuzzing] page in the +ClusterFuzz documentation. -*** note -**Requirements:** libFuzzer in Chromium is supported with Linux, Chrome OS, Mac, -and Windows. -*** +[TOC] -## Integration Status +## Getting Started -Fuzzer tests are well-integrated with Chromium build system and distributed -ClusterFuzz fuzzing system. Cover bug: [crbug.com/539572]. +In Chromium, you can easily create and submit fuzz targets. The targets are +automatically discovered by buildbots, built with different fuzzing engines, +then uploaded to the distributed [ClusterFuzz] fuzzing system to run at scale. -## Documentation +Create your first fuzz target and submit it by stepping through our [Getting +Started Guide]. -* [Getting Started Guide] walks you through all the steps necessary to create -your fuzz target and submit it to ClusterFuzz. -* [Efficient Fuzzer Guide] explains how to measure fuzz target effectiveness and -ways to improve it. -* [Guide to libprotobuf-mutator (LPM)] walks through the steps necessary to -create a fuzz target that expects a protobuf as input (instead of a byte -stream). In addition to fuzzing code that accepts protobufs, it can be used to -fuzz code that requires multiple mutated inputs, or to generate inputs defined -by a grammar. -* [ClusterFuzz Integration] describes integration between ClusterFuzz and -libFuzzer. -* [Reproducing Bugs] describes how to reproduce bugs found by libFuzzer/AFL - and reported by ClusterFuzz. -* [Fuzzing on Chrome OS] describes how to write fuzzers for the non-browser - parts of Chrome OS. -* [AFL Integration] describes AFL's integration with Chromium and ClusterFuzz. -* [Reference] contains detailed references for different integration parts. +## Advanced Topics -## Trophies -* [ClusterFuzz Bugs] - issues found and automatically filed by ClusterFuzz. -* [Manual Bugs] - issues that were filed manually after running fuzz targets. -* [Pdfium Bugs] - bugs found in pdfium by manual fuzzing. -* [OSS Trophies] - bugs found with libFuzzer in open-source projects. +* Improving fuzz target effectiveness: [Efficient Fuzzer Guide]. +* Creating a fuzz target that expects a protobuf (instead of a byte steam) as + input: [Guide to libprotobuf-mutator (LPM)]. + **Note**: you can also use LPM to fuzz code that needs multiple mutated + inputs, or to generate inputs defined by a grammar. +* Reproducing bugs found by libFuzzer/AFL and reported by ClusterFuzz: + [Reproducing Bugs]. -## Blog Posts -* [Guided in-process fuzzing of Chrome components]. +## Further Reading -## Project Links -* [libFuzzer Infrastructure Bugs] +* LibFuzzer's integration with Chromium and ClusterFuzz: [LibFuzzer + Integration]. +* AFL's integration with Chromium and ClusterFuzz: [AFL Integration]. +* Detailed references for other integration parts: [Reference]. +* Writing fuzzers for the non-browser parts of Chrome OS: [Fuzzing on Chrome + OS]. -[Buildbot]: https://ci.chromium.org/p/chromium/g/chromium.fuzz/builders -[Cover Bug]: https://bugs.chromium.org/p/chromium/issues/detail?id=539572 -[Getting Started Guide]: getting_started.md +## Trophies +* Issues found with in-process fuzzing and automatically filed by ClusterFuzz: + [ClusterFuzz Bugs]. +* Issues filed manually after running fuzz targets: [Manual Bugs]. +* Bugs found in PDFium by manual fuzzing: [PDFium Bugs]. +* Bugs found with libFuzzer in open-source projects: [OSS Trophies]. + +## Other Links +* [Guided in-process fuzzing of Chrome components] blog post. +* [ClusterFuzz Stats] for fuzz targets built with AddressSanitizer and + libFuzzer. + +[AFL]: http://lcamtuf.coredump.cx/afl/ +[AFL Integration]: AFL_integration.md +[Blackbox fuzzing]: https://google.github.io/clusterfuzz/setting-up-fuzzing/blackbox-fuzzing/ +[ClusterFuzz]: https://clusterfuzz.com/ +[ClusterFuzz Bugs]: https://bugs.chromium.org/p/chromium/issues/list?sort=-modified&colspec=ID%20Pri%20M%20Stars%20ReleaseBlock%20Component%20Status%20Owner%20Summary%20OS%20Modified&q=label%3AStability-LibFuzzer%2CStability-AFL%20label%3AClusterFuzz%20-status%3AWontFix%2CDuplicate&can=1 +[ClusterFuzz Stats]: https://clusterfuzz.com/fuzzer-stats/by-fuzzer/fuzzer/libFuzzer/job/libfuzzer_chrome_asan [Efficient Fuzzer Guide]: efficient_fuzzer.md +[Fuzzing]: https://en.wikipedia.org/wiki/Fuzzing +[Fuzzing on Chrome OS]: https://chromium.googlesource.com/chromiumos/docs/+/master/fuzzing.md +[Getting Started Guide]: getting_started.md [Guide to libprotobuf-mutator (LPM)]: libprotobuf-mutator.md -[ClusterFuzz Integration]: clusterfuzz.md -[Reproducing Bugs]: reproducing.md -[Reference]: reference.md -[AFL Integration]: AFL.md -[ClusterFuzz Bugs]: https://bugs.chromium.org/p/chromium/issues/list?can=1&q=label:Stability-LibFuzzer%20label:ClusterFuzz&sort=-modified&colspec=ID%20Pri%20M%20Stars%20ReleaseBlock%20Component%20Status%20Owner%20Summary%20OS%20Modified -[ClusterFuzz Stats]: https://clusterfuzz.com/fuzzer-stats/by-fuzzer/fuzzer/libFuzzer/job/libfuzzer_chrome_asan -[Pdfium Bugs]: https://bugs.chromium.org/p/pdfium/issues/list?can=1&q=libfuzzer&colspec=ID+Type+Status+Priority+Milestone+Owner+Summary&cells=tiles +[Guided in-process fuzzing of Chrome components]: https://security.googleblog.com/2016/08/guided-in-process-fuzzing-of-chrome.html [Manual Bugs]: https://bugs.chromium.org/p/chromium/issues/list?can=1&q=label%3AStability-LibFuzzer+-label%3AClusterFuzz&sort=-modified&colspec=ID+Pri+M+Stars+ReleaseBlock+Component+Status+Owner+Summary+OS+Modified&x=m&y=releaseblock&cells=ids [OSS Trophies]: http://llvm.org/docs/LibFuzzer.html#trophies -[Guided in-process fuzzing of Chrome components]: https://security.googleblog.com/2016/08/guided-in-process-fuzzing-of-chrome.html +[PDFium Bugs]: https://bugs.chromium.org/p/pdfium/issues/list?can=1&q=libfuzzer&colspec=ID+Type+Status+Priority+Milestone+Owner+Summary&cells=tiles +[Reference]: reference.md +[Reproducing Bugs]: reproducing.md [crbug.com/539572]: https://bugs.chromium.org/p/chromium/issues/detail?id=539572 +[go/fuzzing-success]: https://goto.google.com/fuzzing-success [libFuzzer]: http://llvm.org/docs/LibFuzzer.html -[libFuzzer Infrastructure Bugs]: https://bugs.chromium.org/p/chromium/issues/list?q=label:LibFuzzer-Infra -[Fuzzing on Chrome OS]: https://chromium.googlesource.com/chromiumos/docs/+/master/fuzzing.md +[libFuzzer Integration]: libFuzzer_integration.md diff --git a/testing/libfuzzer/efficient_fuzzer.md b/testing/libfuzzer/efficient_fuzzer.md index 98b60f51cc08a3..09af434b9ee626 100644 --- a/testing/libfuzzer/efficient_fuzzer.md +++ b/testing/libfuzzer/efficient_fuzzer.md @@ -292,8 +292,8 @@ there is no intended API to disable checksum verification, or when target code uses random generator that affects reproducibility of crashes. [AFL]: http://lcamtuf.coredump.cx/afl/ -[ClusterFuzz Corpus]: clusterfuzz.md#Corpus -[ClusterFuzz status]: clusterfuzz.md#Status-Links +[ClusterFuzz Corpus]: libFuzzer_integration.md#Corpus +[ClusterFuzz status]: libFuzzer_integration.md#Status-Links [Corpus GCS Bucket]: https://console.cloud.google.com/storage/clusterfuzz-corpus/libfuzzer [issue 638836]: https://bugs.chromium.org/p/chromium/issues/detail?id=638836 [coverage script]: https://cs.chromium.org/chromium/src/tools/code_coverage/coverage.py diff --git a/testing/libfuzzer/getting_started.md b/testing/libfuzzer/getting_started.md index ee68f2b1668dca..532e525cc554fc 100644 --- a/testing/libfuzzer/getting_started.md +++ b/testing/libfuzzer/getting_started.md @@ -335,7 +335,7 @@ performance and for optimization hints. [Address Sanitizer]: http://clang.llvm.org/docs/AddressSanitizer.html -[ClusterFuzz status]: clusterfuzz.md#Status-Links +[ClusterFuzz status]: libFuzzer_integration.md#Status-Links [Efficient Fuzzer Guide]: efficient_fuzzer.md [Fuzzer Dictionary]: efficient_fuzzer.md#Fuzzer-Dictionary [Memory Sanitizer]: http://clang.llvm.org/docs/MemorySanitizer.html diff --git a/testing/libfuzzer/clusterfuzz.md b/testing/libfuzzer/libFuzzer_integration.md similarity index 100% rename from testing/libfuzzer/clusterfuzz.md rename to testing/libfuzzer/libFuzzer_integration.md