@@ -12,15 +12,15 @@ It could be used together with guided fuzzing engines, such as [libFuzzer](http:
12
12
13
13
Install prerequisites:
14
14
15
- ```
15
+ ``` sh
16
16
sudo apt-get update
17
17
sudo apt-get install protobuf-compiler libprotobuf-dev binutils cmake \
18
18
ninja-build liblzma-dev libz-dev pkg-config autoconf libtool
19
19
```
20
20
21
21
Compile and test everything:
22
22
23
- ```
23
+ ``` sh
24
24
mkdir build
25
25
cd build
26
26
cmake .. -GNinja -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ -DCMAKE_BUILD_TYPE=Debug
@@ -36,7 +36,7 @@ build a working version of protobuf.
36
36
37
37
Installation:
38
38
39
- ```
39
+ ``` sh
40
40
ninja
41
41
sudo ninja install
42
42
```
@@ -59,7 +59,7 @@ using [libFuzzer](http://libfuzzer.info)'s mutators.
59
59
60
60
To apply one mutation to a protobuf object do the following:
61
61
62
- ```
62
+ ``` c++
63
63
class MyProtobufMutator : public protobuf_mutator ::Mutator {
64
64
public:
65
65
// Optionally redefine the Mutate* methods to perform more sophisticated mutations.
@@ -77,7 +77,7 @@ See also the `ProtobufMutatorMessagesTest.UsageExample` test from
77
77
## Integrating with libFuzzer
78
78
LibFuzzerProtobufMutator can help to integrate with libFuzzer. For example
79
79
80
- ```
80
+ ```c++
81
81
#include "src/libfuzzer/libfuzzer_macro.h"
82
82
83
83
DEFINE_PROTO_FUZZER(const MyMessageType& input) {
@@ -97,7 +97,7 @@ for fuzzer even if it's capable of inserting acceptable values with time.
97
97
PostProcessorRegistration can be used to avoid such issue and guide your fuzzer towards interesting
98
98
code. It registers callback which will be called for each message of particular type after each mutation.
99
99
100
- ```
100
+ ``` c++
101
101
static protobuf_mutator::libfuzzer::PostProcessorRegistration<MyMessageType> reg = {
102
102
[](MyMessageType* message, unsigned int seed) {
103
103
TweakMyMessage (message, seed);
@@ -117,7 +117,7 @@ may corrupt the reproducer so it stops triggering the bug.
117
117
118
118
Note: You can add callback for any nested message and you can add multiple callbacks for
119
119
the same message type.
120
- ```
120
+ ``` c++
121
121
static PostProcessorRegistration<MyMessageType> reg1 = {
122
122
[](MyMessageType* message, unsigned int seed) {
123
123
TweakMyMessage (message, seed);
@@ -155,6 +155,24 @@ cleanup/initialize the message as workaround.
155
155
* [Envoy](https:// github.com/envoyproxy/envoy/search?q=DEFINE_TEXT_PROTO_FUZZER+OR+DEFINE_PROTO_FUZZER+OR+DEFINE_BINARY_PROTO_FUZZER&unscoped_q=DEFINE_TEXT_PROTO_FUZZER+OR+DEFINE_PROTO_FUZZER+OR+DEFINE_BINARY_PROTO_FUZZER&type=Code)
156
156
* [LLVM](https:// github.com/llvm-mirror/clang/search?q=DEFINE_TEXT_PROTO_FUZZER+OR+DEFINE_PROTO_FUZZER+OR+DEFINE_BINARY_PROTO_FUZZER&unscoped_q=DEFINE_TEXT_PROTO_FUZZER+OR+DEFINE_PROTO_FUZZER+OR+DEFINE_BINARY_PROTO_FUZZER&type=Code)
157
157
158
+ ## Grammars
159
+ * GIF, https:// github.com/google/oss-fuzz/tree/master/projects/giflib
160
+ * JSON
161
+ * https:// github.com/google/oss-fuzz/tree/master/projects/jsoncpp
162
+ * https:// github.com/officialcjunior/fuzzrtos/tree/c72e6670e566672ccf8023265cbfad616e75790d/protobufv2
163
+ * Lua 5.1 Language,
164
+ * https:// github.com/ligurio/lua-c-api-tests/tree/master/tests/luaL_loadbuffer_proto
165
+ * https:// github.com/Spoookyyy/luaj/tree/main/fuzz
166
+ * PNG, https:// github.com/google/oss-fuzz/tree/master/projects/libpng-proto
167
+ * SQL
168
+ * https:// github.com/tarantool/tarantool/tree/master/test/fuzz/sql_fuzzer
169
+ * https:// chromium.googlesource.com/chromium/src/third_party/+/refs/heads/main/sqlite/fuzz
170
+ * Solidity Language, https:// github.com/ethereum/solidity/tree/develop/test/tools/ossfuzz
171
+ * XML
172
+ * https:// github.com/google/oss-fuzz/tree/master/projects/xerces-c
173
+ * https:// github.com/google/libprotobuf-mutator/tree/master/examples/xml
174
+ * JPEG, https:// source.chromium.org/chromium/chromium/src/+/main:media/gpu/vaapi/fuzzers/jpeg_decoder/
175
+
158
176
## Bugs found with help of the library
159
177
160
178
### Chromium
0 commit comments