11# Fuzzing
22
3- Fuzz tests generate a ton of random parameter arguments to the program and then validate that none
3+ Fuzz tests generate a ton of random parameter arguments to the program and then validate that none
44cause it to crash.
55
66## How does it work?
77
88Typically, CI will run ` ci-fuzz.sh ` on one of the environments the automated tests are
9- configured for. Fuzzing is further only effective with a lot of CPU time, indicating that if crash
9+ configured for. Fuzzing is further only effective with a lot of CPU time, indicating that if crash
1010scenarios are discovered on CI with its low runtime constraints, the crash is caused relatively
1111easily.
1212
1313## How do I run fuzz tests locally?
1414
15- We support multiple fuzzing engines such as ` honggfuzz ` , ` libFuzzer ` and ` AFL ` . You typically won't
16- need to run the entire suite of different fuzzing tools. For local execution, ` honggfuzz ` should be
17- more than sufficient.
15+ We support multiple fuzzing engines such as ` honggfuzz ` , ` libFuzzer ` and ` AFL ` . You typically won't
16+ need to run the entire suite of different fuzzing tools. For local execution, ` honggfuzz ` should be
17+ more than sufficient.
1818
1919### Setup
2020#### Honggfuzz
@@ -63,12 +63,12 @@ To run fuzzing using `cargo-fuzz / libFuzzer`, run
6363rustup install nightly # Note: libFuzzer requires a nightly version of rust.
6464cargo +nightly fuzz run --features " libfuzzer_fuzz" msg_ping_target
6565```
66- Note: If you encounter a ` SIGKILL ` during run/build check for OOM in kernel logs and consider
66+ Note: If you encounter a ` SIGKILL ` during run/build check for OOM in kernel logs and consider
6767increasing RAM size for VM.
6868
6969If you wish to just generate fuzzing binary executables for ` libFuzzer ` and not run them:
70- ``` shell
71- cargo +nightly fuzz build --features " libfuzzer_fuzz" msg_ping_target
70+ ``` shell
71+ cargo +nightly fuzz build --features " libfuzzer_fuzz" msg_ping_target
7272# Generates binary artifact in path ./target/aarch64-unknown-linux-gnu/release/msg_ping_target
7373# Exact path depends on your system architecture.
7474```
@@ -83,7 +83,7 @@ ls ./src/bin/
8383
8484## A fuzz test failed, what do I do?
8585
86- You're trying to create a PR, but need to find the underlying cause of that pesky fuzz failure
86+ You're trying to create a PR, but need to find the underlying cause of that pesky fuzz failure
8787blocking the merge?
8888
8989Worry not, for this is easily traced.
@@ -106,7 +106,7 @@ The command "if [ "$(rustup show | grep default | grep stable)" != "" ]; then cd
106106```
107107
108108Note that the penultimate stack trace line ends in ` release/full_stack_target] ` . That indicates that
109- the failing target was ` full_stack ` . To reproduce the error locally, simply copy the hex,
109+ the failing target was ` full_stack ` . To reproduce the error locally, simply copy the hex,
110110and run the following from the ` fuzz ` directory:
111111
112112``` shell
@@ -119,11 +119,11 @@ mkdir -p ./test_cases/$TARGET
119119echo $HEX | xxd -r -p > ./test_cases/$TARGET /any_filename_works
120120
121121export RUST_BACKTRACE=1
122- export RUSTFLAGS=" --cfg=fuzzing"
122+ export RUSTFLAGS=" --cfg=fuzzing --cfg=secp256k1_fuzz --cfg=hashes_fuzz "
123123cargo test
124124```
125125
126- Note that if the fuzz test failed locally, moving the offending run's trace
126+ Note that if the fuzz test failed locally, moving the offending run's trace
127127to the ` test_cases ` folder should also do the trick; simply replace the ` echo $HEX | ` line above
128128with (the trace file name is of course a bit longer than in the example):
129129
@@ -136,9 +136,9 @@ This will reproduce the failing fuzz input and yield a usable stack trace.
136136
137137## How do I add a new fuzz test?
138138
139- 1 . The easiest approach is to take one of the files in ` fuzz/src/ ` , such as
140- ` process_network_graph.rs ` , and duplicate it, renaming the new file to something more
141- suitable. For the sake of example, let's call the new fuzz target we're creating
139+ 1 . The easiest approach is to take one of the files in ` fuzz/src/ ` , such as
140+ ` process_network_graph.rs ` , and duplicate it, renaming the new file to something more
141+ suitable. For the sake of example, let's call the new fuzz target we're creating
142142` my_fuzzy_experiment ` .
143143
1441442 . In the newly created file ` fuzz/src/my_fuzzy_experiment.rs ` , run a string substitution
@@ -147,12 +147,12 @@ file are `do_test`, `my_fuzzy_experiment_test`, and `my_fuzzy_experiment_run`.
147147
1481483 . Adjust the body (not the signature!) of ` do_test ` as necessary for the new fuzz test.
149149
150- 4 . In ` fuzz/src/bin/gen_target.sh ` , add a line reading ` GEN_TEST my_fuzzy_experiment ` to the
150+ 4 . In ` fuzz/src/bin/gen_target.sh ` , add a line reading ` GEN_TEST my_fuzzy_experiment ` to the
151151first group of ` GEN_TEST ` lines (starting in line 9).
152152
1531535 . If your test relies on a new local crate, add that crate as a dependency to ` fuzz/Cargo.toml ` .
154154
155- 6 . In ` fuzz/src/lib.rs ` , add the line ` pub mod my_fuzzy_experiment ` . Additionally, if
155+ 6 . In ` fuzz/src/lib.rs ` , add the line ` pub mod my_fuzzy_experiment ` . Additionally, if
156156you added a new crate dependency, add the ` extern crate […] ` import line.
157157
1581587 . Run ` fuzz/src/bin/gen_target.sh ` .
0 commit comments