partially_link_libcxx(fuzzer_no_main ${LIBCXX_${arch}_PREFIX} ${arch})
partially_link_libcxx(fuzzer_interceptors ${LIBCXX_${arch}_PREFIX} ${arch})
partially_link_libcxx(fuzzer ${LIBCXX_${arch}_PREFIX} ${arch})
- if(NOT ${arch} MATCHES "i386") # i386 unsupported for .so version.
- add_custom_command(
- OUTPUT clang_rt.fuzzer_no_main-${arch}.so
- DEPENDS clang_rt.fuzzer_no_main-${arch}
- COMMAND ${CMAKE_CXX_COMPILER} ${EMULATION_ARGUMENT} -Wl,--whole-archive -rdynamic "$<TARGET_LINKER_FILE:clang_rt.fuzzer_no_main-${arch}>" -Wl,--no-whole-archive -shared -fPIC -o "$<TARGET_FILE_DIR:clang_rt.fuzzer_no_main-${arch}>/libclang_rt.fuzzer_no_main-${arch}.so"
- COMMENT "Building clang_rt.fuzzer_no_main-${arch}.so"
- )
- get_compiler_rt_install_dir(${arch} install_dir)
- install(FILES "$<TARGET_FILE_DIR:clang_rt.fuzzer_no_main-${arch}>/libclang_rt.fuzzer_no_main-${arch}.so"
- DESTINATION ${install_dir}
- )
- add_custom_target(
- clang_rt.fuzzer_no_main-${arch}-so ALL
- DEPENDS clang_rt.fuzzer_no_main-${arch}.so
- )
- endif()
endforeach()
-else()
- set(LIBFUZZER_SHARED_LINK_LIBS ${SANITIZER_COMMON_LINK_LIBS})
- list(APPEND LIBFUZZER_SHARED_LINK_LIBS "-lstdc++")
- list(APPEND LIBFUZZER_SHARED_LINK_LIBS "-lm")
- if(NOT ANDROID)
- list(APPEND LIBFUZZER_SHARED_LINK_LIBS "-lpthread")
- endif()
-
- # If we aren't statically linking libc++ into the fuzzer, we can build the shared object directly
- add_compiler_rt_runtime(clang_rt.fuzzer_no_main
- SHARED
- OS ${FUZZER_SUPPORTED_OS}
- ARCHS ${FUZZER_SUPPORTED_ARCH}
- OBJECT_LIBS RTfuzzer
- CFLAGS ${LIBFUZZER_CFLAGS}
- LINK_FLAGS ${SANITIZER_COMMON_LINK_FLAGS}
- LINK_LIBS ${LIBFUZZER_SHARED_LINK_LIBS}
- PARENT_TARGET fuzzer)
endif()
if(COMPILER_RT_INCLUDE_TESTS)
Using libFuzzer as a library
----------------------------
If the code being fuzzed must provide its own `main`, it's possible to
-invoke libFuzzer as a library. Static linking is available on all platforms
-supported by libFuzzer; however, dynamic linking is not available on
-certain platforms (notably 32-bit x86 Linux).
-
-When using libFuzzer as a library, be sure to pass ``-fsanitize=fuzzer-no-link``
+invoke libFuzzer as a library. Be sure to pass ``-fsanitize=fuzzer-no-link``
during compilation, and link your binary against the no-main version of
libFuzzer. On Linux installations, this is typically located at:
.. code-block:: bash
/usr/lib/<llvm-version>/lib/clang/<clang-version>/lib/linux/libclang_rt.fuzzer_no_main-<architecture>.a
- /usr/lib/<llvm-version>/lib/clang/<clang-version>/lib/linux/libclang_rt.fuzzer_no_main-<architecture>.so
If building libFuzzer from source, this is located at the following path
in the build output directory:
.. code-block:: bash
lib/linux/libclang_rt.fuzzer_no_main-<architecture>.a
- lib/linux/libclang_rt.fuzzer_no_main-<architecture>.so
From here, the code can do whatever setup it requires, and when it's ready
to start fuzzing, it can call `LLVMFuzzerRunDriver`, passing in the program
extern "C" int LLVMFuzzerRunDriver(int *argc, char ***argv,
int (*UserCb)(const uint8_t *Data, size_t Size));
+
+
Leaks
-----