cargo-fuzz testing

.github/workflows/build_and_test.yml

@@ -324,62 +324,7 @@ jobs:
       matrix:
         os: [ubuntu-latest]
         fuzzer:
-          - ./fuzzers/fuzzbench_fork_qemu
-          - ./fuzzers/libfuzzer_stb_image_sugar
-          - ./fuzzers/nyx_libxml2_standalone
-          - ./fuzzers/baby_fuzzer_gramatron
-          - ./fuzzers/tinyinst_simple
-          - ./fuzzers/baby_fuzzer_with_forkexecutor
-          - ./fuzzers/baby_no_std
-          - ./fuzzers/baby_fuzzer_swap_differential
-          - ./fuzzers/baby_fuzzer_grimoire
-          - ./fuzzers/baby_fuzzer
-          - ./fuzzers/libfuzzer_libpng_launcher
-          - ./fuzzers/libfuzzer_libpng_accounting
-          - ./fuzzers/forkserver_libafl_cc
-          - ./fuzzers/libfuzzer_libpng_tcp_manager
-          - ./fuzzers/backtrace_baby_fuzzers
-          - ./fuzzers/fuzzbench_qemu
-          - ./fuzzers/nyx_libxml2_parallel
-          - ./fuzzers/qemu_launcher
-          - ./fuzzers/frida_gdiplus
-          - ./fuzzers/libfuzzer_stb_image_concolic
-          - ./fuzzers/nautilus_sync
-          # - ./fuzzers/qemu_cmin
-          # - ./fuzzers/qemu_systemmode
-          - ./fuzzers/push_harness
-          - ./fuzzers/libfuzzer_libpng_centralized
-          - ./fuzzers/baby_fuzzer_nautilus
-          - ./fuzzers/fuzzbench_text
-          - ./fuzzers/libfuzzer_libpng_cmin
-          - ./fuzzers/forkserver_simple
-          - ./fuzzers/baby_fuzzer_unicode
-          - ./fuzzers/libfuzzer_libpng_norestart
-          - ./fuzzers/baby_fuzzer_multi
-          - ./fuzzers/libafl_atheris
-          - ./fuzzers/frida_libpng
-          - ./fuzzers/fuzzbench_ctx
-          - ./fuzzers/fuzzbench_forkserver_cmplog
-          - ./fuzzers/push_stage_harness
-          - ./fuzzers/libfuzzer_libmozjpeg
-          - ./fuzzers/libfuzzer_libpng_aflpp_ui
-          - ./fuzzers/libfuzzer_libpng
-          - ./fuzzers/baby_fuzzer_wasm
-          - ./fuzzers/fuzzbench
-          - ./fuzzers/libfuzzer_stb_image
-          - ./fuzzers/fuzzbench_forkserver
-          - ./fuzzers/libfuzzer_windows_asan
-          - ./fuzzers/baby_fuzzer_minimizing
-          # - ./fuzzers/qemu_coverage
-          - ./fuzzers/frida_executable_libpng
-          - ./fuzzers/tutorial
-          - ./fuzzers/baby_fuzzer_tokens
-          - ./fuzzers/backtrace_baby_fuzzers/rust_code_with_inprocess_executor
-          - ./fuzzers/backtrace_baby_fuzzers/c_code_with_fork_executor
-          - ./fuzzers/backtrace_baby_fuzzers/command_executor
-          - ./fuzzers/backtrace_baby_fuzzers/forkserver_executor
-          - ./fuzzers/backtrace_baby_fuzzers/c_code_with_inprocess_executor
-          - ./fuzzers/backtrace_baby_fuzzers/rust_code_with_fork_executor
+          - ./fuzzers/cargo_fuzz
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v3

.github/workflows/fuzzer-tester-prepare/action.yml

@@ -22,10 +22,6 @@ runs:
     - name: Add wasm target
       shell: bash
       run: rustup target add wasm32-unknown-unknown
-    - name: Remove obsolete llvm (Linux)
-      if: runner.os == 'Linux'
-      shell: bash
-      run: sudo apt purge llvm* clang*
     - name: Install LLVM and Clang
       uses: KyleMayes/install-llvm-action@v1
       with:

fuzzers/cargo_fuzz/Cargo.toml

@@ -0,0 +1,13 @@
+[package]
+name = "cargo_fuzz_test"
+edition = "2021"
+version = "0.0.0"
+description = "test"
+authors = ["Andrea Fioraldi <[email protected]>", "Dominik Maier <[email protected]>"]
+repository = "https://github.com/AFLplusplus/LibAFL/"
+keywords = ["fuzzing", "testing", "compiler"]
+categories = ["development-tools::testing", "emulators", "embedded", "os", "no-std"]
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]

fuzzers/cargo_fuzz/Makefile.toml

@@ -0,0 +1,44 @@
+[env]
+
+[tasks.unsupported]
+script_runner="@shell"
+script='''
+echo "Cargo-make not integrated yet on this"
+'''
+
+[tasks.install_llvm_tools]
+command = "rustup"
+args = ["toolchain", "install", "nightly", "--component", "llvm-tools-preview"]
+
+
+[tasks.install_cargo_fuzz]
+command = "cargo"
+args = ["install", "cargo-fuzz"]
+
+# Fuzzer
+[tasks.build]
+command = "cargo"
+args = ["+nightly", "fuzz", "build", "fuzz_target_1"]
+dependencies = [ "install_cargo_fuzz", "install_llvm_tools"]
+
+[tasks.test]
+linux_alias = "test_unix"
+mac_alias = "unsupported"
+windows_alias = "unsupported"
+
+[tasks.test_unix]
+script='''
+timeout 30s cargo fuzz run fuzz_target_1 |& tee fuzz_stdout.log || true
+if grep -qa "objectives: 1" fuzz_stdout.log; then
+    echo "Fuzzer is working"
+else
+    echo "Fuzzer does not generate any testcases or any crashes"
+    exit 1
+fi
+'''
+dependencies = ["build"]
+
+# Clean
+[tasks.clean]
+command = "rm "
+args = ["-rf", "fuzz/target"]

fuzzers/cargo_fuzz/README.md

@@ -0,0 +1,3 @@
+# cargo-fuzz
+
+This is a minimalistic example how to use LibAFL with cargo-fuzz. It uses the `libafl_libfuzzer` comatability layer to be libFuzzer compatiable.

fuzzers/cargo_fuzz/fuzz/.gitignore

@@ -0,0 +1,4 @@
+target
+corpus
+artifacts
+coverage

fuzzers/cargo_fuzz/fuzz/Cargo.toml

@@ -0,0 +1,26 @@
+[package]
+name = "libafl-fuzz"
+version = "0.0.0"
+publish = false
+edition = "2021"
+
+[workspace]
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+
+[dependencies.cargo_fuzz_test]
+path = ".."
+
+[dependencies.libfuzzer-sys]
+path = "../../../libafl_libfuzzer"
+package = "libafl_libfuzzer"
+
+[[bin]]
+name = "fuzz_target_1"
+path = "fuzz_targets/fuzz_target_1.rs"
+test = false
+doc = false
+bench = false

fuzzers/cargo_fuzz/fuzz/fuzz_targets/fuzz_target_1.rs

@@ -0,0 +1,6 @@
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+use cargo_fuzz_test::do_thing;
+
+fuzz_target!(|data: &[u8]| do_thing(data));

fuzzers/cargo_fuzz/src/lib.rs

@@ -0,0 +1,11 @@
+pub fn do_thing(data: &[u8]) {
+    if data.get(0) == Some(&b'a') {
+        if data.get(1) == Some(&b'b') {
+            if data.get(2) == Some(&b'c') {
+                if data.get(3) == Some(&b'd') {
+                    panic!("We found the objective!");
+                }
+            }
+        }
+    }
+}