cd8367d3e9
* drop not working * why drop_in_place works but drop does not * stop shmem leak * don't kill -9 fuzzer * don't put fuzzer background * no & * nostd * fix * fix * windows, clippy * fix * fmt * windows
Libfuzzer for libpng, with launcher
This folder contains an example fuzzer for libpng, using LLMP for fast multi-process fuzzing and crash detection.
To show off crash detection, we added a ud2 instruction to the harness, edit harness.cc if you want a non-crashing example.
It has been tested on Linux.
In contrast to the normal libfuzzer libpng example, this uses the launcher feature, that automatically spawns n child processes, and binds them to a free core.
Build
To build this example, run
cargo build --release
This will build the library with the fuzzer (src/lib.rs) with the libfuzzer compatibility layer and the SanitizerCoverage runtime functions for coverage feedback. In addition, it will also build two C and C++ compiler wrappers (bin/libafl_c(libafl_c/xx).rs) that you must use to compile the target.
Then download libpng, and unpack the archive:
wget https://deac-fra.dl.sourceforge.net/project/libpng/libpng16/1.6.37/libpng-1.6.37.tar.xz
tar -xvf libpng-1.6.37.tar.xz
Now compile libpng, using the libafl_cc compiler wrapper:
cd libpng-1.6.37
./configure
make CC=../target/release/libafl_cc CXX=../target/release/libafl_cxx -j `nproc`
You can find the static lib at libpng-1.6.37/.libs/libpng16.a.
Now, we have to build the libfuzzer harness and link all together to create our fuzzer binary.
cd ..
./target/release/libafl_cxx ./harness.cc libpng-1.6.37/.libs/libpng16.a -I libpng-1.6.37/ -o fuzzer_libpng -lz -lm
Afterwards, the fuzzer will be ready to run.
Run
Just run once, the launcher feature should do the rest.