diff options
Diffstat (limited to 'tests/libfuzzer/README')
-rw-r--r-- | tests/libfuzzer/README | 26 |
1 files changed, 24 insertions, 2 deletions
diff --git a/tests/libfuzzer/README b/tests/libfuzzer/README index d0ab4fdda8..33aa309670 100644 --- a/tests/libfuzzer/README +++ b/tests/libfuzzer/README @@ -19,7 +19,7 @@ To run a test with libFuzzer: 3. Configure Qt with -platform linux-clang -sanitize fuzzer-no-link or, if you are using clang 5 - -platform linux-clang -coverage trace-pc-guard + -platform linux-clang -- -DCMAKE_CXX_FLAGS=-fsanitize-coverage=trace-pc-guard to add the needed code coverage instrumentation. Since speed of execution is crucial for fuzz testing, it's recommendable to also use the switches -release -static @@ -41,7 +41,8 @@ To run a test with libFuzzer: For further info about libFuzzer, see https://llvm.org/docs/LibFuzzer.html -Some of these tests are continuously being run on oss-fuzz which is documented at +Some of these tests are continuously being run on oss-fuzz, a service by Google for fuzzing free +software. It is documented at: https://google.github.io/oss-fuzz/ You can find: @@ -52,3 +53,24 @@ You can find: Update the date in the URL to get more recent data. - The found issues which were already published at: https://bugs.chromium.org/p/oss-fuzz/issues/list?q=proj%3Dqt + +You can reproduce issues found by oss-fuzz using their Docker images, see +https://google.github.io/oss-fuzz/advanced-topics/reproducing/ +Alternatively, you can also reproduce it locally with a native build: + +1. Read the tested submodule, the test's project and the architecture from the report. + For all findings since November 2020, you get the former from the "Fuzz Target". For example, + "qtbase_gui_text_qtextdocument_sethtml" is fuzzing qtbase using the project in + qtbase/tests/libfuzzer/gui/text/qtextdocument/sethtml/ + The architecture you can find in "Job Type". If it contains "i386" it is a 32-bit x86 build, + otherwise it is an x86_64 build. Sometimes you can reproduce issues on both architectures. +2. Build Qt including the tested submodule and its dependencies on the respective architecture with + the used sanitizer (see above). + The sanitizer is also written in the report. It is usually needed to reproduce the issue. +3. Use this Qt build to build the test's project. For example: + <qt-build>/qtbase/bin/qt-cmake -S "<src>/qtbase/tests/libfuzzer/gui/text/qtextdocument/sethtml/" + cmake --build . +4. Download the "Reproducer Testcase" from the report. +5. Start the binary resulting from step 3 and pass the testcase. For example: + ./sethtml input.html + You should get the same symptoms as described in the report. |