Improve fuzz test coverage generation guide Refactors the guide to improve clarity. Also, adds instructions on how to view the generated coverage report when building on a remote machine. Bug: b:478226234 Change-Id: I3b8f14d0a4734a764261c4492c1eeb1908f3bb18 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7674321 Commit-Queue: Jon Toohill <[email protected]> Reviewed-by: Jon Toohill <[email protected]> Cr-Commit-Position: refs/heads/main@{#1600846} NOKEYCHECK=True GitOrigin-RevId: aa097354e6d4c364bd784ea941db94898c2b396e
Fuzzing is an automated software testing technique that provides invalid, unexpected, or random data as inputs to a program to find bugs.
Why fuzz? Fuzzing finds thousands of security and stability issues before they reach users (see go/fuzzing-success). For more information about the benefits of fuzzing, see go/why-fuzz.
Where to fuzz? Fuzz code that parses, decodes, or manipulates input from untrusted sources, such as the web.
In Chromium, you can create and submit fuzz targets that run continuously at scale on ClusterFuzz.
To get started, choose the fuzzing framework that fits your use case.
We recommend FuzzTest for new fuzzers in Chromium. FuzzTest integrates with the gtest framework. It tests code that accepts structured, typed inputs, such as int, std::string, std::vector, or custom classes.
libFuzzer tests APIs that consume raw byte buffers, such as image decoders and JSON or XML parsers. Use libFuzzer if you are modifying an existing libFuzzer target or building a grammar-aware fuzzer.
Getting Started with libprotobuf-mutator (LPM) - Fuzz code that expects a protobuf, has multiple inputs, or is defined by a grammar.
Fuzzing mojo interfaces - A guide for using LPM to fuzz Mojo interfaces.
Fuzzing in Chrome OS - Writing fuzzers for the non-browser parts of Chrome OS.
Fuzzing browsertests - For fuzzing multiple Chrome subsystems that require a full browser environment.
libFuzzer Integration Details - The specifics of how libFuzzer integrates with Chromium and ClusterFuzz.
libfuzzer Technical References - A detailed reference for build arguments (GN), sanitizer configurations, platform support, and ClusterFuzz options.
If you have questions or encounter issues,
[email protected] or