This directory contains tests to be run with clang's libFuzzer. It will generate data, pass this
data to the function
LLVMFuzzerTestOneInput(const char *Data, size_t Size)
of the test and track the code execution. Should the test crash, libFuzzer will provide you with the
data which triggered the crash. You can then use this to debug and fix the called code.
! Please note: The purpose of fuzz testing is to find unexpected code paths. Running fuzz tests may!
! result in unforeseen behavior, including loss of data. Consider running the tests in an isolated !
! environment, e.g. on a virtual machine. You have been warned. !
To run a test with libFuzzer:
1. Install clang 5.0 or later, e.g. from the repositories of the Linux distribution you are using.
Depending on the version of clang and the source you are installing from, you might have to
install libFuzzer for this version of clang explicitly.
2. Make sure clang and clang++ from this version of clang are found in PATH.
3. Configure Qt with
-platform linux-clang -sanitize fuzzer-no-link
or, if you are using clang 5
-platform linux-clang -coverage trace-pc-guard
to add the needed code coverage instrumentation. Since speed of execution is crucial for fuzz
testing, it's recommendable to also use the switches
-release -static
It might also make sense to add sanitizers by passing
-sanitize <...>
4. Build Qt.
5. Build one of the tests using this Qt build.
6. Execute the resulting executable.
Depending on the expected input format of the tested function, you will get results faster if
you:
* provide a set of interesting input data by passing the path of a directory which contains
these data, each in one file. You can find such data sets in the subdirectory
"fuzzing/testcases" of the qtqa repository.
* pass a so-called dictionary listing keywords of the input format using
-dict=<dictionary file>
A couple of such dictionaries are provided by AFL (http://lcamtuf.coredump.cx/afl/)
* tell libFuzzer to generate only ASCII data using
-only_ascii=1
For further info about libFuzzer, see https://llvm.org/docs/LibFuzzer.html
Some of these tests are continuously being run on oss-fuzz which is documented at
https://google.github.io/oss-fuzz/
You can find:
- The build logs for Qt at
https://oss-fuzz-build-logs.storage.googleapis.com/index.html#qt
- The code coverage of the running fuzzers at
https://storage.googleapis.com/oss-fuzz-coverage/qt/reports/20201104/linux/report.html
Update the date in the URL to get more recent data.
- The found issues which were already published at:
https://bugs.chromium.org/p/oss-fuzz/issues/list?q=proj%3Dqt
82499a6a28