655d30519b
* shmeme/llmp refactor to convert ShMem into a stateful ShMemProvider factory. At the moment we use parking_lot::ReentrantMutex. That may not be necessary. * fix merge issue * formatting * Fix fuzzer examples for new ShMemProvider * Fix clippy warnings * Fix build and clippy for x86_64 * Resolve review comments * Remove ReentrantMutex and RefCell - they are not needed * Hopefully fix win32 build * Fix tests, windows build * Rename ShMemProvider to ShMem * Revert "Rename ShMemProvider to ShMem" This reverts commit eca07c8d7bb3d5e829fecf3f7213c763470a41e9. * Rename ShMemMapping to ShMem; Test fixes * Add missing trait to scope * Fix from_int * Fix try_into * Move to alloc::sync::Arc and spin::Mutex to support nostd * Fix tests * nostd fixes; Make new() a part of the ShMemProvider trait * Fix errant ? * Fix windows * Fix missing trait * nostd remove dbg! * Add Default and Clone to ShMemProvider * Formatting * Fix windows * Get rid of ArcMutex in favor of RefCell * Rc RefCell * moved to refs * SHP->SP * Use alloc::rc::Rc instead of std::rc::Rc * Format * Add setup_restarting_mgr_std which selects the right ShMemProvider; changed fuzzers to use it * Get rid of unnecessary clone * Fix clippy error on windows * Fix nostd * Fix formatting * Make StdShmemProvider include ServedShMemProvider * Get rid of lifetime specifiers now that we are using Rc * Get rid of unneccesary spin * Rename ShMemProvider::Mapping to ShMemProvider::Mem * Formatting * fix Windows * Rename DefaultUnixShmem* to CommonUnixShmem* Co-authored-by: Dominik Maier <domenukk@gmail.com>
Libfuzzer for libpng
This folder contains an example fuzzer for libpng, using LLMP for fast multi-process fuzzing and crash detection. To show off crash detection, we added a ud2 instruction to the harness, edit harness.cc if you want a non-crashing example. It has been tested on Linux.
Build
To build this example, run cargo build --example libfuzzer_libpng --release.
This will call (the build.rs)[./build.rs], which in turn downloads a libpng archive from the web.
Then, it will link (the fuzzer)[./src/fuzzer.rs] against (the C++ harness)[./harness.cc] and the instrumented libpng.
Afterwards, the fuzzer will be ready to run, from ../../target/examples/libfuzzer_libpng.
Run
The first time you run the binary, the broker will open a tcp port (currently on port 1337), waiting for fuzzer clients to connect. This port is local and only used for the initial handshake. All further communication happens via shared map, to be independent of the kernel.
Each following execution will run a fuzzer client.
As this example uses in-process fuzzing, we added a Restarting Event Manager (setup_restarting_mgr).
This means each client will start itself again to listen for crashes and timeouts.
By restarting the actual fuzzer, it can recover from these exit conditions.
In any real-world scenario, you should use taskset to pin each client to an empty CPU core, the lib does not pick an empty core automatically (yet).
For convenience, you may just run ./test.sh in this folder to test it.