cedcee01c0
* build fuzzers with shared cargo target dir * Make external build scripts aware of CARGO_TARGET_DIR * fix libmozjpeg fuzzer with shared target dir * fix cargo-make default value for CARGO_TARGET_DIR * avoid ./ in cargo-make for windows compat * CI: cargo-hack's --feature-powerset is too powerful * fuzzer_concolic: support CARGO_TARGET_DIR * ci: install z3 to avoid building from source * ci: update actions * ci: test nightly features with nightly rust * test_all_fuzzers: try pruning more compilation artifacts * ci: fix nightly feature check * ci: apply rust-cache action after checkout (d'oh) The rust-cache action populates the checkout directory, which is promply deleted by the checkout action during checkout.. whoops!
Fuzzbench Harness
This folder contains an example fuzzer tailored for fuzzbench. It uses the best possible setting, with the exception of a SimpleRestartingEventManager instead of an LlmpEventManager - since fuzzbench is single threaded. Real fuzz campaigns should consider using multithreaded LlmpEventManager, see the other examples.
Build
To build this example, run cargo build --release.
This will build the fuzzer compilers (libafl_cc and libafl_cpp) with src/lib.rs as fuzzer.
The fuzzer uses the libfuzzer compatibility layer and the SanitizerCoverage runtime functions for coverage feedback.
These can then be used to build libfuzzer harnesses in the software project of your choice.
Finally, just run the resulting binary with out_dir, in_dir.
In any real-world scenario, you should use taskset to pin each client to an empty CPU core, the lib does not pick an empty core automatically (yet).