tree: 34e74c585834e61b836785a30bcdda2bccde2a19 [path history] [tgz]
  1. fuzzer-be/
  2. fuzzer-fe/
  3. go/
  4. res/
  5. templates/
  6. .bowerrc
  7. bower.json
  8. create-fuzzer-be-sa.sh
  9. DESIGN.md
  10. docker_build_be_release
  11. docker_build_fe_release
  12. elements.html
  13. Makefile
  14. package.json
  15. PROD.md
  16. README.md
fuzzer/README.md

Fuzzer

When the instance is created, afl-fuzz is downloaded from gs://skia-fuzzer/afl-mirror/afl-[version].tgz To update afl-versions, download the .tgz file from [http://lcamtuf.coredump.cx/afl/releases/?O=D], upload it to that location and make it publically shared.

AFL-fuzz requires that core dumps be handled normally and not notify external entities. As such, this may need to be run as root (sudo su): echo core >/proc/sys/kernel/core_pattern

AFL-fuzz notes: Try minimizing the test cases first for better performance:

#This will lock the test case in to those that run in under a second
FUZZ_INPUT="$HOME/SKP/small"
FUZZ_SAMPLES="$HOME/SKP/minimized"
./afl-cmin -i $FUZZ_INPUT -o $FUZZ_SAMPLES -m 1000 -t 1000 -- $SKIA_ROOT/out/Release/dm --src skp --skps @@ --config 8888

When deployed to production, the params in fuzzer-be.service and fuzzer-fe.service can be tuned via experimentation for optimal performance.