tree: 34e74c585834e61b836785a30bcdda2bccde2a19 [path history] [tgz]
  1. .bowerrc
  2. DESIGN.md
  3. Makefile
  4. PROD.md
  5. README.md
  6. bower.json
  7. create-fuzzer-be-sa.sh
  8. docker_build_be_release
  9. docker_build_fe_release
  10. elements.html
  11. fuzzer-be/
  12. fuzzer-fe/
  13. go/
  14. package.json
  15. res/
  16. templates/
fuzzer/README.md

Fuzzer

When the instance is created, afl-fuzz is downloaded from gs://skia-fuzzer/afl-mirror/afl-[version].tgz To update afl-versions, download the .tgz file from [http://lcamtuf.coredump.cx/afl/releases/?O=D], upload it to that location and make it publically shared.

AFL-fuzz requires that core dumps be handled normally and not notify external entities. As such, this may need to be run as root (sudo su): echo core >/proc/sys/kernel/core_pattern

AFL-fuzz notes: Try minimizing the test cases first for better performance:

#This will lock the test case in to those that run in under a second
FUZZ_INPUT="$HOME/SKP/small"
FUZZ_SAMPLES="$HOME/SKP/minimized"
./afl-cmin -i $FUZZ_INPUT -o $FUZZ_SAMPLES -m 1000 -t 1000 -- $SKIA_ROOT/out/Release/dm --src skp --skps @@ --config 8888

When deployed to production, the params in fuzzer-be.service and fuzzer-fe.service can be tuned via experimentation for optimal performance.