diff --git a/tools/fuzz/README.afl b/tools/fuzz/README.afl index c5f749a6f8..4758de2490 100644 --- a/tools/fuzz/README.afl +++ b/tools/fuzz/README.afl @@ -18,7 +18,15 @@ Use the x86 instruction emulator fuzzer as an example. 2. run the following commands to build: $ cd tools/fuzz/x86_instruction_emulator $ make distclean - $ make CC=$AFLPATH/afl-gcc afl # produces afl-harness + + If you have a new enough version of Clang/LLVM and have configured AFL's + llvm_mode, make use of afl-clang-fast: + + $ make CC=$AFLPATH/afl-clang-fast afl # produces afl-harness + + If not, use the default afl-gcc: + + $ make CC=$AFLPATH/afl-gcc afl # produces afl-harness 3. provide initial test case (fuzzer dependent, see afl-*.c): $ mkdir testcase_dir diff --git a/tools/fuzz/x86_instruction_emulator/afl-harness.c b/tools/fuzz/x86_instruction_emulator/afl-harness.c index 63aff5904b..154869336a 100644 --- a/tools/fuzz/x86_instruction_emulator/afl-harness.c +++ b/tools/fuzz/x86_instruction_emulator/afl-harness.c @@ -17,6 +17,7 @@ int main(int argc, char **argv) size_t size; FILE *fp = NULL; + setbuf(stdin, NULL); setbuf(stdout, NULL); while ( 1 ) @@ -61,38 +62,45 @@ int main(int argc, char **argv) if ( LLVMFuzzerInitialize(&argc, &argv) ) exit(-1); - if ( fp != stdin ) /* If not using stdin, open the provided file. */ +#ifdef __AFL_HAVE_MANUAL_CONTROL + __AFL_INIT(); + + while ( __AFL_LOOP(1000) ) +#endif { - fp = fopen(argv[optind], "rb"); - if ( fp == NULL ) + if ( fp != stdin ) /* If not using stdin, open the provided file. */ { - perror("fopen"); + fp = fopen(argv[optind], "rb"); + if ( fp == NULL ) + { + perror("fopen"); + exit(-1); + } + } + + size = fread(input, 1, INPUT_SIZE, fp); + + if ( ferror(fp) ) + { + perror("fread"); exit(-1); } + + if ( !feof(fp) ) + { + printf("Input too large\n"); + exit(-1); + } + + if ( fp != stdin ) + { + fclose(fp); + fp = NULL; + } + + LLVMFuzzerTestOneInput(input, size); } - size = fread(input, 1, INPUT_SIZE, fp); - - if ( ferror(fp) ) - { - perror("fread"); - exit(-1); - } - - if ( !feof(fp) ) - { - printf("Input too large\n"); - exit(-1); - } - - if ( fp != stdin ) - { - fclose(fp); - fp = NULL; - } - - LLVMFuzzerTestOneInput(input, size); - return 0; }