Latest update.
This commit is contained in:
+12
-8
@@ -1,7 +1,10 @@
|
||||
# I Can Haz Fuzz?
|
||||
Fuzzing OpenSSL
|
||||
===============
|
||||
|
||||
OpenSSL can use either LibFuzzer or AFL to do fuzzing.
|
||||
|
||||
LibFuzzer
|
||||
=========
|
||||
---------
|
||||
|
||||
How to fuzz OpenSSL with [libfuzzer](http://llvm.org/docs/LibFuzzer.html),
|
||||
starting from a vanilla+OpenSSH server Ubuntu install.
|
||||
@@ -68,7 +71,7 @@ prebuilt fuzzer library. This is represented as `$PATH_TO_LIBFUZZER_DIR` below.
|
||||
--debug
|
||||
|
||||
AFL
|
||||
===
|
||||
---
|
||||
|
||||
This is an alternative to using LibFuzzer.
|
||||
|
||||
@@ -92,7 +95,7 @@ Run one of the fuzzers:
|
||||
Where $FUZZER is one of the executables in `fuzz/`.
|
||||
|
||||
Reproducing issues
|
||||
==================
|
||||
------------------
|
||||
|
||||
If a fuzzer generates a reproducible error, you can reproduce the problem using
|
||||
the fuzz/*-test binaries and the file generated by the fuzzer. They binaries
|
||||
@@ -108,7 +111,7 @@ To reproduce the crash you can run:
|
||||
fuzz/$FUZZER-test $file
|
||||
|
||||
Random numbers
|
||||
==============
|
||||
--------------
|
||||
|
||||
The client and server fuzzer normally generate random numbers as part of the TLS
|
||||
connection setup. This results in the coverage of the fuzzing corpus changing
|
||||
@@ -127,16 +130,17 @@ the same client hello with the same random number in it, and so the server, as
|
||||
emulated by the file, can be generated for that client hello.
|
||||
|
||||
Coverage changes
|
||||
================
|
||||
----------------
|
||||
|
||||
Since the corpus depends on the default behaviour of the client and the server,
|
||||
changes in what they send by default will have an impact on the coverage. The
|
||||
corpus will need to be updated in that case.
|
||||
|
||||
Updating the corpus
|
||||
===================
|
||||
-------------------
|
||||
|
||||
The client and server corpus is generated with multiple config options:
|
||||
|
||||
- The options as documented above
|
||||
- Without enable-ec_nistp_64_gcc_128 and without --debug
|
||||
- With no-asm
|
||||
@@ -147,7 +151,7 @@ The libfuzzer merge option is used to add the additional coverage
|
||||
from each config to the minimal set.
|
||||
|
||||
Minimizing the corpus
|
||||
=====================
|
||||
---------------------
|
||||
|
||||
When you have gathered corpus data from more than one fuzzer run
|
||||
or for any other reason want to to minimize the data
|
||||
|
||||
Reference in New Issue
Block a user