Repository navigation
Add a fuzz! macro that can be called from main - #146
Open
chris-srlabs wants to merge 1 commit into
Open
chris-srlabs wants to merge 1 commit into
chris-srlabs wants to merge 1 commit into
Conversation
The new `fuzz!` macro does not require `#[no_main]` and can be called directly from `main`. It invokes libFuzzer through `LLVMFuzzerRunDriver`. Since the closure passed to `fuzz!` can capture its environment, its lifetime needs careful handling. A trampoline connects libFuzzer's callback to the closure. Signal handling also needs care because Rust's signal handlers can interfere with libFuzzer's. Macro hygiene in the existing `fuzz_target!` macro is also improved, allowing the libfuzzer-sys crate to be renamed. The new `fuzz!` macro is gated behind the `fuzz_macro` feature as it adds the libc dependency on unix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This adds a new
fuzz!macro that lets you call libFuzzer frommain, run setup beforehand, and use local state in the fuzz closure (see #33 for a previous attempt in that direction). The goal is to make it easier to switch to afl.rs or honggfuzz and back to libfuzzer-sys (see the discussion in rust-fuzz/cargo-fuzz#119). This is only a first step in that direction.The new macro is gated behind the
fuzz_macrofeature because it adds alibcdependency on Unix. It invokes libFuzzer throughLLVMFuzzerRunDriver.Since the closure passed to
fuzz!can capture its environment, its lifetime needs careful handling. A trampoline connects libFuzzer's callback to the closure.Signal handling also needs care because Rust's signal handlers can interfere with libFuzzer's (now that the target has a Rust
mainfunction).Macro hygiene in the existing
fuzz_target!macro is also improved, allowing downstream crates to rename thelibfuzzer-sysdependency.The
signal-matrixtool was written entirely by AI (kept outside this PR on a separate branch). But it does the job of comparing how the existingfuzz_target!harness and the newfuzz!harness called frommainhandle different crash signals. It compares those harnesses with ASan and without a sanitizer.On my linux system it outputs this divergence matrix (exec via
cargo run -p signal-matrix):fuzz_target!(no_main)fuzz!(main)