google / google/clusterfuzz

Add Better Support for AFL/gcc

Open
#920 3 comments 1 reaction 1 assignee Claimed by @jonathanmetzman View on GitHub
Dominant language
Python
Stars
5.6k
Forks
629
Avg merge
4d 6h
Merged PRs (30d)
22

Description

Some potential users (@asudhak and @acatinahat) have said using libFuzzer will be too difficult to use for them because they depend on `gcc`.

I see two ways to support `gcc` users:

1. Make libFuzzer usable with `gcc` ("libfuzzer-gcc").
2. Support fuzzing with `afl-gcc` based targets and no libFuzzer build ("afl-gcc").

@asudhak and @acatinahat preferred the afl-gcc option over the libfuzzer-gcc option. However I think libfuzzer-gcc is worth exploring anyway because it is considerably easier for ClusterFuzz to support and maintain, and it will probably do better, since in our experience, libFuzzer finds more bugs than AFL.

Supporting libfuzzer-gcc would only require (once again) supporting `trace-pc-guard` instrumentation in libFuzzer.

afl-gcc would require:

1. Supporting afl targets not compiled with `afl_driver.cpp` (including creating a convention so that ClusterFuzz could recognize these as targets.
2. Supporting corpus pruning with afl.
3. Supporting testcase minimization with afl.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.