mirror of
https://github.com/ElementsProject/lightning.git
synced 2024-11-19 18:11:28 +01:00
62b54d0125
This adds a new configuration, --enable-fuzzing (which is more than welcome to be coupled with --enable-address-sanitizer), to pass the fuzzer sanitizer argument when compiling objects. This allows libfuzzer to actually be able "to fuzz" by detecting coverage and be smart when mutating inputs. As libfuzzer brings its own ~~fees~~ main(), we compile objects with fsanitize=fuzzer-no-link, and special-case the linkage of the fuzz targets. A "lib" is added to abstract out the interface to the fuzzing tool used. This allow us to use the same targets to fuzz using AFL, hongfuzz or w/e by adding their entrypoints into libfuzz. (h/t to practicalswift who introduced this for bitcoin-core, which i mimiced) Signed-off-by: Antoine Poinsot <darosior@protonmail.com>
19 lines
550 B
C
19 lines
550 B
C
#ifndef LIGHTNING_TESTS_FUZZ_LIBFUZZ_H
|
|
#define LIGHTNING_TESTS_FUZZ_LIBFUZZ_H
|
|
|
|
#include <stddef.h>
|
|
#include <stdint.h>
|
|
|
|
/* Called once before running the target. Use it to setup the testing
|
|
* environment. */
|
|
void init(int *argc, char ***argv);
|
|
|
|
/* The actual target called multiple times with mutated data. */
|
|
void run(const uint8_t *data, size_t size);
|
|
|
|
/* Copy an array of chunks from data. */
|
|
const uint8_t **get_chunks(const void *ctx, const uint8_t *data,
|
|
size_t data_size, size_t chunk_size);
|
|
|
|
#endif /* LIGHTNING_TESTS_FUZZ_LIBFUZZ_H */
|