Merge #10415: [tests] Speed up fuzzing by ~200x when using afl-fuzz

693247b [test] Speed up fuzzing by ~200x when using afl-fuzz (practicalswift)

Tree-SHA512: 95922fc2616b8cb00dd531ed1140a52bbda4e04292dd8c1c60a8f49dbf6ccb797a18b61180b3fb68d695456b478a1f5ae7fda47e8ecee41dd65555487aef40a3
This commit is contained in:
Wladimir J. van der Laan 2017-05-22 16:53:18 +02:00 committed by Pasta
parent 2f2a6972dd
commit 122da986c1
2 changed files with 28 additions and 3 deletions

View File

@ -32,6 +32,13 @@ We disable ccache because we don't want to pollute the ccache with instrumented
objects, and similarly don't want to use non-instrumented cached objects linked
in.
The fuzzing can be sped up significantly (~200x) by using `afl-clang-fast` and
`afl-clang-fast++` in place of `afl-gcc` and `afl-g++` when compiling. When
compiling using `afl-clang-fast`/`afl-clang-fast++` the resulting
`test_bitcoin_fuzzy` binary will be instrumented in such a way that the AFL
features "persistent mode" and "deferred forkserver" can be used. See
https://github.com/mcarpenter/afl/tree/master/llvm_mode for details.
Preparing fuzzing
------------------
@ -63,4 +70,3 @@ $AFLPATH/afl-fuzz -i ${AFLIN} -o ${AFLOUT} -m52 -- test/test_bitcoin_fuzzy
You may have to change a few kernel parameters to test optimally - `afl-fuzz`
will print an error and suggestion if so.

View File

@ -59,9 +59,8 @@ bool read_stdin(std::vector<char> &data) {
return length==0;
}
int main(int argc, char **argv)
int do_fuzz()
{
ECCVerifyHandle globalVerifyHandle;
std::vector<char> buffer;
if (!read_stdin(buffer)) return 0;
@ -256,3 +255,23 @@ int main(int argc, char **argv)
return 0;
}
int main(int argc, char **argv)
{
ECCVerifyHandle globalVerifyHandle;
#ifdef __AFL_INIT
// Enable AFL deferred forkserver mode. Requires compilation using
// afl-clang-fast++. See fuzzing.md for details.
__AFL_INIT();
#endif
#ifdef __AFL_LOOP
// Enable AFL persistent mode. Requires compilation using afl-clang-fast++.
// See fuzzing.md for details.
while (__AFL_LOOP(1000)) {
do_fuzz();
}
return 0;
#else
return do_fuzz();
#endif
}