diff options
Diffstat (limited to 'FUZZING.md')
| -rw-r--r-- | FUZZING.md | 15 |
1 files changed, 4 insertions, 11 deletions
@@ -23,21 +23,14 @@ Then copy `libFuzzer.a` to the top-level of your BoringSSL source directory. From the `build/` directory, you can then run the fuzzers. For example: ``` -./fuzz/cert -max_len=4000 -jobs=32 -workers=32 ../fuzz/cert_corpus/ +./fuzz/cert -max_len=3072 -jobs=32 -workers=32 ../fuzz/cert_corpus/ ``` -The `max_len` argument is often important because, without it, libFuzzer defaults to limiting all test cases to 64 bytes, which is often insufficient for the formats that we wish to fuzz. The arguments to `jobs` and `workers` should be the number of cores that you wish to dedicate to fuzzing. +The arguments to `jobs` and `workers` should be the number of cores that you wish to dedicate to fuzzing. By default, libFuzzer uses the largest test in the corpus (or 64 if empty) as the maximum test case length. The `max_len` argument overrides this. -There are directories in `fuzz/` for each of the fuzzing tests which contain seed files for fuzzing. Some of the seed files were generated manually but many of them are “interesting” results generated by the fuzzing itself. (Where “interesting” means that it triggered a previously unknown path in the code.) - -Here are the recommended values of `max_len` for each test. +The recommended values of `max_len` for each test may be found in `.options` files alongside the test source. These were determined by rounding up the length of the largest case in the corpus. When writing a new fuzzer, configure `max_len` in a similar file. -| Test | `max_len` value | -|-----------|-----------------| -| `privkey` | 2048 | -| `cert` | 3072 | -| `server` | 1024 | -| `client` | 4096 | +There are directories in `fuzz/` for each of the fuzzing tests which contain seed files for fuzzing. Some of the seed files were generated manually but many of them are “interesting” results generated by the fuzzing itself. (Where “interesting” means that it triggered a previously unknown path in the code.) ## Minimising the corpuses |