Commit 4f560b4c authored by Darwin Huang's avatar Darwin Huang Committed by Commit Bot

Fuzz: Update README.

Change-Id: I9576f5f8191a42d518b984966cb745bc4b97d6f8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1600861
Commit-Queue: Darwin Huang <huangdarwin@chromium.org>
Auto-Submit: Darwin Huang <huangdarwin@chromium.org>
Reviewed-by: default avatarVictor Costan <pwnall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#658328}
parent 87f10611
...@@ -11,7 +11,7 @@ Example bug: https://crbug.com/956851 ...@@ -11,7 +11,7 @@ Example bug: https://crbug.com/956851
# Simple automated repro # Simple automated repro
TODO: Move to [here](https://google.github.io/clusterfuzz/using-clusterfuzz/)? TODO: Move to [here](https://google.github.io/clusterfuzz/using-clusterfuzz/)?
If just trying to verify that the bug still repros on the current trunk: To verify that the bug still repros on the current master branch:
1. Open the relevant bug (ex. https://crbug.com/956851). 1. Open the relevant bug (ex. https://crbug.com/956851).
2. Open the clusterfuzz "Detailed report" (ex. https://clusterfuzz.com/testcase?key=5756437473656832). 2. Open the clusterfuzz "Detailed report" (ex. https://clusterfuzz.com/testcase?key=5756437473656832).
3. Click on the "REDO TASK" button. 3. Click on the "REDO TASK" button.
...@@ -29,9 +29,8 @@ stack trace will be displayed in the "Detailed report". ...@@ -29,9 +29,8 @@ stack trace will be displayed in the "Detailed report".
# Local repro using clusterfuzz testcase id # Local repro using clusterfuzz testcase id
If the fuzzer that identified this bug is public (ex. dbfuzz2), reproduce If the fuzzer that identified this bug is public (ex. dbfuzz2), reproduce
locally using the [Reproduce Tool](https://github.com/google/clusterfuzz-tools). locally using the [Reproduce Tool](https://github.com/google/clusterfuzz-tools).
1. Set ${TESTCASE_ID}, where TESTCASE_ID is the ID at the end of the clusterfuzz 1. `export TESTCASE_ID=5756437473656832 # Set ${TESTCASE_ID}, where TESTCASE_ID is the ID at the end of the clusterfuzz link`
link (ex. `export TESTCASE_ID=5756437473656832`). 2. `/google/data/ro/teams/clusterfuzz-tools/releases/clusterfuzz reproduce --current --skip-deps ${TESTCASE_ID}`
2. `/google/data/ro/teams/clusterfuzz-tools/releases/clusterfuzz reproduce --current --skip-deps ${TESTCASE_ID}`,
# Local repro using clusterfuzz testcase # Local repro using clusterfuzz testcase
If the fuzzer is not public (ex. LPM-based fuzzers, including fts_lpm), or if If the fuzzer is not public (ex. LPM-based fuzzers, including fts_lpm), or if
...@@ -39,7 +38,7 @@ more data is needed, reproduce a bit more manually by first building the target. ...@@ -39,7 +38,7 @@ more data is needed, reproduce a bit more manually by first building the target.
To build the target, first set .gn args to match those in the clusterfuzz link, To build the target, first set .gn args to match those in the clusterfuzz link,
then build and run the fuzzer. then build and run the fuzzer.
1. `export FUZZER_NAME=sqlite3_fts3_lpm_fuzzer # FUZZER_NAME is listed in the crbug as the Fuzz target binary` 1. `export FUZZER_NAME=sqlite3_fts3_lpm_fuzzer # FUZZER_NAME is listed in the crbug as the "Fuzz target binary"`
2. Download the clusterfuzz minimized testcase. 2. Download the clusterfuzz minimized testcase.
3. `export CLUSTERFUZZ_TESTCASE=./clusterfuzz-testcase-minimized-sqlite3_fts3_lpm_fuzzer-5756437473656832 # Set the clusterfuzz testcase path to CLUSTERFUZZ_TESTCASE` 3. `export CLUSTERFUZZ_TESTCASE=./clusterfuzz-testcase-minimized-sqlite3_fts3_lpm_fuzzer-5756437473656832 # Set the clusterfuzz testcase path to CLUSTERFUZZ_TESTCASE`
3. `gn args out/Fuzzer # Set arguments to matches those in the clusterfuzz "Detailed report"'s "GN CONFIG (ARGS.GN)" section` 3. `gn args out/Fuzzer # Set arguments to matches those in the clusterfuzz "Detailed report"'s "GN CONFIG (ARGS.GN)" section`
...@@ -53,7 +52,7 @@ non-sql content afterwards. Either way, ensure that the case continues to repro ...@@ -53,7 +52,7 @@ non-sql content afterwards. Either way, ensure that the case continues to repro
given filters placed in (7). given filters placed in (7).
# Local repro using SQL commands # Local repro using SQL commands
Please have a SQL query ready, preferably in .sql format. For this context, Please have a .sql file with SQL queries ready. We'll refer to this file as
we'll refer to this query as repro.sql. repro.sql.
1. `autoninja -C out/Fuzzer/ sqlite_shell # Build the sqlite_shell` 1. `autoninja -C out/Fuzzer/ sqlite_shell # Build the sqlite_shell`
2. `out/Fuzzer/sqlite_shell < repro.sql # Try running this sql query in sqlite` 2. `out/Fuzzer/sqlite_shell < repro.sql # Try running this sql query in sqlite`
\ No newline at end of file
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment