Commit c555cfbc authored by Jonathan Metzman's avatar Jonathan Metzman Committed by Commit Bot

[libFuzzer][Windows] Improve docs

Fix link to reproduce tool.
Include note about using powershell.
Remove "> " from command.
Mention that document is for libFuzzer explicitly.
Be more consistent about capitalization of "libFuzzer".

TBR=mmoroz@chromium.org

Bug: 901836
Change-Id: I9a91be5d01c2707366b1d8100cb0823c221aa82e
Reviewed-on: https://chromium-review.googlesource.com/c/1318918
Commit-Queue: Jonathan Metzman <metzman@chromium.org>
Reviewed-by: default avatarMax Moroz <mmoroz@chromium.org>
Reviewed-by: default avatarJonathan Metzman <metzman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#605684}
parent fe88c9ec
...@@ -62,8 +62,8 @@ libFuzzer. ...@@ -62,8 +62,8 @@ libFuzzer.
[Efficient Fuzzer Guide]: efficient_fuzzer.md [Efficient Fuzzer Guide]: efficient_fuzzer.md
[Guide to libprotobuf-mutator]: libprotobuf-mutator.md [Guide to libprotobuf-mutator]: libprotobuf-mutator.md
[ClusterFuzz Integration]: clusterfuzz.md [ClusterFuzz Integration]: clusterfuzz.md
[Reproducing]: https://github.com/google/clusterfuzz-tools
[Reproducing on Windows]: reproducing_on_windows.md [Reproducing on Windows]: reproducing_on_windows.md
[Reproducing on Linux and Mac]: https://github.com/google/clusterfuzz-tools
[Reference]: reference.md [Reference]: reference.md
[ClusterFuzz Bugs]: https://bugs.chromium.org/p/chromium/issues/list?can=1&q=label:Stability-LibFuzzer%20label:ClusterFuzz&sort=-modified&colspec=ID%20Pri%20M%20Stars%20ReleaseBlock%20Component%20Status%20Owner%20Summary%20OS%20Modified [ClusterFuzz Bugs]: https://bugs.chromium.org/p/chromium/issues/list?can=1&q=label:Stability-LibFuzzer%20label:ClusterFuzz&sort=-modified&colspec=ID%20Pri%20M%20Stars%20ReleaseBlock%20Component%20Status%20Owner%20Summary%20OS%20Modified
[Pdfium Bugs]: https://bugs.chromium.org/p/pdfium/issues/list?can=1&q=libfuzzer&colspec=ID+Type+Status+Priority+Milestone+Owner+Summary&cells=tiles [Pdfium Bugs]: https://bugs.chromium.org/p/pdfium/issues/list?can=1&q=libfuzzer&colspec=ID+Type+Status+Priority+Milestone+Owner+Summary&cells=tiles
......
# Reproducing Crashes on Windows # Reproducing libFuzzer Crashes on Windows
Since the [ClusterFuzz Reproduce Tool] does not work on Windows, you will need Since the [ClusterFuzz Reproduce Tool] does not work on Windows, you will need
to reproduce crashes found by ClusterFuzz manually. Luckily, this process is to reproduce crashes found by ClusterFuzz manually. Luckily, this process is
usually very simple. Below are the steps (assuming use of cmd.exe): usually very simple. Below are the steps:
*** note
**Requirements:** These commands are intended to work in cmd.exe, not
powershell.
***
1. Download the test case from ClusterFuzz (if you are CCed on an issue filed by 1. Download the test case from ClusterFuzz (if you are CCed on an issue filed by
ClusterFuzz, a link to it is next to "Reproducer testcase" in the ClusterFuzz, a link to it is next to "Reproducer testcase" in the
bug description). For the rest of this walkthrough, we call the path of this bug description). For the rest of this walkthrough, we call the path of this
file: `$TESTCASE_PATH`. file: `$TESTCASE_PATH`.
2. Generate gn build configuration for fuzzers: 2. Generate gn build configuration for libFuzzer:
``` ```
python tools\mb\mb.py gen -m chromium.fyi -b "Libfuzzer Upload Windows ASan" out\libfuzzer python tools\mb\mb.py gen -m chromium.fyi -b "Libfuzzer Upload Windows ASan" out\libFuzzer
``` ```
3. Build the fuzzer: 3. Build the fuzzer:
``` ```
autoninja -C .\out\libfuzzer\ $FUZZER_NAME autoninja -C .\out\libFuzzer\ $FUZZER_NAME
``` ```
4. Set the `ASAN_OPTIONS` environment variable to be the same as ClusterFuzz. 4. Set the `ASAN_OPTIONS` environment variable to be the same as ClusterFuzz.
...@@ -27,13 +32,13 @@ Here is an example value of `ASAN_OPTIONS` that is similar to its value on ...@@ -27,13 +32,13 @@ Here is an example value of `ASAN_OPTIONS` that is similar to its value on
ClusterFuzz: ClusterFuzz:
``` ```
> set ASAN_OPTIONS=redzone=256:print_summary=1:handle_sigill=1:strict_string_check=1:allocator_release_to_os_interval_ms=500:print_suppressions=0:strict_memcmp=1:allow_user_segv_handler=0:use_sigaltstack=1:handle_sigfpe=1:handle_sigbus=1:detect_stack_use_after_return=0:alloc_dealloc_mismatch=0:detect_leaks=0:print_scariness=1:allocator_may_return_null=1:handle_abort=1:check_malloc_usable_size=0:detect_container_overflow=0:quarantine_size_mb=256:detect_odr_violation=0:symbolize=1:handle_segv=1:fast_unwind_on_fatal=1 set ASAN_OPTIONS=redzone=256:print_summary=1:handle_sigill=1:strict_string_check=1:allocator_release_to_os_interval_ms=500:print_suppressions=0:strict_memcmp=1:allow_user_segv_handler=0:use_sigaltstack=1:handle_sigfpe=1:handle_sigbus=1:detect_stack_use_after_return=0:alloc_dealloc_mismatch=0:detect_leaks=0:print_scariness=1:allocator_may_return_null=1:handle_abort=1:check_malloc_usable_size=0:detect_container_overflow=0:quarantine_size_mb=256:detect_odr_violation=0:symbolize=1:handle_segv=1:fast_unwind_on_fatal=1
``` ```
5. Run the fuzzer: 5. Run the fuzzer:
``` ```
.\out\libfuzzer\$FUZZER_NAME -runs=100 $TESTCASE_PATH .\out\libFuzzer\$FUZZER_NAME -runs=100 $TESTCASE_PATH
``` ```
Send an email to fuzzing@chromium.org if you run into any issues. Send an email to fuzzing@chromium.org if you run into any issues.
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment