<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - improve support for fuzz targets in LLVM"
href="https://bugs.llvm.org/show_bug.cgi?id=34314">34314</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>improve support for fuzz targets in LLVM
</td>
</tr>
<tr>
<th>Product</th>
<td>new-bugs
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>new bugs
</td>
</tr>
<tr>
<th>Assignee</th>
<td>mascasa@google.com
</td>
</tr>
<tr>
<th>Reporter</th>
<td>kcc@google.com
</td>
</tr>
<tr>
<th>CC</th>
<td>ekarpenkov@apple.com, llvm-bugs@justinbogner.com, llvm-bugs@lists.llvm.org
</td>
</tr></table>
<p>
<div>
<pre>Currently, we have only one way to build fuzz targets (e.g. clang-fuzzer) in
LLVM: specify -DLLVM_USE_SANITIZE_COVERAGE=On and -DLLVM_USE_SANITIZER=Address
I would like to have this be more flexible.
1. Fuzz targets should be built in the default configuration (no asan, no
coverage). They won't be suitable for fuzzing this way, but this will ensure
that the code still builds (fuzz targets need to be build during check-all)
2. [stretch] each fuzz target foo-fuzz needs to have a build rule
check-foo-fuzz that will execute the fuzz target on a fixed set of inputs (from
the same repo) as a way of regression testing. This will ensure that the fuzz
target not only builds, but runs. This is also a great regression test.
3. Fuzz targets should work with any of the sanitizers, or with none at all
(-DLLVM_USE_SANITIZER=Address should not be mandatory)
4. There should be a way to specify the compile-time coverage instrumentation
flags and link-time fuzzing engine flag. In particular, I'd like to support the
env. vars. defined by OSS-Fuzz: CC, CXX, CFLAGS, CXXFLAGS, LIB_FUZZING_ENGINE
(by passing these flags to cmake variables). This way we'll be able to build
the fuzz targets with e.g. AFL, hoggfuzz, and with Clang Coverage (for coverage
visualization)</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>