@@ -7,18 +7,17 @@ To quickly get started fuzzing Bitcoin Core using [libFuzzer](https://llvm.org/d
7
7
``` sh
8
8
$ git clone https://github.com/bitcoin/bitcoin
9
9
$ cd bitcoin/
10
- $ cmake -B build_fuzz \
11
- -DCMAKE_C_COMPILER=" clang" \
12
- -DCMAKE_CXX_COMPILER=" clang++" \
13
- -DBUILD_FOR_FUZZING=ON \
14
- -DSANITIZERS=undefined,address,fuzzer
10
+ $ cmake --preset=libfuzzer
15
11
# macOS users: If you have problem with this step then make sure to read "macOS hints for
16
12
# libFuzzer" on https://github.com/bitcoin/bitcoin/blob/master/doc/fuzzing.md#macos-hints-for-libfuzzer
17
13
$ cmake --build build_fuzz
18
14
$ FUZZ=process_message build_fuzz/src/test/fuzz/fuzz
19
15
# abort fuzzing using ctrl-c
20
16
```
21
17
18
+ One can use ` --prefix=libfuzzer-nosan ` to do the same without common sanitizers enabled.
19
+ See [ further] ( #run-without-sanitizers-for-increased-throughput ) for more information.
20
+
22
21
There is also a runner script to execute all fuzz targets. Refer to
23
22
` ./test/fuzz/test_runner.py --help ` for more details.
24
23
@@ -107,8 +106,8 @@ INFO: seed corpus: files: 991 min: 1b max: 1858b total: 288291b rss: 150Mb
107
106
Fuzzing on a harness compiled with ` -DSANITIZERS= address,fuzzer,undefined` is
108
107
good for finding bugs. However, the very slow execution even under libFuzzer
109
108
will limit the ability to find new coverage. A good approach is to perform
110
- occasional long runs without the additional bug-detectors (just
111
- ` -DSANITIZERS=fuzzer ` ) and then merge new inputs into a corpus as described in
109
+ occasional long runs without the additional bug-detectors
110
+ ( ` --preset=libfuzzer-nosan ` ) and then merge new inputs into a corpus as described in
112
111
the qa-assets repo
113
112
(https://github.com/bitcoin-core/qa-assets/blob/main/.github/PULL_REQUEST_TEMPLATE.md).
114
113
Patience is useful; even with improved throughput, libFuzzer may need days and
@@ -145,11 +144,9 @@ You may also need to take care of giving the correct path for `clang` and
145
144
Full configuration step that was tested on macOS with ` brew` installed ` llvm` :
146
145
147
146
` ` ` sh
148
- $ cmake -B build_fuzz \
147
+ $ cmake --preset=libfuzzer \
149
148
-DCMAKE_C_COMPILER=" $( brew --prefix llvm) /bin/clang" \
150
149
-DCMAKE_CXX_COMPILER=" $( brew --prefix llvm) /bin/clang++" \
151
- -DBUILD_FOR_FUZZING=ON \
152
- -DSANITIZERS=undefined,address,fuzzer \
153
150
-DAPPEND_LDFLAGS=-Wl,-no_warn_duplicate_libraries
154
151
` ` `
155
152
0 commit comments