Skip to content

Commit 34ddf0b

Browse files
committed
Replace fuzzer::FuzzerDriver's INTERFACE marking with new LLVMRunFuzzerDriver.
This adds a new extern "C" function that serves the same purpose. This removes the need for external users to depend on internal headers in order to use this feature. It also standardizes the interface in a way that other fuzzing engines will be able to match. Patch By: IanPudney Reviewed By: kcc Differential Revision: https://reviews.llvm.org/D84561
1 parent b52b2e1 commit 34ddf0b

File tree

2 files changed

+35
-0
lines changed

2 files changed

+35
-0
lines changed

compiler-rt/lib/fuzzer/FuzzerDriver.cpp

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -858,6 +858,12 @@ int FuzzerDriver(int *argc, char ***argv, UserCallback Callback) {
858858
exit(0); // Don't let F destroy itself.
859859
}
860860

861+
extern "C" ATTRIBUTE_INTERFACE int
862+
LLVMFuzzerRunDriver(int *argc, char ***argv,
863+
int (*UserCb)(const uint8_t *Data, size_t Size)) {
864+
return FuzzerDriver(argc, argv, UserCb);
865+
}
866+
861867
// Storage for global ExternalFunctions object.
862868
ExternalFunctions *EF = nullptr;
863869

llvm/docs/LibFuzzer.rst

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -617,6 +617,35 @@ really need to access ``argv``/``argc``.
617617
return 0;
618618
}
619619
620+
Using libFuzzer as a library
621+
----------------------------
622+
If the code being fuzzed must provide its own `main`, it's possible to
623+
invoke libFuzzer as a library. Be sure to pass ``-fsanitize=fuzzer-no-link``
624+
during compilation, and link your binary against the no-main version of
625+
libFuzzer. On Linux installations, this is typically located at:
626+
627+
.. code-block:: bash
628+
629+
/usr/lib/<llvm-version>/lib/clang/<clang-version>/lib/linux/libclang_rt.fuzzer_no_main-<architecture>.a
630+
631+
If building libFuzzer from source, this is located at the following path
632+
in the build output directory:
633+
634+
.. code-block:: bash
635+
636+
lib/linux/libclang_rt.fuzzer_no_main-<architecture>.a
637+
638+
From here, the code can do whatever setup it requires, and when it's ready
639+
to start fuzzing, it can call `LLVMFuzzerRunDriver`, passing in the program
640+
arguments and a callback. This callback is invoked just like
641+
`LLVMFuzzerTestOneInput`, and has the same signature.
642+
643+
.. code-block:: c++
644+
645+
extern "C" int LLVMFuzzerRunDriver(int *argc, char ***argv,
646+
int (*UserCb)(const uint8_t *Data, size_t Size));
647+
648+
620649

621650
Leaks
622651
-----

0 commit comments

Comments
 (0)