diff --git a/doc/fuzzing.md b/doc/fuzzing.md index bf3ad1786..5dedcb51c 100644 --- a/doc/fuzzing.md +++ b/doc/fuzzing.md @@ -32,6 +32,13 @@ We disable ccache because we don't want to pollute the ccache with instrumented objects, and similarly don't want to use non-instrumented cached objects linked in. +The fuzzing can be sped up significantly (~200x) by using `afl-clang-fast` and +`afl-clang-fast++` in place of `afl-gcc` and `afl-g++` when compiling. When +compiling using `afl-clang-fast`/`afl-clang-fast++` the resulting +`test_bitcoin_fuzzy` binary will be instrumented in such a way that the AFL +features "persistent mode" and "deferred forkserver" can be used. See +https://github.com/mcarpenter/afl/tree/master/llvm_mode for details. + Preparing fuzzing ------------------ @@ -63,4 +70,3 @@ $AFLPATH/afl-fuzz -i ${AFLIN} -o ${AFLOUT} -m52 -- test/test_bitcoin_fuzzy You may have to change a few kernel parameters to test optimally - `afl-fuzz` will print an error and suggestion if so. - diff --git a/src/test/test_bitcoin_fuzzy.cpp b/src/test/test_bitcoin_fuzzy.cpp index c4983f6f5..e11e46bb0 100644 --- a/src/test/test_bitcoin_fuzzy.cpp +++ b/src/test/test_bitcoin_fuzzy.cpp @@ -59,9 +59,8 @@ bool read_stdin(std::vector &data) { return length==0; } -int main(int argc, char **argv) +int do_fuzz() { - ECCVerifyHandle globalVerifyHandle; std::vector buffer; if (!read_stdin(buffer)) return 0; @@ -256,3 +255,23 @@ int main(int argc, char **argv) return 0; } +int main(int argc, char **argv) +{ + ECCVerifyHandle globalVerifyHandle; +#ifdef __AFL_INIT + // Enable AFL deferred forkserver mode. Requires compilation using + // afl-clang-fast++. See fuzzing.md for details. + __AFL_INIT(); +#endif + +#ifdef __AFL_LOOP + // Enable AFL persistent mode. Requires compilation using afl-clang-fast++. + // See fuzzing.md for details. + while (__AFL_LOOP(1000)) { + do_fuzz(); + } + return 0; +#else + return do_fuzz(); +#endif +}