1# libFuzzer and ClusterFuzz Integration 2 3ClusterFuzz is a distributed fuzzing infrastructure that automatically 4executes libFuzzer powered fuzzer tests on scale. 5 6Googlers can read more [here](https://goto.google.com/clusterfuzz). 7 8## Status Links 9 10* [Buildbot] - status of all libFuzzer builds. 11* [ClusterFuzz Fuzzer Stats] - fuzzing metrics. 12* [Code Coverage] - code coverage of libFuzzer targets in Chrome. 13* [ClusterFuzz libFuzzer Logs] - individual fuzz target run logs. 14* [Corpus GCS Bucket] - current corpus for each fuzz target. Can be used to 15upload bootstrapped corpus. 16 17## Integration Details 18 19The integration between libFuzzer and ClusterFuzz consists of: 20 21* Build rules definition in [fuzzer_test.gni]. 22* [Buildbot] that automatically discovers fuzz targets using `gn refs`, builds 23fuzz targets with multiple sanitizers and uploads binaries to a GCS bucket. 24Recipe is defined in [fuzz.py]. 25* ClusterFuzz downloads builds and runs fuzz targets continuously. 26* Fuzz target run logs are uploaded to [ClusterFuzz libFuzzer Logs] GCS bucket. 27* Fuzzing corpus is maintained for each fuzz target in [Corpus GCS Bucket]. Once 28a day, the corpus is minimized to reduce number of duplicates and/or reduce 29effect of parasitic coverage. 30* [ClusterFuzz Fuzzer Stats] displays fuzzer runtime metrics as well as 31provides links to crashes and coverage reports. 32 33 34## Corpus 35 36Chromium developers can access the corpus stored in the [Corpus GCS Bucket] via 37web interface or by using `gsutil` tool (the latter is easier for downloading): 38 39```bash 40mkdir local_corpus_dir 41gsutil -m cp -r gs://clusterfuzz-corpus/libfuzzer/<fuzz_target> local_corpus_dir 42``` 43 44[Buildbot]: https://ci.chromium.org/p/chromium/g/chromium.fuzz/builders 45[Code Coverage]: https://chromium-coverage.appspot.com/reports/latest_fuzzers_only/linux/index.html 46[fuzz.py]: https://source.chromium.org/chromium/chromium/tools/build/+/main:recipes/recipes/chromium/fuzz.py?q=fuzz.py 47[ClusterFuzz Fuzzer Stats]: https://clusterfuzz.com/fuzzer-stats/by-fuzzer/fuzzer/libFuzzer/job/libfuzzer_chrome_asan 48[ClusterFuzz libFuzzer Logs]: https://console.cloud.google.com/storage/browser/clusterfuzz-libfuzzer-logs 49[Corpus GCS Bucket]: https://console.cloud.google.com/storage/clusterfuzz-corpus/libfuzzer 50[fuzzer_test.gni]: https://source.chromium.org/chromium/chromium/src/+/HEAD:testing/libfuzzer/fuzzer_test.gni 51