1# Fuzzing 2 3Crosvm contains several [fuzz testing](https://en.wikipedia.org/wiki/Fuzzing) programs that are 4intended to exercise specific subsets of the code with automatically generated inputs to help 5uncover bugs that were not found by human-written unit tests. 6 7The source code for the fuzzer target programs can be found in [`fuzz/fuzz_targets`] in the crosvm 8source tree. 9 10## OSS-Fuzz 11 12Crosvm makes use of the OSS-Fuzz service, which automatically builds and runs fuzzers for many open 13source projects. Once a crosvm change is committed and pushed to the main branch, it will be tested 14automatically by [ClusterFuzz], and if new issues are found, a bug will be filed. 15 16- [crosvm oss-fuzz configuration] 17- [crosvm oss-fuzz build status] 18 19## Running fuzzers locally 20 21It can be useful to run a fuzzer in order to test new changes locally or to reproduce a bug filed by 22ClusterFuzz. 23 24To build and run a specific fuzz target, install [`cargo fuzz`], then run it in the crosvm source 25tree, specifying the desired fuzz target to run. If you have a testcase provided by the automated 26fuzzing infrastructure in a bug report, you can add that file to the fuzzer command line to 27reproduce the same fuzzer execution rather than using randomly generating inputs. 28 29```sh 30# Run virtqueue_fuzzer with randomly-generated input. 31# This will run indefinitely; it can be stopped with Ctrl+C. 32cargo +nightly fuzz run virtqueue_fuzzer 33 34# Run virtqueue_fuzzer with a specific input file from ClusterFuzz. 35cargo +nightly fuzz run virtqueue_fuzzer clusterfuzz-testcase-minimized-... 36``` 37 38[clusterfuzz]: https://google.github.io/clusterfuzz/ 39[crosvm oss-fuzz build status]: https://oss-fuzz-build-logs.storage.googleapis.com/index.html#crosvm 40[crosvm oss-fuzz configuration]: https://github.com/google/oss-fuzz/tree/master/projects/crosvm 41[`cargo fuzz`]: https://github.com/rust-fuzz/cargo-fuzz 42[`fuzz/fuzz_targets`]: https://chromium.googlesource.com/crosvm/crosvm/+/refs/heads/main/fuzz/fuzz_targets/ 43