1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
|
# libFuzzer Integration
Custom builds of the Swift toolchain (including development snapshots)
have a built-in `libFuzzer` integration. In order to use it on a file
`myfile.swift`, define an entry point fuzzing function with a
`@_cdecl("LLVMFuzzerTestOneInput")` annotation:
```swift
@_cdecl("LLVMFuzzerTestOneInput")
public func test(_ start: UnsafeRawPointer, _ count: Int) -> CInt {
let bytes = UnsafeRawBufferPointer(start: start, count: count)
// TODO: Test the code using the provided bytes.
return 0
}
```
To compile it, use the `-sanitize=fuzzer` flag to link `libFuzzer`
and enable code coverage information; and the `-parse-as-library` flag
to omit the `main` symbol, so that the fuzzer entry point can be used:
```bash
% swiftc -sanitize=fuzzer -parse-as-library myfile.swift
```
`libFuzzer` can be combined with other sanitizers:
```bash
% swiftc -sanitize=fuzzer,address -parse-as-library myfile.swift
```
Finally, launch the fuzzing process:
```bash
% ./myfile
```
Refer to the official `libFuzzer` documentation at
<https://llvm.org/docs/LibFuzzer.html#options>
for a description of the fuzzer's command line options.
|
