GitHub-Mirror/monero
0
0
Fork 0
mirror of https://github.com/monero-project/monero synced 2025-10-06 08:42:47 +02:00
Code Issues Releases Wiki Activity

tests: add OSS-Fuzz documentation

Browse Source 
Adds documentation that outlines the OSS-Fuzz integration of Monero. The
goal is to make it more accessible to build/test/expand the existing
fuzz suite, and also to make it more visible that this integration
exists.

Signed-off-by: David Korczynski <david@adalogics.com>
This commit is contained in:
David Korczynski
2025-07-16 08:40:06 -07:00
parent fbd7348d82
commit 4775755456
1 changed files with 65 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

65
tests/README.md
View File

@@ -91,6 +91,71 @@ Fuzz tests are written using American Fuzzy Lop (AFL), and located under the `te
An additional helper utility is provided `contrib/fuzz_testing/fuzz.sh`. AFL must be installed, and some additional setup may be necessary for the script to run properly.
## OSS-Fuzz
Monero is integrated into [OSS-Fuzz](https://github.com/google/oss-fuzz) and the project integration
is available [here](https://github.com/google/oss-fuzz/tree/master/projects/monero). OSS-Fuzz builds
and runs the fuzzers continuously, so long as Monero's OSS-Fuzz [build script](https://github.com/google/oss-fuzz/blob/master/projects/monero/build.sh) builds them.
Issues found by OSS-Fuzz are publicly available (following a disclosure deadline) on the OSS-Fuzz issue tracker [here](https://issues.oss-fuzz.com/issues?q=project%3Dmonero).
The issue tracker only displays limited information, and only maintainers with emails listed in the [project.yaml](https://github.com/google/oss-fuzz/blob/master/projects/monero/project.yaml) have access to full details.
Coverage reports are built on a daily basis and data about this can be found at [introspector.oss-fuzz.com](https://introspector.oss-fuzz.com) [here](https://introspector.oss-fuzz.com/project-profile?project=monero).
### Build and run fuzzers by way of OSS-Fuzz
**Building Monero's fuzzers with OSS-Fuzz**
```sh
$ git clone https://github.com/google/oss-fuzz
$ cd oss-fuzz
$ python3 infra/helper.py build_fuzzers monero
# Display what was build
$ ls build/out/monero/
base58_fuzz_tests cold-outputs_fuzz_tests_seed_corpus.zip llvm-symbolizer signature_fuzz_tests
base58_fuzz_tests_seed_corpus.zip cold-transaction_fuzz_tests load-from-binary_fuzz_tests signature_fuzz_tests_seed_corpus.zip
block_fuzz_tests cold-transaction_fuzz_tests_seed_corpus.zip load-from-binary_fuzz_tests_seed_corpus.zip transaction_fuzz_tests
block_fuzz_tests_seed_corpus.zip http-client_fuzz_tests load-from-json_fuzz_tests transaction_fuzz_tests_seed_corpus.zip
bulletproof_fuzz_tests http-client_fuzz_tests_seed_corpus.zip load-from-json_fuzz_tests_seed_corpus.zip tx-extra_fuzz_tests
bulletproof_fuzz_tests_seed_corpus.zip levin_fuzz_tests parse-url_fuzz_tests tx-extra_fuzz_tests_seed_corpus.zip
cold-outputs_fuzz_tests levin_fuzz_tests_seed_corpus.zip parse-url_fuzz_tests_seed_corpus.zip
```
**Run fuzzing harness with OSS-Fuzz**
Assuming you performed the above steps for building the fuzzers and are in the OSS-Fuzz root directory:
```sh
$ python3 infra/helper.py run_fuzzer monero base58_fuzz_tests
...
...
INFO: Loaded 1 modules (9075 inline 8-bit counters): 9075 [0x55d1c3d6cfd8, 0x55d1c3d6f34b),
INFO: Loaded 1 PC tables (9075 PCs): 9075 [0x55d1c3d6f350,0x55d1c3d92a80),
INFO: 1 files found in /tmp/base58_fuzz_tests_corpus
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
INFO: seed corpus: files: 1 min: 95b max: 95b total: 95b rss: 33Mb
#2 INITED cov: 18 ft: 19 corp: 1/95b exec/s: 0 rss: 33Mb
#3 NEW cov: 19 ft: 23 corp: 2/190b lim: 95 exec/s: 0 rss: 34Mb L: 95/95 MS: 1 ChangeByte-
#4 NEW cov: 20 ft: 24 corp: 3/285b lim: 95 exec/s: 0 rss: 34Mb L: 95/95 MS: 1 ChangeByte-
#5 NEW cov: 22 ft: 26 corp: 4/359b lim: 95 exec/s: 0 rss: 34Mb L: 74/95 MS: 1 EraseBytes-
#6 NEW cov: 23 ft: 29 corp: 5/454b lim: 95 exec/s: 0 rss: 34Mb L: 95/95 MS: 1 ChangeByte-
#8 NEW cov: 24 ft: 30 corp: 6/549b lim: 95 exec/s: 0 rss: 34Mb L: 95/95 MS: 2 CrossOver-ChangeBit-
#12 NEW cov: 25 ft: 35 corp: 7/606b lim: 95 exec/s: 0 rss: 34Mb L: 57/95 MS: 4 ChangeBinInt-ShuffleBytes-ShuffleBytes-EraseBytes-
#14 NEW cov: 26 ft: 38 corp: 8/655b lim: 95 exec/s: 0 rss: 34Mb L: 49/95 MS: 2 ChangeBinInt-EraseBytes-
#17 NEW cov: 27 ft: 40 corp: 9/708b lim: 95 exec/s: 0 rss: 34Mb L: 53/95 MS: 3 ChangeASCIIInt-ChangeBit-EraseBytes-
#18 NEW cov: 28 ft: 41 corp: 10/803b lim: 95 exec/s: 0 rss: 34Mb L: 95/95 MS: 1 ChangeByte-
#20 NEW cov: 28 ft: 42 corp: 11/852b lim: 95 exec/s: 0 rss: 34Mb L: 49/95 MS: 2 ChangeASCIIInt-ShuffleBytes-
#22 REDUCE cov: 28 ft: 42 corp: 11/847b lim: 95 exec/s: 0 rss: 34Mb L: 90/95 MS: 2 ChangeBinInt-CrossOver-
#25 NEW cov: 29 ft: 47 corp: 12/942b lim: 95 exec/s: 0 rss: 34Mb L: 95/95 MS: 3 ChangeBit-ChangeBit-CopyPart-
#39 REDUCE cov: 29 ft: 47 corp: 12/941b lim: 95 exec/s: 0 rss: 34Mb L: 94/95 MS: 4 ChangeByte-CopyPart-ChangeASCIIInt-EraseBytes-
#41 NEW cov: 30 ft: 48 corp: 13/991b lim: 95 exec/s: 0 rss: 34Mb L: 50/95 MS: 2 CopyPart-CrossOver-
#57 NEW cov: 31 ft: 49 corp: 14/1068b lim: 95 exec/s: 0 rss: 34Mb L: 77/95 MS: 1 InsertRepeatedBytes-
#63 NEW cov: 32 ft: 50 corp: 15/1147b lim: 95 exec/s: 0 rss: 34Mb L: 79/95 MS: 1 CrossOver-
...
```
# Hash tests
Hash tests exist under `tests/hash`, and include a set of target hashes in text files.