11Fuzz Tests for CPython
22======================
33
4- These fuzz tests are designed to be included in Google's `oss-fuzz `_ project.
4+ These fuzz tests are designed to be included in Google's `OSS-Fuzz `_ project.
55
6- oss-fuzz works against a library exposing a function of the form
6+ OSS-Fuzz works against a library exposing a function of the form
77``int LLVMFuzzerTestOneInput(const uint8_t* data, size_t length) ``. We provide
8- that library (``fuzzer.c ``), and include a ``_fuzz `` module for testing with
8+ that library (``fuzzer.c ``), and include a ``_xxtestfuzz `` module for testing with
99some toy values -- no fuzzing occurs in Python's test suite.
1010
11- oss-fuzz will regularly pull from CPython, discover all the tests in
11+ OSS-Fuzz will regularly pull from CPython, discover all the tests in
1212``fuzz_tests.txt ``, and run them -- so adding a new test here means it will
13- automatically be run in oss-fuzz , while also being smoke-tested as part of
13+ automatically be run in OSS-Fuzz , while also being smoke-tested as part of
1414CPython's test suite.
1515
16- In addition, the tests are run on GitHub Actions using CIFuzz for PRs to the
17- main branch changing relevant files.
16+ In addition, the tests are run on GitHub Actions using `CIFuzz
17+ <https://google.github.io/oss-fuzz/getting-started/continuous-integration/> `_
18+ for PRs to the ``main `` branch changing relevant files.
19+
1820
1921Adding a new fuzz test
2022----------------------
@@ -28,7 +30,6 @@ In ``fuzzer.c``, add a function to be run::
2830 return 0;
2931 }
3032
31-
3233And invoke it from ``LLVMFuzzerTestOneInput ``::
3334
3435 #if !defined(_Py_FUZZ_ONE) || defined(_Py_FUZZ_$fuzz_test_name)
@@ -37,25 +38,27 @@ And invoke it from ``LLVMFuzzerTestOneInput``::
3738
3839Don't forget to replace ``$fuzz_test_name `` with your actual test name.
3940
40- ``LLVMFuzzerTestOneInput `` will run in oss-fuzz , with each test in
41+ ``LLVMFuzzerTestOneInput `` will run in OSS-Fuzz , with each test in
4142``fuzz_tests.txt `` run separately.
4243
4344Seed data (corpus) for the test can be provided in a subfolder called
4445``<test_name>_corpus `` such as ``fuzz_json_loads_corpus ``. A wide variety
4546of good input samples allows the fuzzer to more easily explore a diverse
4647set of paths and provides a better base to find buggy input from.
4748
48- Dictionaries of tokens (see oss-fuzz documentation for more details) can
49- be placed in the ``dictionaries `` folder with the name of the test.
49+ Dictionaries of tokens (see the `libFuzzer documentation
50+ <https://llvm.org/docs/LibFuzzer.html#dictionaries> `_ for more information) can
51+ be placed in the ``dictionaries/ `` folder with the name of the test.
5052For example, ``dictionaries/fuzz_json_loads.dict `` contains JSON tokens
5153to guide the fuzzer.
5254
55+
5356What makes a good fuzz test
5457---------------------------
5558
5659Libraries written in C that might handle untrusted data are worthwhile. The
57- more complex the logic (e.g. parsing), the more likely this is to be a useful
60+ more complex the logic (e.g., parsing), the more likely this is to be a useful
5861fuzz test. See the existing examples for reference, and refer to the
59- `oss-fuzz `_ docs.
62+ `OSS-Fuzz `_ docs.
6063
61- .. _ oss-fuzz : https://github.com/google/oss-fuzz
64+ .. _ OSS-Fuzz : https://github.com/google/oss-fuzz
0 commit comments