Updated the way we build AFL++ fuzz binaries
Test: Built AFL fuzzers individually and built all using haiku command
and built libfuzzers individually and also by using haiku command. Ran
selected fuzzers manually to ensure fuzzing still worked.
Description: Previously we needed to add cc_afl_fuzz to build an afl fuzz binary,
however, to turn current libFuzzers into AFL fuzzers this would required
an update to each Android.bp file which is a lot of work, and would also
require an approval from each Android.bp file owner, which is even more
work.
To get around this (and also to match how AFL fuzzers are built in G3)
we will build AFL++ fuzz binaries by command line option FUZZ_FRAMEWORK.
When FUZZ_FRAMEWORK=AFL is set, all cc_fuzz modules will be built
for AFL rather than libFuzzer. Devs can also specify if a cc_fuzz module
is only for libFuzzer or AFL by using fuzzing_frameworks. If
fuzzing_frameworks is left blank then it will be assumed that the
cc_fuzz module can be built for all available fuzzing frameworks.
Change-Id: Ia7a8224627f2de61606b410d1d1a56d7bdc0955f
diff --git a/cc/cc_test.go b/cc/cc_test.go
index 24732bf..ac1a49f 100644
--- a/cc/cc_test.go
+++ b/cc/cc_test.go
@@ -3343,8 +3343,8 @@
}
func TestAFLFuzzTarget(t *testing.T) {
- ctx := testCc(t, `
- cc_afl_fuzz {
+ bp := `
+ cc_fuzz {
name: "test_afl_fuzz_target",
srcs: ["foo.c"],
host_supported: true,
@@ -3354,17 +3354,10 @@
shared_libs: [
"afl_fuzz_shared_lib",
],
- }
- cc_fuzz {
- name: "test_fuzz_target",
- srcs: ["foo.c"],
- static_libs: [
- "afl_fuzz_static_lib",
- "libfuzzer_only_static_lib",
- ],
- shared_libs: [
- "afl_fuzz_shared_lib",
- ],
+ fuzzing_frameworks: {
+ afl: true,
+ libfuzzer: false,
+ },
}
cc_library {
name: "afl_fuzz_static_lib",
@@ -3409,12 +3402,19 @@
host_supported: true,
srcs: ["second_file.c"],
}
- filegroup {
+ cc_object {
name: "aflpp_driver",
+ host_supported: true,
srcs: [
"aflpp_driver.c",
],
- }`)
+ }`
+
+ testEnv := map[string]string{
+ "FUZZ_FRAMEWORK": "AFL",
+ }
+
+ ctx := android.GroupFixturePreparers(prepareForCcTest, android.FixtureMergeEnv(testEnv)).RunTestWithBp(t, bp)
checkPcGuardFlag := func(
modName string, variantName string, shouldHave bool) {
@@ -3434,31 +3434,28 @@
}
}
- for _, vnt := range ctx.ModuleVariantsForTests("libfuzzer_only_static_lib") {
- if strings.Contains(vnt, "fuzzer_afl") {
- t.Errorf("libfuzzer_only_static_lib has afl variant and should not")
- }
- }
-
moduleName := "test_afl_fuzz_target"
- variantName := "android_arm64_armv8-a_fuzzer_afl"
- checkPcGuardFlag(moduleName, variantName, true)
+ hostVariant := "linux_glibc_x86_64"
+ armVariant := "android_arm64_armv8-a"
+ checkPcGuardFlag(moduleName, armVariant+"_fuzzer", true)
+ checkPcGuardFlag(moduleName, hostVariant+"_fuzzer", true)
moduleName = "afl_fuzz_static_lib"
- variantName = "android_arm64_armv8-a_static"
- checkPcGuardFlag(moduleName, variantName, false)
- checkPcGuardFlag(moduleName, variantName+"_fuzzer", false)
- checkPcGuardFlag(moduleName, variantName+"_fuzzer_afl", true)
+ checkPcGuardFlag(moduleName, armVariant+"_static", false)
+ checkPcGuardFlag(moduleName, armVariant+"_static_fuzzer", true)
+ checkPcGuardFlag(moduleName, hostVariant+"_static", false)
+ checkPcGuardFlag(moduleName, hostVariant+"_static_fuzzer", true)
moduleName = "second_static_lib"
- checkPcGuardFlag(moduleName, variantName, false)
- checkPcGuardFlag(moduleName, variantName+"_fuzzer", false)
- checkPcGuardFlag(moduleName, variantName+"_fuzzer_afl", true)
+ checkPcGuardFlag(moduleName, armVariant+"_static", false)
+ checkPcGuardFlag(moduleName, armVariant+"_static_fuzzer", true)
+ checkPcGuardFlag(moduleName, hostVariant+"_static", false)
+ checkPcGuardFlag(moduleName, hostVariant+"_static_fuzzer", true)
ctx.ModuleForTests("afl_fuzz_shared_lib",
"android_arm64_armv8-a_shared").Rule("cc")
ctx.ModuleForTests("afl_fuzz_shared_lib",
- "android_arm64_armv8-a_shared_fuzzer_afl").Rule("cc")
+ "android_arm64_armv8-a_shared_fuzzer").Rule("cc")
}
// Simple smoke test for the cc_fuzz target that ensures the rule compiles