| # Building and running fuzzers |
| |
| In order to build fuzzers, you need the GN arg `use_libfuzzer=true`. It's also |
| recommended to build with `is_asan=true` to catch additional problems. Building |
| and running then might look like: |
| ```bash |
| gn gen out/libfuzzer --args="use_libfuzzer=true is_asan=true is_debug=false" |
| ninja -C out/libfuzzer some_fuzz_target |
| out/libfuzzer/some_fuzz_target <args> <corpus_dir> [additional corpus dirs] |
| ``` |
| |
| The arguments to the fuzzer binary should be whatever is listed in the GN target |
| description (e.g. `-max_len=1500`). These arguments may be automatically |
| scraped by Chromium's ClusterFuzz tool when it runs fuzzers, but they are not |
| built into the target. You can also look at the file |
| `out/libfuzzer/some_fuzz_target.options` for what arguments should be used. The |
| `corpus_dir` is listed as `seed_corpus` in the GN definition of the fuzzer |
| target. |
| |
