[Xen-devel] [PATCH 6/8] tools/insn-fuzz: Accept fuzzing input on stdin

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

This is rather faster for afl-fuzz to arrange than using an explicit file
parameter.  Also update the README to recommend using a tmpfs for findings_dir
which reduces disk load and is more performant.

Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
CC: Jan Beulich <JBeulich@xxxxxxxx>
CC: Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>
CC: Wei Liu <wei.liu2@xxxxxxxxxx>
---
 tools/fuzz/README.afl                             |  7 ++++--
 tools/fuzz/x86_instruction_emulator/afl-harness.c | 29 ++++++++++++++---------
 2 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/tools/fuzz/README.afl b/tools/fuzz/README.afl
index 357c3c8..c5f749a 100644
--- a/tools/fuzz/README.afl
+++ b/tools/fuzz/README.afl
@@ -25,8 +25,11 @@ Use the x86 instruction emulator fuzzer as an example.
    $ dd if=/dev/urandom of=testcase_dir/rand.bin \
        bs=`./afl-harness --min-input-size` count=1
 
+3a. use a tmpfs for findings_dir (Perf improvement and reduced disk load)
+   $ mkdir findings_dir
+   $ mount -t tmpfs -o size=512M tmpfs findings_dir
+
 4. run the fuzzer with AFL:
-   $ $AFLPATH/afl-fuzz -m none -t 1000 -i testcase_dir -o findings_dir -- \
-     ./afl-harness @@
+   $ $AFLPATH/afl-fuzz -t 1000 -i testcase_dir -o findings_dir -- ./afl-harness
 
 Please see AFL documentation for more information.
diff --git a/tools/fuzz/x86_instruction_emulator/afl-harness.c 
b/tools/fuzz/x86_instruction_emulator/afl-harness.c
index 102566c..89d8605 100644
--- a/tools/fuzz/x86_instruction_emulator/afl-harness.c
+++ b/tools/fuzz/x86_instruction_emulator/afl-harness.c
@@ -14,7 +14,7 @@ static uint8_t input[INPUT_SIZE];
 int main(int argc, char **argv)
 {
     size_t size;
-    FILE *fp;
+    FILE *fp = NULL;
 
     setbuf(stdout, NULL);
 
@@ -40,6 +40,7 @@ int main(int argc, char **argv)
             break;
 
         case '?':
+        usage:
             printf("Usage: %s $FILE | [--min-input-size]\n", argv[0]);
             exit(-1);
             break;
@@ -51,17 +52,19 @@ int main(int argc, char **argv)
         }
     }
 
-    if ( optind != (argc - 1) )
-    {
-        printf("Expecting only one argument\n");
-        exit(-1);
-    }
+    if ( optind == argc ) /* No positional parameters.  Use stdin. */
+        fp = stdin;
+    else if ( optind != (argc - 1) )
+        goto usage;
 
-    fp = fopen(argv[1], "rb");
-    if ( fp == NULL )
+    if ( fp != stdin ) /* If not using stdin, open the provided file. */
     {
-        perror("fopen");
-        exit(-1);
+        fp = fopen(argv[optind], "rb");
+        if ( fp == NULL )
+        {
+            perror("fopen");
+            exit(-1);
+        }
     }
 
     size = fread(input, 1, INPUT_SIZE, fp);
@@ -78,7 +81,11 @@ int main(int argc, char **argv)
         exit(-1);
     }
 
-    fclose(fp);
+    if ( fp != stdin )
+    {
+        fclose(fp);
+        fp = NULL;
+    }
 
     LLVMFuzzerTestOneInput(input, size);
 
-- 
2.1.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel