Meta: Update Fuzzili instructions and dockerfile since patch is upstream

This commit is contained in:
Andrew Kaster 2024-01-08 17:04:34 -07:00 committed by Andreas Kling
parent 00b24a55b1
commit 480cbd9126
Notes: sideshowbarker 2024-07-17 05:18:58 +09:00
3 changed files with 9 additions and 77 deletions

View file

@ -18,54 +18,33 @@
# but this doesn't use the same approach - that would require a fair amount of patching
# which is not worth it, unless we plan to add LibJS support to Fuzzilli upstream.
FROM fedora:33 AS serenity-build
FROM fedora:39 AS serenity-build
WORKDIR /home
RUN dnf install -y clang cmake git-core ninja-build
RUN git clone --depth=1 https://github.com/SerenityOS/serenity
RUN mkdir /home/serenity/Build
WORKDIR /home/serenity/Build
RUN sed -i 's/-Wmissing-declarations //' ../CMakeLists.txt
RUN cd serenity/Meta/Lagom && ./BuildFuzzers.sh
# In file included from ../Libraries/LibGfx/Font.cpp:37:
# ../Libraries/LibCore/FileStream.h:96:5: error: explicitly defaulted default constructor is implicitly deleted [-Werror,-Wdefaulted-function-deleted]
# InputFileStream() = default;
# ^
# -------------------------------------------------------------------
# I have no idea how to fix this, so I'll allow it. It's not relevant
# as LibJS doesn't use LibGfx; but I suppose Lagom builds it anyway.
# ¯\_(ツ)_/¯
RUN CXXFLAGS="-Wno-defaulted-function-deleted" \
cmake -GNinja \
-DBUILD_LAGOM=ON \
-DENABLE_FUZZERS_LIBFUZZER=ON \
-DCMAKE_C_COMPILER=clang \
-DCMAKE_CXX_COMPILER=clang++ \
..
RUN ninja FuzzilliJs
FROM fedora:33 AS fuzzilli-build
FROM fedora:39 AS fuzzilli-build
WORKDIR /home
RUN dnf install -y git-core patch swift-lang
RUN git clone --depth=1 https://github.com/googleprojectzero/fuzzilli
WORKDIR /home/fuzzilli
COPY --from=serenity-build /home/serenity/Meta/Lagom/Fuzzers/add-serenity-support-to-fuzzilli.patch .
RUN patch -p1 < add-serenity-support-to-fuzzilli.patch
RUN swift build -c release
FROM fedora:33
FROM fedora:39
WORKDIR /home
# This is unfortunate, but we need libswiftCore.so (and possibly other files) from the
# Swift runtime. The "swift-lang-runtime" package doesn't seem to exist in Fedora 33 :/
RUN dnf install -y swift-lang
COPY --from=serenity-build /home/serenity/Build/Meta/Lagom/Fuzzers/FuzzilliJs .
# Swift runtime. The "swift-lang-runtime" package doesn't seem to exist in Fedora :/
RUN dnf install -y swift-lang procps-ng
COPY --from=serenity-build /home/serenity/Meta/Lagom/Build/lagom-fuzzers/bin ./bin
COPY --from=serenity-build /home/serenity/Meta/Lagom/Build/lagom-fuzzers/lib64 ./lib64
COPY --from=fuzzilli-build /home/fuzzilli/.build/x86_64-unknown-linux-gnu/release/FuzzilliCli .
RUN mkdir fuzzilli-storage
ENV FUZZILLI_CLI_OPTIONS ""
CMD [ "sh", "-c", "./FuzzilliCli --profile=serenity --storagePath=fuzzilli-storage ${FUZZILLI_CLI_OPTIONS} ./FuzzilliJs" ]
CMD [ "sh", "-c", "./FuzzilliCli --profile=serenity --storagePath=fuzzilli-storage ${FUZZILLI_CLI_OPTIONS} ./bin/FuzzilliJs" ]

View file

@ -3,7 +3,6 @@
1. Download a copy of the Fuzzilli repo from https://github.com/googleprojectzero/fuzzilli
2. Install Swift and make sure it's in your path environment variable.
3. Build FuzzilliJs as you would the other fuzzers. [See ReadMe.md in the parent folder.](https://github.com/SerenityOS/serenity/blob/master/Meta/Lagom/ReadMe.md)
4. Apply the add-serenity-support-to-fuzzilli.patch patch file to the Fuzzilli root directory. ```patch -p1 < /path/to/add-serenity-support-to-fuzzilli.patch```
5. Build Fuzzilli with ```swift build -c release```
6. Run Fuzzilli with ```swift run -c release FuzzilliCli --profile=serenity /path/to/FuzzilliJs```. See ```swift run FuzzilliCli --help``` for options.

View file

@ -1,46 +0,0 @@
diff --git a/Sources/FuzzilliCli/Profiles/Profile.swift b/Sources/FuzzilliCli/Profiles/Profile.swift
index 900b4e2..c916e84 100644
--- a/Sources/FuzzilliCli/Profiles/Profile.swift
+++ b/Sources/FuzzilliCli/Profiles/Profile.swift
@@ -33,6 +33,35 @@ struct Profile {
let additionalBuiltins: [String: Type]
}
+let serenityProfile = Profile(
+ processArguments: [""],
+
+ processEnv: ["UBSAN_OPTIONS":"handle_segv=0 handle_abrt=0"],
+
+ codePrefix: """
+ function main() {
+ """,
+
+ codeSuffix: """
+ }
+ main();
+ """,
+
+ ecmaVersion: ECMAScriptVersion.es6,
+
+ crashTests: ["fuzzilli('FUZZILLI_CRASH', 0)", "fuzzilli('FUZZILLI_CRASH', 1)"],
+
+ additionalCodeGenerators: WeightedList<CodeGenerator>([]),
+
+ additionalProgramTemplates: WeightedList<ProgramTemplate>([]),
+
+ disabledCodeGenerators: [],
+
+ additionalBuiltins: [
+ "gc" : .function([] => .undefined)
+ ]
+)
+
let profiles = [
"qjs": qjsProfile,
"jsc": jscProfile,
@@ -40,4 +69,5 @@ let profiles = [
"v8": v8Profile,
"duktape": duktapeProfile,
"jerryscript": jerryscriptProfile,
+ "serenity": serenityProfile,
]