Fuzz test example

This repository contains the source code for a fuzz testing example.

It was created specifically for a presentation at the University of Catania, and is accompanied by slides used during the event.

• 📍 Event
• 📄 Slides
• ▶️ Teams Event + Video

Build the source

mkdir build
cd build
cmake .. -DCMAKE_CXX_COMPILER=clang++
cmake --build . -- -j$(nproc)

Run unit tests

cd build
./math_utils_test

Run fuzz test and read crash dump

env -u DEBUGINFOD_URLS timeout 30 ./fuzz_math_utils || echo "Fuzz test crashed or timed out"

Note

Ubuntu sets DEBUGINFOD_URLS by default. When AddressSanitizer prints the crash report, llvm-symbolizer then tries to download the binary's missing debug info from debuginfod.ubuntu.com, which can take longer than the 30s timeout: the fuzzer gets killed before writing the crash-* file. env -u DEBUGINFOD_URLS disables this lookup for a single command; to disable it permanently, add unset DEBUGINFOD_URLS to your ~/.bashrc.

There are multiple ways to read the crashdump, I strongly recommend hexdump.

# read full crash dump
hexdump crash-123456789

# read crash dump and convert hex values to decimal
hexdump -v -e '"%d, "' -e '8/1 "0x%02x, " "\n"' crash-123456789

# read crash dump via xxd
xxd crash-123456789

# read crash dump via gdb and print the a,b values (partially)
gdb ./fuzz_math_utils
run < ./crash-123456789
print a
print b