# Fuzzing

Crosvm contains several [fuzz testing](https://en.wikipedia.org/wiki/Fuzzing) programs that are
intended to exercise specific subsets of the code with automatically generated inputs to help
uncover bugs that were not found by human-written unit tests.

The source code for the fuzzer target programs can be found in [`fuzz/fuzz_targets`] in the crosvm
source tree.

## OSS-Fuzz

Crosvm makes use of the OSS-Fuzz service, which automatically builds and runs fuzzers for many open
source projects. Once a crosvm change is committed and pushed to the main branch, it will be tested
automatically by [ClusterFuzz], and if new issues are found, a bug will be filed.

- [crosvm oss-fuzz configuration]
- [crosvm oss-fuzz build status]

## Running fuzzers locally

It can be useful to run a fuzzer in order to test new changes locally or to reproduce a bug filed by
ClusterFuzz.

To build and run a specific fuzz target, install [`cargo fuzz`], then run it in the crosvm source
tree, specifying the desired fuzz target to run. If you have a testcase provided by the automated
fuzzing infrastructure in a bug report, you can add that file to the fuzzer command line to
reproduce the same fuzzer execution rather than using randomly generating inputs.

```sh
# Run virtqueue_fuzzer with randomly-generated input.
# This will run indefinitely; it can be stopped with Ctrl+C.
cargo +nightly fuzz run virtqueue_fuzzer

# Run virtqueue_fuzzer with a specific input file from ClusterFuzz.
cargo +nightly fuzz run virtqueue_fuzzer clusterfuzz-testcase-minimized-...
```

[clusterfuzz]: https://google.github.io/clusterfuzz/
[crosvm oss-fuzz build status]: https://oss-fuzz-build-logs.storage.googleapis.com/index.html#crosvm
[crosvm oss-fuzz configuration]: https://github.com/google/oss-fuzz/tree/master/projects/crosvm
[`cargo fuzz`]: https://github.com/rust-fuzz/cargo-fuzz
[`fuzz/fuzz_targets`]: https://chromium.googlesource.com/crosvm/crosvm/+/refs/heads/main/fuzz/fuzz_targets/