33
44# Continuous Fuzzing for Golang Example
55
6- This is an example of how to integrate your [ go-fuzz] ( https://github.com/dvyukov/go-fuzz ) targets with
6+ This is an example of how to integrate your [ go-fuzz] ( https://github.com/dvyukov/go-fuzz ) targets with the
77[ Fuzzit] ( https://fuzzit.dev ) Continuous Fuzzing Platform (Go support is currently in Alpha).
88
99This example will show the following steps:
10- * [ Building and running locally a simple go-fuzz target] ( #building-go-fuzz-target )
10+ * [ Building and running a simple go-fuzz target locally ] ( #building-go-fuzz-target )
1111* [ Integrate the go-fuzz target with Fuzzit via Travis-CI] ( #integrating-with-fuzzit-from-ci )
1212
1313Result:
14- * Fuzzit will run the fuzz targets continuously on daily basis with the latest release.
14+ * Fuzzit will run the fuzz targets continuously on a daily basis with the latest release.
1515* Fuzzit will run sanity tests on every pull-request with the generated corpus and crashes to catch bugs early on.
1616
17- Fuzzing for go can both help find complex bugs as well as correctness bugs. Go is a safe language so memory corruption bugs
18- are very unlikely to happen but some bugs can still have security [ implications] ( https://blog.cloudflare.com/dns-parser-meet-go-fuzzer/ ) .
17+ Fuzzing for go can help find both complex bugs, as well as correctness bugs. Go is a safe language so memory corruption bugs
18+ are very unlikely to happen, but some bugs can still have security [ implications] ( https://blog.cloudflare.com/dns-parser-meet-go-fuzzer/ ) .
1919
20- This tutorial is less about how to build go-fuzz targets but more about how to integrate the targets with Fuzzit. A lot of
20+ This tutorial focuses less on how to build go-fuzz targets and more on how to integrate the targets with Fuzzit. A lot of
2121great information is available at the [ go-fuzz] ( https://github.com/dvyukov/go-fuzz ) repository.
2222
2323## Building go-fuzz Target
2424
25- The targets that are currently supported on Fuzzit is targets that utilize the libFuzzer engine. This is why we will
26- use the ` -libfuzzer ` flag of go-fuzz and compile it on Linux machine (should be also supported on mac in the future)
25+ The targets that are currently supported on Fuzzit are targets that utilize the libFuzzer engine. This is why we will
26+ use the ` -libfuzzer ` flag of go-fuzz and compile it on a Linux machine (should also be supported on mac in the future)
2727
2828### Understanding the bug
2929
30- The bug is located at ` parser_complex.go ` with the following code
30+ The bug is located at ` parser_complex.go ` in the following code
3131
3232``` go
3333package parser
@@ -42,12 +42,12 @@ func ParseComplex(data [] byte) bool {
4242}
4343```
4444
45- This is the simplest example to demonstrate a classic off-by-one/out-of-bound error which causes the program to crash.
45+ This is the simplest example to demonstrate a classic off-by-one/out-of-bounds error which causes the program to crash.
4646Instead of ` len(data) == 5 ` the correct code will be ` len(data) == 6 ` .
4747
4848### Understanding the fuzzer
4949
50- the fuzzer is located at ` parse_complex_fuzz.go ` with the following code:
50+ the fuzzer is located at ` parse_complex_fuzz.go ` in the following code:
5151
5252``` go
5353// +build gofuzz
@@ -140,21 +140,21 @@ Base64: RlVaWkk=
140140
141141## Integrating with Fuzzit from CI
142142
143- The best way to integrate with Fuzzit is by adding a two stages in your Contintous Build system
143+ The best way to integrate with Fuzzit is by adding a two stages in your Continuous Build system
144144(like Travis CI or Circle CI).
145145
146146Fuzzing stage:
147147
148148* build a fuzz target
149149* download ` fuzzit ` cli
150150* authenticate with ` fuzzit auth `
151- * create a fuzzing job by uploading fuzz target
151+ * create a fuzzing job by uploading the fuzz target
152152
153153Sanity stage
154154* build a fuzz target
155155* download ` fuzzit ` cli
156156* authenticate with ` fuzzit auth `
157- * create a local sanity fuzzing job - This will pull all the generated corpus and run them through
157+ * create a local sanity fuzzing job - This will pull all the generated corpuses and run them through
158158the fuzzing binary. If new bugs are introduced this will fail the CI and alert
159159
160160here is the relevant snippet from the [ ./ci/fuzzit.sh] ( https://github.com/fuzzitdev/example-go/blob/master/ci/fuzzit.sh )
@@ -169,18 +169,18 @@ export TARGET_ID=2n6hO2dQzylLxX5GGhRG
169169```
170170
171171NOTE: In production it is advised to download a pinned version of the [ CLI] ( https://github.com/fuzzitdev/fuzzit )
172- like in the example. In development you can use latest version:
172+ like in the example. In development you can use the latest version:
173173https://github.com/fuzzitdev/fuzzit/releases/latest/download/fuzzit_${OS}_${ARCH} .
174174Valid values for ` ${OS} ` are: ` Linux ` , ` Darwin ` , ` Windows ` .
175175Valid values for ` ${ARCH} ` are: ` x86_64 ` and ` i386 ` .
176176
177177The steps are:
178- * Authenticate with the API key (you should keep this secret) you can find in the fuzzit settings dashboard.
179- * Upload the fuzzer via create job command and create the fuzzing job. In This example we use two type of jobs:
180- * Fuzzing job which is run on every push to master which continuous the previous job just with the new release.
181- Continuous means all the current corpus is kept and the fuzzer will try to find new paths in the newly added code
182- * In a Pull-Request the fuzzer will run a quick "sanity" test running the fuzzer through all the generated corpus
178+ * Authenticate with the API key (you should keep this secret) from the fuzzit settings dashboard.
179+ * Upload the fuzzer via ` create job ` command and create the fuzzing job. In This example we use two type of jobs:
180+ * A fuzzing job which is run on every push to master, that continues the previous job with the new release.
181+ This means the current corpus is kept and the fuzzer will try to find new paths in the newly added code.
182+ * In a Pull-Request the fuzzer will run a quick "sanity" test running the fuzzer through all the generated corpuses
183183 and crashes to see if the Pull-Request doesnt introduce old or new crashes. This will be alred via the configured
184- channel in the dashboard
184+ channel in the dashboard.
185185* The Target is not a secret. This ID can be retrieved from the dashboard after your create the appropriate target in the dashboard.
186- Each target has it's own corpus and crashes.
186+ Each target has its own corpus and crashes.
0 commit comments