No public description

centipede/BUILD

@@ -979,8 +979,6 @@ cc_library(
     name = "engine_worker",
     srcs = [
         "engine_worker.cc",
-        "runner_utils.cc",
-        "runner_utils.h",
     ],
     hdrs = ["engine_worker_abi.h"],
     deps = [
@@ -989,6 +987,7 @@ cc_library(
         ":feature",
         ":runner_request",
         ":runner_result",
+        ":runner_utils",
         ":shared_memory_blob_sequence",
         "@abseil-cpp//absl/base:nullability",
         "@com_google_fuzztest//common:defs",
@@ -1215,8 +1214,6 @@ cc_library(
         "reverse_pc_table.h",
         "runner_dl_info.cc",
         "runner_dl_info.h",
-        "runner_utils.cc",
-        "runner_utils.h",
         "sancov_callbacks.cc",
         "sancov_interceptors.cc",
         "sancov_object_array.cc",
@@ -1238,6 +1235,7 @@ cc_library(
         ":foreach_nonzero",
         ":int_utils",
         ":runner_cmp_trace",
+        ":runner_utils",
         "@abseil-cpp//absl/base:core_headers",
         "@abseil-cpp//absl/base:nullability",
         "@abseil-cpp//absl/numeric:bits",
@@ -2000,3 +1998,23 @@ sh_test(
         ":test_util_sh",
     ],
 )
+
+cc_library(
+    name = "runner_utils",
+    srcs = ["runner_utils.cc"],
+    hdrs = ["runner_utils.h"],
+    copts = DISABLE_SANCOV_COPTS,
+    deps = [
+        "@abseil-cpp//absl/base:nullability",
+    ],
+)
+
+cc_static_library(
+    name = "centipede_engine_static",
+    deps = [
+        ":engine_controller_with_subprocess",
+        ":engine_worker",
+        ":sancov_runtime",
+        ":weak_sancov_stubs",
+    ],
+)

rust/.rustfmt.toml

@@ -0,0 +1,3 @@
+use_field_init_shorthand = true
+use_try_shorthand = true
+edition = "2021"

rust/BUILD

@@ -0,0 +1,44 @@
+load("//third_party/bazel_rules/rules_rust/rust:defs.bzl", "rust_library", "rust_test")
+
+licenses(["notice"])
+
+exports_files(["BUILD"])
+
+rust_library(
+    name = "fuzztest",
+    srcs = glob([
+        "src/**/*.rs",
+    ]),
+    edition = "2024",
+    proc_macro_deps = [
+        "@com_google_fuzztest//rust/fuzztest_macro:fuzztest_macro",
+    ],
+    rustc_flags = ["-Zallow-features=cfg_sanitize"],
+    visibility = ["__subpackages__"],
+    deps = [
+        "//third_party/rust/anyhow/v1:anyhow",
+        "//third_party/rust/clap/v4:clap",
+        "//third_party/rust/humantime/v2:humantime",
+        "//third_party/rust/inventory/v0_3:inventory",
+        "//third_party/rust/num_traits/v0_2:num_traits",
+        "//third_party/rust/postcard/v1:postcard",
+        "//third_party/rust/rand/v0_10:rand",
+        "//third_party/rust/serde/v1:serde",
+        "//third_party/rust/spin/v0_10:spin",
+        "//third_party/rust/tempfile/v3:tempfile",
+        "@com_google_fuzztest//rust/coverage",
+        "@com_google_fuzztest//rust/engine",
+    ],
+)
+
+rust_test(
+    name = "fuzztest_test",
+    # Avoid interference when setting/resetting environment variables in tests.
+    args = ["--test-threads=1"],
+    crate = ":fuzztest",
+    edition = "2024",
+    rustc_flags = ["-Zallow-features=cfg_sanitize"],
+    deps = [
+        "//third_party/gtest_rust/googletest",
+    ],
+)

rust/Cargo.toml

@@ -0,0 +1,37 @@
+[package]
+name = "fuzztest"
+version = "0.1.0"
+edition = "2024"
+
+[[test]]
+name = "trybuild"
+path = "tests/trybuild.rs"
+
+[dependencies]
+anyhow = "1.0.100"
+fuzztest-macro = { path = "fuzztest_macro" }
+inventory = "0.3.20"
+num-traits = "0.2"
+postcard = { version = "1.0.0", features = ["use-std"] }
+rand = { version = "0.10.1", features = ["std_rng"] }
+serde = { version = "1.0", features = ["derive"] }
+coverage = { path = "coverage" }
+engine = { path = "engine", package = "engine-ffi" }
+spin = "0.10.0"
+tempfile = "3.27.0"
+clap = { version = "4.6.1", features = ["derive", "env"] }
+humantime = "2.4.0"
+
+[dev-dependencies]
+googletest = "0.14.3"
+
+[dev-dependencies.trybuild]
+version = "1.0.103"
+features = ["diff"]
+
+[profile.fuzztest]
+inherits = 'release'
+panic = 'abort'
+opt-level = "s"
+debug = true
+split-debuginfo = "packed"

rust/README.md

@@ -0,0 +1,57 @@
+# FuzzTest Rust
+
+A framework for fuzzing Rust projects using Google FuzzTest.
+
+## Prerequisites
+
+1.  Clone the repository.
+2.  Build the C++ Centipede static library engine using Bazel (from the
+    repository root):
+
+    ```bash
+    cd /path/to/fuzztest
+    bazel build //centipede:centipede_engine_static
+    ```
+
+## Setup a Project
+
+1.  Create a new Rust project:
+
+    ```bash
+    cargo new my_fuzz_project --bin
+    ```
+
+2.  Add `fuzztest` as a dependency in your `Cargo.toml`:
+
+    ```toml
+    [dependencies]
+    fuzztest = { path = "/path/to/fuzztest/rust" }
+    ```
+
+## Write a Fuzz Test
+
+In `src/main.rs`:
+
+```rust
+#[cfg(test)]
+mod tests {
+    use fuzztest::domains::arbitrary::Arbitrary;
+    use fuzztest::fuzztest;
+
+    #[fuzztest(a = Arbitrary::<i32>::default(), b = Arbitrary::<i32>::default())]
+    fn test_addition(a: i32, b: i32) {
+        let _ = a.wrapping_add(b);
+    }
+}
+```
+
+## Build and Run Fuzz Tests
+
+To run the fuzz tests, you must specify:
+
+-   `CENTIPEDE_BIN_DIR`: The directory containing the compiled C++ static
+    libraries (i.e. `bazel-bin/centipede`).
+
+```bash
+CENTIPEDE_BIN_DIR=/path/to/fuzztest/bazel-bin/centipede cargo test __fuzztest_mod__::test_addition
+```

rust/coverage/BUILD

@@ -0,0 +1,34 @@
+load("//third_party/bazel_rules/rules_rust/rust:defs.bzl", "rust_library", "rust_test")
+
+licenses(["notice"])
+
+rust_library(
+    name = "coverage",
+    srcs = [
+        "src/coverage.rs",
+        "src/lib.rs",
+    ],
+    cc_deps = [
+        "@com_google_fuzztest//centipede:sancov_runtime",
+    ],
+    visibility = ["@com_google_fuzztest//rust:__subpackages__"],
+)
+
+rust_test(
+    name = "coverage_test",
+    # Avoid interference on coverage collection between threads.
+    args = ["--test-threads=1"],
+    crate = ":coverage",
+    env = {
+        "CENTIPEDE_RUNNER_FLAGS": ":use_cmp_features:",
+    },
+    # TODO: b/437896409 - Replace with global config once it's available.
+    rustc_flags = [
+        "-Cpasses=sancov-module",
+        "-Cllvm-args=-sanitizer-coverage-level=1",
+        "-Cllvm-args=-sanitizer-coverage-trace-compares",
+    ],
+    deps = [
+        "//third_party/gtest_rust/googletest",
+    ],
+)

rust/coverage/Cargo.toml

@@ -0,0 +1,6 @@
+[package]
+name = "coverage"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]

rust/coverage/src/coverage.rs

@@ -0,0 +1,78 @@
+use std::slice;
+
+#[repr(C)]
+pub struct SanCovRuntimeRawFeatureParts {
+    // Safety invariant: The only way to receive this type is through `SanCovRuntimeGetCoverage()`
+    // which guarantees that `ptr` always points to a valid slice of `size` elements.
+    ptr: *const u64,
+    size: usize,
+}
+
+impl SanCovRuntimeRawFeatureParts {
+    /// # Safety
+    ///
+    /// Must not be held on when its data has to be mutated. For example, do not hold on to it
+    /// when calling `SanCovRuntimeGetCoverage()`.
+    pub unsafe fn as_slice(&self) -> &[u64] {
+        // Safety: self ensures that `ptr` always points to a valid slice of `size` elements.
+        unsafe { slice::from_raw_parts(self.ptr, self.size) }
+    }
+}
+
+unsafe extern "C" {
+    pub safe fn SanCovRuntimeClearCoverage(full_clear: bool);
+
+    pub safe fn SanCovRuntimeGetCoverage(reject_input: bool) -> SanCovRuntimeRawFeatureParts;
+
+    pub safe fn SanCovRuntimePostProcessCoverage(reject_input: bool);
+
+    // Exposed only for testing purposes.
+    pub safe fn __sanitizer_cov_trace_const_cmp1(Arg1: u8, Arg2: u8);
+}
+
+#[cfg(test)]
+mod test {
+    use super::*;
+    use googletest::prelude::*;
+
+    #[gtest]
+    fn should_collect_features_from_sancov_callback() {
+        SanCovRuntimeClearCoverage(true);
+
+        __sanitizer_cov_trace_const_cmp1(1, 1);
+
+        let features = SanCovRuntimeGetCoverage(false);
+        expect_false!(features.ptr.is_null());
+        expect_gt!(features.size, 0);
+    }
+
+    #[gtest]
+    fn should_not_collect_features_from_empty_user_code() {
+        SanCovRuntimeClearCoverage(true);
+
+        // An execution where sancov hooks such as
+        // `__sanitizer_cov_trace_const_cmp1` are not called.
+
+        let features = SanCovRuntimeGetCoverage(false);
+        expect_false!(features.ptr.is_null());
+        expect_eq!(features.size, 0);
+    }
+
+    #[gtest]
+    fn should_collect_features_from_user_code() {
+        let x = std::env::args().count();
+
+        SanCovRuntimeClearCoverage(true);
+
+        {
+            // An LLVM trace cmp callback is expected to be instrumented here.
+            if x == 2 {
+                std::hint::black_box(2); // To prevent dead code elimination.
+            }
+        }
+
+        let features = SanCovRuntimeGetCoverage(false);
+        expect_false!(features.ptr.is_null());
+        expect_gt!(features.size, 0);
+    }
+}

rust/coverage/src/lib.rs

@@ -0,0 +1,15 @@
+mod coverage;
+
+pub use coverage::SanCovRuntimeRawFeatureParts;
+
+pub fn prepare_coverage(full_clear: bool) {
+    coverage::SanCovRuntimeClearCoverage(full_clear)
+}
+
+pub fn get_coverage(reject_input: bool) -> SanCovRuntimeRawFeatureParts {
+    coverage::SanCovRuntimeGetCoverage(reject_input)
+}
+
+pub fn post_process_coverage(reject_input: bool) {
+    coverage::SanCovRuntimePostProcessCoverage(reject_input)
+}