Davíð Steinn Geirsson
bb3c603172
Add a second fuzzing engine alongside the existing libFuzzer/cargo-fuzz setup. AFL++ runs with persistent mode (afl::fuzz! macro), LLVM plugins (CmpLog, IJON), and a SymCC concolic companion for hybrid fuzzing. - cargo-afl built from afl.rs with a patch for CARGO_AFL_DIR / CARGO_AFL_LLVM_DIR env-var overrides - AFL++ built with LLVM 22 plugins to match rust-nightly - Persistent-mode fuzz targets in lib/fuzz-afl/ - --jobs N parallel fuzzing: main instance in foreground, secondaries and SymCC companion as systemd transient units in a slice - Ctrl+c / exit cleans up all background processes via slice stop - AFL_AUTORESUME=1 for clean restarts after previous runs - fuzz-clean-afl collects crashes from all instance directories - Shared harness logic in lib/src/fuzz_harness.rs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
22 lines
553 B
Diff
22 lines
553 B
Diff
--- a/cargo-afl-common/src/lib.rs
|
|
+++ b/cargo-afl-common/src/lib.rs
|
|
@@ -64,11 +64,17 @@ fn pkg_version() -> String {
|
|
}
|
|
|
|
pub fn afl_dir() -> Result<PathBuf> {
|
|
- data_dir("afl")
|
|
+ if let Ok(val) = env::var("CARGO_AFL_DIR") {
|
|
+ return Ok(PathBuf::from(val));
|
|
+ }
|
|
+ data_dir("afl")
|
|
}
|
|
|
|
pub fn afl_llvm_dir() -> Result<PathBuf> {
|
|
- data_dir("afl-llvm")
|
|
+ if let Ok(val) = env::var("CARGO_AFL_LLVM_DIR") {
|
|
+ return Ok(PathBuf::from(val));
|
|
+ }
|
|
+ data_dir("afl-llvm")
|
|
}
|
|
|
|
pub fn object_file_path() -> Result<PathBuf> {
|