Closes #28971
In addition to the benefits listed in #28971, this should also enable us to use https://github.com/ossf/fuzz-introspector provided by oss-fuzz. Our current runtime harness selection blocks introspector’s static analysis from working properly (e.g. it can’t statically determine which functions are reachable by a given harness).
This PR uses the approach suggested here: #29010 (comment). The list of available harnesses is determined (prior to compiling) by grepping for harness names in FUZZ_TARGET
invocations. When compiling with -DBUILD_INDIVIDUAL_FUZZ_BINARIES=ON
, individual binaries for each harness are produced that no longer include the runtime lookup via the FUZZ
environment variable.
0cmake -B build_fuzz \
1 -DBUILD_FOR_FUZZING=ON \
2 -DBUILD_INDIVIDUAL_FUZZ_BINARIES=ON \
3 -DSANITIZERS=fuzzer
4cmake --build build_fuzz
build_fuzz/src/test/fuzz
will contain the individual binaries, which are prefixed with fuzz_*
.
I’m opening this now to get some early feedback, there are still a few things to address:
- mention
-DBUILD_INDIVIDUAL_FUZZ_BINARIES
in the docs - include wallet harnesses
- CI job that builds individual binaries (perhaps verify that the list of produced harnesses matches the monolithic binary)