Skip to content

How To Debug Fuzzer (ASAN enabled executable)

Timur Safin edited this page Mar 28, 2023 · 1 revision
  1. Let assume you have already built fuzzer via some set of instructions given elsewhere:
CC=clang-17 \
CXX=clang++-17 \
cmake -DENABLE_ASAN=ON \
      -DENABLE_FUZZER=ON \
      -DCMAKE_BUILD_TYPE=Debug \
      ..
make -j datetime_strptime_fuzzer
  1. If you run this freshly built test/fuzz/datetime_strptime_fuzzer it crashes;

  2. Then how to debug this fuzzer in gdb so it will stop at the moment of error report, and give you chance to look around?

$ cat .gdbinit
b abort

$ ASAN_OPTIONS=abort_on_error=1 \
  gdb --args ./test/fuzz/datetime_strptime_fuzzer ./crash-24f6659811e32d67dd14bbf965dbee0c38969dcf

Where ./crash-xxxx is a file created by prior fuzzer run, at the moment of crash.

ASAN_OPTIONS=abort_on_error=1 makes ASAN to call abort() function at the moment of crash, otherwise it's being shutdown using different, not interceptible in debugger means.

Developer Guidelines ↗

Architecture

How To ...?

Recipes

Upgrade instructions

Useful links

Old discussions

Personal pages

Clone this wiki locally