How to use LibFuzz on a C project that is not a library

Question

I am trying to run libFuzz on a C project that usually compiles to an executable. The examples I found for libFuzz almost exclusively link with a library, i.e. a mylibary.a file. So I compiled the project with the normal Makefile, and combined the generated object files into a library with ar rcs a.o b.o etc.. Now I want to link this library file with the fuzzing target using clang++, but the linker is not able to find the implementation of the function I want to fuzz. The command I use for linking inside the src directory of the project is clang++ -Wall -fsanitize=fuzzer -Wno-cpp -Wpedantic -std=c++11 -O2 -g  -I/usr/include/libxml2 -g -O2 -rdynamic  -o fuzzing libmylib.a fuzztarget.cc -lcurl -lxml2 -I. The error I get is "Undefined reference to function_xy()" So the compiler finds the import of the function but not the implementation of it. I am new to clang and generally building complex C projects so all help is greatly appreciated. Thank you!

I tried compiling the project with the included Makefile, then combining the generated object files into a .a library and finally linking the library with my fuzzing target.

Answer 1

I found the solution and want to provide it for people with the same problem as me. I had to edit the Makefiles of the project to compile it correctly with the Fuzzer. More specifically, I changed the compiler to clang, modified the compiler flags (CFLAGs) to -fsanitize=fuzzer-no-link to prevent it from linking with the main file of the project. Finally, I changed the linker flags (DFLAGs) to include the fuzzer with -fsanitize=fuzzer,address.

Answer 2

The error you got is about linking, not the LibFuzzer. If you can compile and link your file without implementing function in LLVMFuzzerTestOneInput, then the fuzz-target should work: Include header in your code, call the function, compile file and link with libraries. Please check the order of include path, file, linked libraries. Be careful with the option of optimization (-O2), sometimes the fuzzer does not give crash with this option.