Merge bitcoin/bitcoin#33921: doc: clarify and cleanup macOS fuzzing notes

c34bc01b2f doc: clarify and cleanup macOS fuzzing notes (dergoegge)

Pull request description:

  * Remove or consolidate macOS notes sprinkled throughout the doc into dedicated section
  * Note that support for fuzzing on macOS is not maintained

  Closes #33731

ACKs for top commit:
  frankomosh:
    ACK c34bc01
  janb84:
    Concept ACK  c34bc01b2f
  darosior:
    reACK c34bc01b2f
  brunoerg:
    ACK c34bc01b2f
  rkrux:
    ACK c34bc01b2f
  ismaelsadeeq:
    reACK c34bc01b2f

Tree-SHA512: 76a79a102b4941b31bd05b65aa37beb0f48d8bb7b07f4ec2fa55be7e6b4880ce7031fe9a7764984dbd879bf6238dc61689006a9225deee39b8b759722078b808
This commit is contained in:
merge-script committed 2025-11-25 16:26:05 +00:00
commit 1a5f1eb080
1 file changed
+9 -27
+9 -27
View File
@@ -8,8 +8,6 @@ To quickly get started fuzzing Bitcoin Core using [libFuzzer](https://llvm.org/d
$ git clone https://github.com/bitcoin/bitcoin $ git clone https://github.com/bitcoin/bitcoin
$ cd bitcoin/ $ cd bitcoin/
$ cmake --preset=libfuzzer $ cmake --preset=libfuzzer
# macOS users: If you have problem with this step then make sure to read "macOS hints for
# libFuzzer" on https://github.com/bitcoin/bitcoin/blob/master/doc/fuzzing.md#macos-hints-for-libfuzzer
$ cmake --build build_fuzz $ cmake --build build_fuzz
$ FUZZ=process_message build_fuzz/bin/fuzz $ FUZZ=process_message build_fuzz/bin/fuzz
# abort fuzzing using ctrl-c # abort fuzzing using ctrl-c
@@ -23,6 +21,9 @@ There is also a runner script to execute all fuzz targets. Refer to
For source-based coverage reports, see [developer notes](/doc/developer-notes.md#compiling-for-fuzz-coverage). For source-based coverage reports, see [developer notes](/doc/developer-notes.md#compiling-for-fuzz-coverage).
macOS users: We recommend fuzzing on Linux, see [macOS notes](#macos-notes) for
more information.
## Overview of Bitcoin Core fuzzing ## Overview of Bitcoin Core fuzzing
[Google](https://github.com/google/fuzzing/) has a good overview of fuzzing in general, with contributions from key architects of some of the most-used fuzzers. [This paper](https://agroce.github.io/bitcoin_report.pdf) includes an external overview of the status of Bitcoin Core fuzzing, as of summer 2021. [John Regehr](https://blog.regehr.org/archives/1687) provides good advice on writing code that assists fuzzers in finding bugs, which is useful for developers to keep in mind. [Google](https://github.com/google/fuzzing/) has a good overview of fuzzing in general, with contributions from key architects of some of the most-used fuzzers. [This paper](https://agroce.github.io/bitcoin_report.pdf) includes an external overview of the status of Bitcoin Core fuzzing, as of summer 2021. [John Regehr](https://blog.regehr.org/archives/1687) provides good advice on writing code that assists fuzzers in finding bugs, which is useful for developers to keep in mind.
@@ -183,29 +184,14 @@ There are 3 ways fuzz tests can be built:
tests would not be useful. This build is only useful for ensuring fuzz tests tests would not be useful. This build is only useful for ensuring fuzz tests
compile and link. compile and link.
## macOS hints for libFuzzer ## macOS notes
The default Clang/LLVM version supplied by Apple on macOS does not include Support for fuzzing on macOS is not officially maintained by this project. If
fuzzing libraries, so macOS users will need to install a full version, for you are running into issues on macOS, we recommend fuzzing on Linux instead for
example using `brew install llvm`. best results. On macOS this can be done within Docker or a virtual machine.
You may also need to take care of giving the correct path for `clang` and Reproducing and debugging fuzz testcases on macOS is supported, by building the
`clang++`, like `CC=/path/to/clang CXX=/path/to/clang++` if the non-systems fuzz binary without support for any specific fuzzing engine.
`clang` does not come first in your path.
Using `lld` is required due to issues with Apple's `ld` and `LLVM`.
Full configuration step for macOS:
```sh
$ brew install llvm lld
$ cmake --preset=libfuzzer \
-DCMAKE_C_COMPILER="$(brew --prefix llvm)/bin/clang" \
-DCMAKE_CXX_COMPILER="$(brew --prefix llvm)/bin/clang++" \
-DCMAKE_EXE_LINKER_FLAGS="-fuse-ld=lld"
```
Read the [libFuzzer documentation](https://llvm.org/docs/LibFuzzer.html) for more information. This [libFuzzer tutorial](https://github.com/google/fuzzing/blob/master/tutorial/libFuzzerTutorial.md) might also be of interest.
# Fuzzing Bitcoin Core using afl++ # Fuzzing Bitcoin Core using afl++
@@ -225,10 +211,6 @@ $ cmake -B build_fuzz \
-DCMAKE_CXX_COMPILER="$(pwd)/AFLplusplus/afl-clang-lto++" \ -DCMAKE_CXX_COMPILER="$(pwd)/AFLplusplus/afl-clang-lto++" \
-DBUILD_FOR_FUZZING=ON -DBUILD_FOR_FUZZING=ON
$ cmake --build build_fuzz $ cmake --build build_fuzz
# For macOS you may need to ignore x86 compilation checks when running "cmake --build". If so,
# try compiling using: AFL_NO_X86=1 cmake --build build_fuzz
# Also, it might be required to run "afl-system-config" to adjust the shared
# memory parameters.
$ mkdir -p inputs/ outputs/ $ mkdir -p inputs/ outputs/
$ echo A > inputs/thin-air-input $ echo A > inputs/thin-air-input
$ FUZZ=bech32 ./AFLplusplus/afl-fuzz -i inputs/ -o outputs/ -- build_fuzz/bin/fuzz $ FUZZ=bech32 ./AFLplusplus/afl-fuzz -i inputs/ -o outputs/ -- build_fuzz/bin/fuzz