2-fuzz.sh (1453B)
1 #!/bin/bash 2 set -exuo pipefail 3 4 # A short, *bounded* fuzz run: this job has to finish in seconds, not 5 # hours, so that a regression is caught in the pull request rather than 6 # the next morning. Long, corpus-accumulating sessions are a different 7 # thing entirely and are not run here. 8 # 9 # MHD_FUZZ_ITERATIONS, MHD_FUZZ_SEED, MHD_FUZZ_MIN_DISCIPLINE and 10 # MHD_FUZZ_MIN_MEM_LIMIT are ordinary make variables of 11 # src/fuzz/Makefile.am and can be overridden on the command line. The 12 # defaults cover the full discipline and memory-limit range. 13 # 14 # Every run is exactly reproducible from (harness, seed), so the seed is 15 # pinned here. Point MHD_CI_FUZZ_SEED at $RANDOM in a nightly job if a 16 # varying seed is wanted; a failure then prints a copy-pasteable replay 17 # command. 18 19 FUZZ_ITERATIONS="${MHD_CI_FUZZ_ITERATIONS:-20000}" 20 FUZZ_SEED="${MHD_CI_FUZZ_SEED:-1}" 21 22 make -C src/fuzz check \ 23 MHD_FUZZ_ITERATIONS="${FUZZ_ITERATIONS}" \ 24 MHD_FUZZ_SEED="${FUZZ_SEED}" 25 26 # Replay the whole committed seed corpus - including 27 # corpus/known-findings/, the reproducers of src/fuzz/README section 6 - 28 # through every harness. This is the part that proves a fixed crash 29 # stays fixed, and it is cheap. 30 # 31 # It only means something because 1-build.sh configures --enable-asserts: 32 # most of those reproducers trip an mhd_assert(), which compiles away 33 # without it, so on a default build they would pass whether MHD is fixed 34 # or not. 35 make -C src/fuzz check-corpus