A Chromium IPC fuzzer is under development by aedla and tsepez. The fuzzer lives under src/tools/ipc_fuzzer/
and is running on ClusterFuzz. A previous version of the fuzzer was a simple bitflipper, which caught around 10 bugs. A new version is doing smarter mutations and generational fuzzing. To do so, each ParamTraits<Type>
needs a corresponding FuzzTraits<Type>
. Feel free to contribute.
gn args
and add enable_ipc_fuzzer = true
to your args.gn.ipc_fuzzer_all
targettools/ipc_fuzzer/scripts/play_testcase.py path/to/testcase.ipcdump
tools/ipc_fuzzer/scripts/play_testcase.py -h
out/<Build>/ipc_message_util --dump path/to/testcase.ipcdump
tools/ipc_fuzzer/scripts/cf_package_builder.py
ipc_fuzzer_mut.zip
and ipc_fuzzer_gen.zip
under build directory to ClusterFuzztools/ipc_fuzzer/fuzzer/fuzzer.cc
enable_ipc_fuzzer = true
to args.gn
chrome
and ipc_message_dump
targets--no-sandbox --ipc-dump-directory=/path/to/ipcdump/directory
_pid_.ipcdump
Lives under ipc_fuzzer/replay
. The renderer is replaced with ipc_fuzzer_replay
using --renderer-cmd-prefix
. This is done automatically with the ipc_fuzzer/play_testcase.py
convenience script.
Lives under ipc_fuzzer/fuzzer
. This is the code that runs on ClusterFuzz. It uses FuzzTraits<Type>
to mutate ipcdumps or generate them out of thin air.
Send them to [email protected].