-
Notifications
You must be signed in to change notification settings - Fork 74k
/
tf_fuzzing.bzl
146 lines (118 loc) · 4.88 KB
/
tf_fuzzing.bzl
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
"""Definitions for rules to fuzz TensorFlow."""
# TensorFlow fuzzing can be done in open source too.
#
# For a fuzzer ${FUZZ} we have the following setup:
# - ${FUZZ}_fuzz.cc : the implementation of the fuzzer
# - corpus/${FUZZ}/... : public corpus for the fuzzer
# - dictionaries/${FUZZ}.dict : fuzzing dictionary for the fuzzer
# - ${FUZZ}_internal/... : internal data for the fuzzer
#
# If a fuzzer needs some framework to build, we can use the ${FUZZ}_internal/
# directory to hold the harness. Or, if the infrastructure needs to be shared
# across multiple fuzzers (for example fuzzing ops), we can store it in other
# places in TF or move it to a different folder here. We will decide on these
# on a case by case basis, for now the ops fuzzing harness resides under
# tensorflow/core/kernels/fuzzing.
#
# The internal folder can also contain proto definitions (if using proto-based
# mutators to do structure aware fuzzing) or any other type of content that is
# not classified elsewhere.
# tf_cc_fuzz_target is a cc_test modified to include fuzzing support.
def tf_fuzz_target(
name,
# Fuzzing specific arguments
fuzzing_dict = [],
corpus = [],
parsers = [],
# Reporting bugs arguments, not used in open source
componentid = None,
hotlists = [],
# Additional cc_test control
data = [],
deps = [],
tags = [],
# Remaining cc_test arguments
**kwargs):
"""Specify how to build a TensorFlow fuzz target.
Args:
name: Mandatory name of the fuzzer target.
fuzzing_dict: An optional a set of dictionary files following
the AFL/libFuzzer dictionary syntax.
corpus: An optional set of files used as the initial test corpus
for the target. When doing "bazel test" in the default null-fuzzer
(unittest) mode, these files are automatically passed to the target
function.
parsers: An optional list of file extensions that the target supports.
Used by tools like autofuzz to reuse corpus sets across targets.
componentid: Used internally for reporting fuzz discovered bugs.
hotlists: Used internally for reporting fuzz discovered bugs.
data: Additional data dependencies passed to the underlying cc_test rule.
deps: An optional list of dependencies for the code you're fuzzing.
tags: Additional tags passed to the underlying cc_test rule.
**kwargs: Collects all remaining arguments and passes them to the
underlying cc_test rule generated by the macro.
"""
componentid = None
hotlists = None
# Fuzzers in open source must be run manually
tags = tags + ["manual"]
# Now, redirect to cc_test
native.cc_test(
name = name,
deps = deps,
data = data,
tags = tags,
linkstatic = 1,
**kwargs
)
# tf_py_fuzz_target is a py_test modified to include fuzzing support.
def tf_py_fuzz_target(
name,
# Fuzzing specific arguments
fuzzing_dict = [],
corpus = [],
parsers = [],
# Reporting bugs arguments, not used in open source
componentid = None,
hotlists = [],
# Additional py_test control
python_version = None,
data = [],
deps = [],
tags = [],
# Remaining py_test arguments
**kwargs):
"""Specify how to build a TensorFlow Python fuzz target.
Args:
name: Mandatory name of the fuzzer target.
fuzzing_dict: An optional a set of dictionary files following
the AFL/libFuzzer dictionary syntax.
corpus: An optional set of files used as the initial test corpus
for the target. When doing "bazel test" in the default null-fuzzer
(unittest) mode, these files are automatically passed to the target
function.
parsers: An optional list of file extensions that the target supports.
Used by tools like autofuzz to reuse corpus sets across targets.
componentid: Used internally for reporting fuzz discovered bugs.
hotlists: Used internally for reporting fuzz discovered bugs.
python_version: Python version to run target with.
data: Additional data dependencies passed to the underlying py_test rule.
deps: An optional list of dependencies for the code you're fuzzing.
tags: Additional tags passed to the underlying py_test rule.
**kwargs: Collects all remaining arguments and passes them to the
underlying py_test rule generated by the macro.
"""
componentid = None
hotlists = None
python_version = python_version or "PY3"
# Fuzzers in open source must be run manually
tags = tags + ["manual"]
# Now, redirect to py_test
native.py_test(
name = name,
python_version = python_version,
deps = deps,
data = data,
tags = tags,
**kwargs
)