fuzz: Use libFuzzer instead of afl-fuzz

This allows us to have faster fuzz cycles since the fuzzer is in-process.

1 files changed, 7 insertions, 4 deletions

diff --git a/Makefile b/Makefile
index f9b26d6..e483e02 100644
--- a/Makefile
+++ b/Makefile
@@ -68,10 +68,9 @@ test: $(EXECUTABLE)
 	./$(EXECUTABLE)
 endif
 
-fuzz:
-	@mkdir -p $(BUILD)
-	$(AFL)/afl-clang++ tests/fuzz_parse.cpp tests/allocator.cpp src/pugixml.cpp $(CXXFLAGS) -o $(BUILD)/fuzz_parse
-	$(AFL)/afl-fuzz -i tests/data_fuzz_parse -o $(BUILD)/fuzz_parse_out -x $(AFL)/testcases/_extras/xml/ -- $(BUILD)/fuzz_parse @@
+fuzz_%: $(BUILD)/fuzz_%
+	@mkdir -p build/$@
+	$< build/$@ tests/data_$*
 
 clean:
 	rm -rf $(BUILD)
@@ -87,6 +86,10 @@ build/pugixml-%: .FORCE | $(RELEASE)
 $(EXECUTABLE): $(OBJECTS)
 	$(CXX) $(OBJECTS) $(LDFLAGS) -o $@
 
+$(BUILD)/fuzz_%: tests/fuzz_%.cpp src/pugixml.cpp
+	@mkdir -p $(BUILD)
+	clang++ $(CXXFLAGS) -fsanitize=address -fsanitize-coverage=trace-pc-guard $^ libFuzzer.a -o $@
+
 $(BUILD)/%.o: %
 	@mkdir -p $(dir $@)
 	$(CXX) $< $(CXXFLAGS) -c -MMD -MP -o $@