Skip to content

Check sigint when a worker catches an error

Eric Cornelissen requested to merge (removed):check-sigint-before-crash into master

Add a check for the sigint flag when a fuzz worker detects a crash. This fixes a bug where killing Jsfuzz during the execution of the fuzz function can cause an error as well, generating an invalid crash. This bug is particularly likely to happen if you're fuzzing a slow & blocking function.

With this change, if the sigint flag is set the worker will close gracefully. If the sigint flag is not set the worker will behave the same as before.

It should be noted that this may be considered as adding another bug. Namely, the following is now a theoretical possibility:

  1. Alice is fuzzing with Jsfuzz.
  2. A (legitimate) crash happens.
  3. Alice kills the fuzzer (using Ctrl+C).
  4. Jsfuzz reports no crash.

This scenario is strictly less likely than the existing bug. Still, I wanted to point it out as some may consider it a trade-off that's not worth it. If there are any suggestions to prevent or further reduce the chances of this new bug, I'd be more than happy to add it here.

Merge request reports