Skip to content

Fix sub_fuzzer issues found by OSS-Fuzz

Pierre-Antoine BRAMERET requested to merge pab-fix-subfuzzer into master

Credit to OSS-Fuzz

Closes #998 (closed), #999 (closed).

To reproduce locally:

  • define aliases (optional, taken from the fuzzing README): 
    # Build aliases
alias mkfuzza='./.check-in-docker.sh "mkdir -p build.asan && cd build.asan && CC=clang CFLAGS=-fsanitize=fuzzer-no-link cmake -DENABLE_FUZZING=ON - 
DCMAKE_BUILD_TYPE=RelWithDebInfo -DWITH_ASAN=1 -DWITH_UBSAN=1 .. && make -j$(nproc) fuzzers"'
# MSAN is not an option proposed by our current CMakeLists so directly use -fsanitize=memory as a C flag
alias mkfuzzm='./.check-in-docker.sh "mkdir -p build.msan && cd build.msan && CC=clang CFLAGS=-fsanitize=fuzzer-no-link cmake -DENABLE_FUZZING=ON - 
DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_C_FLAGS=-fsanitize=memory -DWITH_UBSAN=1 .. && make -j$(nproc) fuzzers"'
  • build on current master and reproduce with files attached to #998 (closed) and #999 (closed): 
    mkfuzza
build.asan/bin/sub_fuzzer /path/to/clusterfuzz-testcase-minimized-sub_fuzzer-5995303672610816
mkfuzzm
build.msan/bin/sub_fuzzer /path/to/clusterfuzz-testcase-minimized-sub_fuzzer-6194281487925248
  • checkout this branch and verify that there is no error: 
    git checkout pab-fix-subfuzzer
mkfuzza
build.asan/bin/sub_fuzzer /path/to/clusterfuzz-testcase-minimized-sub_fuzzer-5995303672610816
mkfuzzm
build.msan/bin/sub_fuzzer /path/to/clusterfuzz-testcase-minimized-sub_fuzzer-6194281487925248

Merge request reports