MozillaSecurity / MozillaSecurity/FuzzManager

Assertion failed in TestStrings.cpp

Open
#521 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
208
Forks
48
Avg merge
23h 5m
Merged PRs (30d)
2

Description

Hi,

I am trying to run FuzzManager to some fuzzing of Firefox.

I cloned and compiled Firefox using this config:
mozconfig.txt

Then to instrument the DOM I used the following instead of /dom/moz.build:
moz.build.txt
However, the the fuzzy test case is defined with the required functions (but they are empty)

Then I cloned FuzzManager, installed the server dependencies, installed it with the setup.py install.

Then, I run the server with python manage.py runserver from the /server/ folder.
Finally, I run the fuzzer with the following command, as suggested here:

MOZ_RUN_GTEST=1 LIBFUZZER=1 FUZZER=Dom python ~/FuzzManager/misc/afl-libfuzzer/afl-libfuzzer-daemon.py --fuzzmanager     --stats libfuzzer-dom.stats --libfuzzer-auto-reduce-min 500 --libfuzzer-auto-reduce 30     --tool libfuzzer-dom --libfuzzer --libfuzzer-instances 6 ~/mozilla-central/objdir-ff-asan/dist/bin/firefox     -max_len=256 -use_value_profile=1 -rss_limit_mb=3000 corpus-dom

And this is the stderr and stdout I get:

out.txt
err.txt

Could you help me to understand why the assertion is failing? Shouldn't that go through without errors?
Can I use the FuzzManager in a way I can exclude all the other tests and run only a list of tests?
How to run only one test fuzzer?

Thanks!

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the assertion named in TestStrings.cpp, then compare the attached out.txt and err.txt with the Firefox build and fuzzing command shown here. Verify whether the failure comes from the instrumented DOM setup or the FuzzManager daemon, and determine how a single selected fuzzer or test can be run. Done means the assertion cause and supported selective-run procedure are documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, python
Domain
security, testing-qa
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.