MozillaSecurity / MozillaSecurity/FuzzManager
Assertion failed in TestStrings.cpp
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 208
- Forks
- 48
- Avg merge
- 23h 5m
- Merged PRs (30d)
- 2
Description
Hi,
I am trying to run FuzzManager to some fuzzing of Firefox.
I cloned and compiled Firefox using this config:
mozconfig.txt
Then to instrument the DOM I used the following instead of /dom/moz.build:
moz.build.txt
However, the the fuzzy test case is defined with the required functions (but they are empty)
Then I cloned FuzzManager, installed the server dependencies, installed it with the setup.py install.
Then, I run the server with python manage.py runserver from the /server/ folder.
Finally, I run the fuzzer with the following command, as suggested here:
MOZ_RUN_GTEST=1 LIBFUZZER=1 FUZZER=Dom python ~/FuzzManager/misc/afl-libfuzzer/afl-libfuzzer-daemon.py --fuzzmanager --stats libfuzzer-dom.stats --libfuzzer-auto-reduce-min 500 --libfuzzer-auto-reduce 30 --tool libfuzzer-dom --libfuzzer --libfuzzer-instances 6 ~/mozilla-central/objdir-ff-asan/dist/bin/firefox -max_len=256 -use_value_profile=1 -rss_limit_mb=3000 corpus-dom
And this is the stderr and stdout I get:
Could you help me to understand why the assertion is failing? Shouldn't that go through without errors?
Can I use the FuzzManager in a way I can exclude all the other tests and run only a list of tests?
How to run only one test fuzzer?
Thanks!
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the assertion named in TestStrings.cpp, then compare the attached out.txt and err.txt with the Firefox build and fuzzing command shown here. Verify whether the failure comes from the instrumented DOM setup or the FuzzManager daemon, and determine how a single selected fuzzer or test can be run. Done means the assertion cause and supported selective-run procedure are documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, python
- Domain
- security, testing-qa
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100