Preloaded libFuzzer doesn't allow to use custom mutator.
- Dominant language
- Python
- Stars
- 1.7k
- Forks
- 127
- PR merge metrics
- No merged PRs in 30d
Description
Hi! We've been fuzzing with atheris and faced the problem that when we use `LD_PRELOAD=/path/to/preload/asan_with_fuzzer.so` for fuzzing with [C extensions](https://github.com/google/atheris/blob/master/native_extension_fuzzing.md), the custom mutator that is written in python code is not linked and as a result is not used.
I will demonstrate the problem on this [atheris example](https://github.com/google/atheris/blob/master/example_fuzzers/custom_mutator_example.py).
When I run the target like this: `/custom_mutator_example.py`, I get the following:
INFO: Using built-in libfuzzer
WARNING: Failed to find function "__sanitizer_acquire_crash_state".
WARNING: Failed to find function "__sanitizer_print_stack_trace".
WARNING: Failed to find function "__sanitizer_set_death_callback".
INFO: found LLVMFuzzerCustomMutator (0x7ffff767d9b0). Disabling -len_control by default.
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 352984491
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
INFO: A corpus is not provided, starting from an empty corpus
#2 INITED cov: 2 ft: 2 corp: 1/1b exec/s: 0 rss: 35Mb
And the LLVMFuzzerCustomMutator is found.
When I run `LD_PRELOAD="/usr/local/lib/python3.8/dist-packages/asan_with_fuzzer.so" /custom_mutator_example.py`, I get this:
INFO: Using preloaded libfuzzer
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 129126802
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
INFO: A corpus is not provided, starting from an empty corpus
#2 INITED cov: 2 ft: 2 corp: 1/1b exec/s: 0 rss: 44Mb
And the LLVMFuzzerCustomMutator is not found and not used.
How can I use a custom mutator while using `asan_with_fuzzer.so` for external C extensions?
Contributor guide
Assessment
This issue has not been assessed yet.