google / google/atheris

`atheris.Fuzz` segfaults when using `atheris.instrument_all` with `@singledispatch` on 3.11.9

Open
#90 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
1.7k
Forks
127
PR merge metrics
No merged PRs in 30d

Description

I've been running atheris as part of a large scale evaluation, and have run into a few repositories which throw "failed to instrument" warnings when instrumenting and subsequently segfault. I believe I've isolated this to `@singledispatch` on 3.11:

reproducer

```python
from functools import singledispatch
import sys
import atheris

@singledispatch
def dispatched(x):
return x

def fuzz_one_input(b):
dispatched(b)

atheris.instrument_all()
atheris.Setup(sys.argv, fuzz_one_input)
atheris.Fuzz()
```

Which has produces output in part:

```python
ERROR: Failed to instrument function ._proto_hook at 0x2b2e3ed1d120>: '>' not supported between instances of 'NoneType' and 'int'
[2949/3004] 98%
ERROR: Failed to instrument function ._proto_hook at 0x2b2e3ed1d940>: '>' not supported between instances of 'NoneType' and 'int'
[2988/3004] 99%
ERROR: Failed to instrument function : '>' not supported between instances of 'NoneType' and 'int'
[2989/3004] 99%
ERROR: Failed to instrument function : '>' not supported between instances of 'NoneType' and 'int'
[2995/3004] 99%
ERROR: Failed to instrument function : '>' not supported between instances of 'NoneType' and 'int'
[3004/3004] 100%
INFO: Using built-in libfuzzer
WARNING: Failed to find function "__sanitizer_acquire_crash_state".
WARNING: Failed to find function "__sanitizer_print_stack_trace".
WARNING: Failed to find function "__sanitizer_set_death_callback".
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 3305948197
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
==2403== ERROR: libFuzzer: deadly signal
NOTE: libFuzzer has rudimentary signal handlers.
Combine libFuzzer with AddressSanitizer or similar for better crash reports.
SUMMARY: libFuzzer: deadly signal
```

This minimal reproducer exits with a libfuzzer "deadly signal", but I've seen segmentation faults more commonly in practice: `Fatal Python error: Segmentation fault`, usually after <100 examples. My guess is this crash occurs whenever atheris first produces an input which exercises an `@singledispatch` function.

I cannot reproduce this with python 3.10.14, or with `@atheris.instrument_func` on python3.11.9.

If you need a reproducer which segfaults explicitly, let me know. It's a bit fiddly to put one together. Hopefully the above is useful enough to track this down!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.