Don't set CFLAGS/CXXFLAGS/CC/CXX when building fuzzer builders
- Dominant language
- Python
- Stars
- 1.2k
- Forks
- 302
- PR merge metrics
- No merged PRs in 30d
Description
The OSS-Fuzz builder images sets these environment variables:
```
CC=clang
CXX=clang++
CFLAGS=-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
CXXFLAGS=-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -stdlib=libc++
```
In base-builder (used for standard benchmarks) we set:
CXXFLAGS=-stdlib=libc++
This is bad for two reasons:
1. It makes it easier to mess up compiling fuzzers that have weird dependencies. For example, aflsmart couldn't compile using these flags which were being used.
2. We shouldn't be compiling fuzzing engines/fuzzers with `O1`.
We can fix this problem by:
1. (for standard benchmarks) installing `libstdc++-dev` so that `libc++` doesn't need to be used.
2. (for OSS-Fuzz benchmarks) not setting these environment variables until the build is done. We could also add an image in between the actual OSS-Fuzz project image and the fuzzer builder, but we can't actually unset environment variables, we can only set them to the empty string due to a limitation in docker.
Contributor guide
Assessment
This issue has not been assessed yet.