google / google/fuzztest

Fuzzer not crashing with basic string comparison

Open
#1,201 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
1.1k
Forks
137
Avg merge
3d 6h
Merged PRs (30d)
22

Description

Playing around with [codelab](https://github.com/google/fuzztest/tree/main/codelab) example I noticed fuzzer is not able to find basic string comparison crashes with input domains.

I am trying below test:
```
void StringCmp(std::string s) {
EXPECT_NE(s, "Hello");
}
FUZZ_TEST(ExpTests, StringCmp).
WithDomains(/*s:*/fuzztest::PrintableAsciiString());
```

Running this in fuzzing mode following [quickstart-cmake](https://github.com/google/fuzztest/blob/main/doc/quickstart-cmake.md#fuzzing-mode) doesn't crash whereas removing the domain constraint for `PrintableAsciiString()` followed from [here](https://github.com/google/fuzztest/blob/main/doc/domains-reference.md#string-domains), crashes instantly. Tried with `AsciiString()` domain as well and it is not crashing.
Already ran fuzzer for 5 hours (and still running...) and it's not reporting the bug whereas without domain it is able to find `"Hello"` string and crash instantly. Tried with 6a370aed314173f472b265c8196bd4810846c831, couldn't try `main` because of https://github.com/google/fuzztest/issues/1192

Seems like there might be some issue while using tokens received from string comparison instructions enabled via `-fsanitize-coverage=trace-cmp` when domains are enabled.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.