google / google/oss-fuzz

Issue 58113 (opensc): Unusable traces pointing to linked library

Open
#10,375 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
12.6k
Forks
2.9k
Avg merge
2d 2h
Merged PRs (30d)
62

Description

Lately, we received issue 58113 (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58113) with quite unusable traces

```
Direct leak of 40 byte(s) in 1 object(s) allocated from:
#0 0x5318e6 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3
#1 0x795693544c0d in CRYPTO_zalloc
```

pointing to some function from a linked library (OpenSSL). However, the issue was hidden in the actual tested project, not the linked library. Is there something that can be done about it, or is it a problem regarding the underlying `libFuzzer` engine?

Contributor guide

Open the contributing guide

Research direction

Start with OSS-Fuzz issue 10375 and the linked OSS-Fuzz report 58113, then inspect the sample trace showing allocation in OpenSSL's CRYPTO_zalloc. Determine whether the unusable trace comes from OSS-Fuzz configuration or the underlying libFuzzer engine; done means documenting the cause and a concrete way to produce traces that identify the tested project.

Written by the indexing model from the issue text.

Assessment

Domain
testing
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.