afl++ timeouts not reported
- Dominant language
- Shell
- Stars
- 12.6k
- Forks
- 2.9k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 62
Description
We (bitcoin-core) have a couple targets that spawn threads prior to calling `__AFL_INIT` which then leads to timeouts in targets that use those threads in the main loop. While we should fix this behavior on our end (i.e. don't spawn those threads that early, https://github.com/bitcoin/bitcoin/issues/28469), it is interesting that oss-fuzz never reported these timeouts to us.
To observe the timeouts:
```
python infra/helper.py run_fuzzer --engine afl bitcoin-core process_messages
```
My speculative theory of what might be happening here is that oss-fuzz does not report the timeouts because they don't reproduce using libFuzzer (I don't know much about oss-fuzz internals, so that could be completely wrong).
Contributor guide
Research direction
Start with infra/helper.py run_fuzzer --engine afl bitcoin-core process_messages to reproduce the reported timeout. Compare the AFL and libFuzzer execution paths and determine why the timeout is not surfaced; done means the reporting behavior and its cause are established, with a reproducible regression check if a fix is identified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- testing
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100