google / google/oss-fuzz

afl++ timeouts not reported

Open
#10,950 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
12.6k
Forks
2.9k
Avg merge
2d 2h
Merged PRs (30d)
62

Description

We (bitcoin-core) have a couple targets that spawn threads prior to calling `__AFL_INIT` which then leads to timeouts in targets that use those threads in the main loop. While we should fix this behavior on our end (i.e. don't spawn those threads that early, https://github.com/bitcoin/bitcoin/issues/28469), it is interesting that oss-fuzz never reported these timeouts to us.

To observe the timeouts:
```
python infra/helper.py run_fuzzer --engine afl bitcoin-core process_messages
```

My speculative theory of what might be happening here is that oss-fuzz does not report the timeouts because they don't reproduce using libFuzzer (I don't know much about oss-fuzz internals, so that could be completely wrong).

Contributor guide

Open the contributing guide

Research direction

Start with infra/helper.py run_fuzzer --engine afl bitcoin-core process_messages to reproduce the reported timeout. Compare the AFL and libFuzzer execution paths and determine why the timeout is not surfaced; done means the reporting behavior and its cause are established, with a reproducible regression check if a fix is identified.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
testing
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.