google / google/oss-fuzz

[lua] broken dictionary processing in Centipede

Open
#13,273 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
12.6k
Forks
2.9k
Avg merge
2d 2h
Merged PRs (30d)
62

Description

Project: Lua
Log: https://oss-fuzz-build-logs.storage.googleapis.com/log-bd7d8f76-0a04-4910-9f19-508aa8910eb2.txt

```
Step #23 - "build-check-centipede-none-x86_64": /tmp/not-out/tmpu8iz7olo/centipede --workdir=/tmp/tmpmk27ueot --corpus_dir="/tmp/fuzz_lua_corpus" --fork_server=1 --exit_on_crash=1 --timeout=1200 --rss_limit_mb=4096 --address_space_limit_mb=5120 --dictionary fuzz_lua.dict --binary="/tmp/not-out/tmpu8iz7olo/fuzz_lua"
Step #23 - "build-check-centipede-none-x86_64": I0430 06:31:55.624831 26982 environment.cc:365] --timeout_per_batch default wasn't overridden; auto-computed to be 4616 sec (see --help for details)
Step #23 - "build-check-centipede-none-x86_64": I0430 06:31:55.631664 26982 centipede.cc:177] shard=0 inputs_added=0 inputs_ignored=0 num_shard_bytes=0 shard_data.size()=0
Step #23 - "build-check-centipede-none-x86_64": I0430 06:31:55.631881 26982 centipede_interface.cc:220] Coverage dir: /tmp/tmpmk27ueot/fuzz_lua-ce5d6128477ed6243045ff61a9906edc8526d5ed; temporary dir: /tmp/centipede-26982-140463982925632
Step #23 - "build-check-centipede-none-x86_64": F0430 06:31:55.633569 26982 centipede_callbacks.cc:279] Check failed: !unpacked_dictionary.empty() Empty or corrupt dictionary file: fuzz_lua.dict
Step #23 - "build-check-centipede-none-x86_64": *** Check failure stack trace: ***
Step #23 - "build-check-centipede-none-x86_64": @ 0x555dc14475f4 absl::lts_20230125::log_internal::LogMessage::SendToLog()
Step #23 - "build-check-centipede-none-x86_64": @ 0x555dc1447353 absl::lts_20230125::log_internal::LogMessage::Flush()
Step #23 - "build-check-centipede-none-x86_64": @ 0x555dc1447989 absl::lts_20230125::log_internal::LogMessageFatal::~LogMessageFatal()
Step #23 - "build-check-centipede-none-x86_64": @ 0x555dc140d2be centipede::CentipedeCallbacks::LoadDictionary()
Step #23 - "build-check-centipede-none-x86_64": @ 0x555dc13e2ca3 centipede::CentipedeDefaultCallbacks::CentipedeDefaultCallbacks()
Step #23 - "build-check-centipede-none-x86_64": @ 0x555dc13e2ab2 centipede::DefaultCallbacksFactory<>::create()
Step #23 - "build-check-centipede-none-x86_64": @ 0x555dc13e519c centipede::CentipedeMain()
Step #23 - "build-check-centipede-none-x86_64": @ 0x555dc13e24a8 main
Step #23 - "build-check-centipede-none-x86_64": @ 0x7fc051d0e083 __libc_start_main
Step #23 - "build-check-centipede-none-x86_64": /usr/local/bin/run_fuzzer: line 227: 26982 Aborted (core dumped) bash -c "$CMD_LINE"
```

Contributor guide

Open the contributing guide

Research direction

Start with the linked OSS-Fuzz log and the Centipede invocation using fuzz_lua.dict and fuzz_lua. Inspect how the Lua fuzzing target and dictionary are configured, then reproduce the empty-or-corrupt dictionary failure. Done means the Centipede build check accepts the dictionary and starts fuzzing without this crash.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua
Domain
testing-qa
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.