No coverage generated due to corpus format in Golang Native Fuzzing
- Dominant language
- Shell
- Stars
- 12.6k
- Forks
- 2.9k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 62
Description
We are implementing fuzzing in [envoy/gateway](https://github.com/envoyproxy/gateway) using Go's native fuzzing support. However, we are seeing **no coverage** reported in OSS-Fuzz.
Upon investigation, we found that this is due to a **mismatch in corpus formats.** For fuzzing, OSS-Fuzz uses a **libFuzzer-style corpus,** while for coverage builds, it expects a corpus in the **Go native fuzzing format.**
This issue arises because the fuzzing build uses the go-118-fuzz-build library, whereas the coverage build uses Go's native fuzzing implementation.
https://github.com/google/oss-fuzz/blob/74762513ad565f46a4502f390cb0cb64bc9bdf21/infra/base-images/base-builder/compile_native_go_fuzzer#L44-L68
There is a **corpus converter** that is supposed to transform the libFuzzer corpus into the Go native format during coverage builds. However, it appears that this conversion step is **not being triggered.**
https://github.com/google/oss-fuzz/blob/8bc2e0b5cfeffaee2cd8f6dd27e0b72ca87bac88/infra/base-images/base-runner/coverage#L145-L146
As a result, the entire generated **corpus is not taken into account** while building the coverage report. See coverage build logs: https://oss-fuzz-build-logs.storage.googleapis.com/log-5714e769-c3e8-4543-adfb-7ed9e040a8d8.txt
We would appreciate any guidance on how to resolve this issue, as having coverage reports is crucial for us to fine-tune and develop additional fuzzers for `envoy/gateway`.
Contributor guide
Assessment
This issue has not been assessed yet.