google / google/oss-fuzz

No coverage generated due to corpus format in Golang Native Fuzzing

Open
#13,285 1 comment 0 reactions 1 assignee Claimed by @AdamKorcz View on GitHub
Dominant language
Shell
Stars
12.6k
Forks
2.9k
Avg merge
2d 2h
Merged PRs (30d)
62

Description

We are implementing fuzzing in [envoy/gateway](https://github.com/envoyproxy/gateway) using Go's native fuzzing support. However, we are seeing **no coverage** reported in OSS-Fuzz.

Upon investigation, we found that this is due to a **mismatch in corpus formats.** For fuzzing, OSS-Fuzz uses a **libFuzzer-style corpus,** while for coverage builds, it expects a corpus in the **Go native fuzzing format.**
This issue arises because the fuzzing build uses the go-118-fuzz-build library, whereas the coverage build uses Go's native fuzzing implementation.

https://github.com/google/oss-fuzz/blob/74762513ad565f46a4502f390cb0cb64bc9bdf21/infra/base-images/base-builder/compile_native_go_fuzzer#L44-L68

There is a **corpus converter** that is supposed to transform the libFuzzer corpus into the Go native format during coverage builds. However, it appears that this conversion step is **not being triggered.**

https://github.com/google/oss-fuzz/blob/8bc2e0b5cfeffaee2cd8f6dd27e0b72ca87bac88/infra/base-images/base-runner/coverage#L145-L146

As a result, the entire generated **corpus is not taken into account** while building the coverage report. See coverage build logs: https://oss-fuzz-build-logs.storage.googleapis.com/log-5714e769-c3e8-4543-adfb-7ed9e040a8d8.txt

We would appreciate any guidance on how to resolve this issue, as having coverage reports is crucial for us to fine-tune and develop additional fuzzers for `envoy/gateway`.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.