libprotobuf-mutator fuzz target with MSAN
- Dominant language
- Shell
- Stars
- 12.6k
- Forks
- 2.9k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 62
Description
In the `cryptsetup` project, we use `libprotobuf-mutator` library for custom mutator. We would like to run the custom mutator with memory sanitizer, however it started generating MSAN errors because `libfuzzer` in OSS-Fuzz is not compiled with MSAN. I have [worked around the issue](
https://gitlab.com/cryptsetup/cryptsetup/-/merge_requests/482) by manually unpoisoning the buffer passed (via `LLVMFuzzerMutate` function) from `libfuzzer` to `libprotobuf-mutator` (the `LLVMFuzzerMutate` happens to be called only from 2 places, so it is not a big deal).
Is there a better way to compile LPM targets with MSAN?
I have looked through `llvm/compiler-rt` source code and there seems to be unpoison calls on the buffer returned by `LLVMFuzzerTestOneInput`, but not on buffer returned by `LLVMFuzzerMutate`, so trivial fuzz targets work, but not custom mutators. So this could probably be addressed in `lbfuzzer` instead.
Related issues:
https://github.com/google/oss-fuzz/issues/864
https://github.com/google/oss-fuzz/pull/4095
Contributor guide
Research direction
Start by reading the LLVM compiler-rt libFuzzer handling around LLVMFuzzerTestOneInput and LLVMFuzzerMutate, then review the related OSS-Fuzz issue and pull request. Determine how libprotobuf-mutator targets are compiled and run with MSAN; the work is complete when a supported approach avoids manual buffer unpoisoning or clearly documents the necessary setup.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- build-system, testing-qa
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100