google / google/oss-fuzz

libprotobuf-mutator fuzz target with MSAN

Open
#9,549 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
12.6k
Forks
2.9k
Avg merge
2d 2h
Merged PRs (30d)
62

Description

In the `cryptsetup` project, we use `libprotobuf-mutator` library for custom mutator. We would like to run the custom mutator with memory sanitizer, however it started generating MSAN errors because `libfuzzer` in OSS-Fuzz is not compiled with MSAN. I have [worked around the issue](
https://gitlab.com/cryptsetup/cryptsetup/-/merge_requests/482) by manually unpoisoning the buffer passed (via `LLVMFuzzerMutate` function) from `libfuzzer` to `libprotobuf-mutator` (the `LLVMFuzzerMutate` happens to be called only from 2 places, so it is not a big deal).

Is there a better way to compile LPM targets with MSAN?

I have looked through `llvm/compiler-rt` source code and there seems to be unpoison calls on the buffer returned by `LLVMFuzzerTestOneInput`, but not on buffer returned by `LLVMFuzzerMutate`, so trivial fuzz targets work, but not custom mutators. So this could probably be addressed in `lbfuzzer` instead.

Related issues:
https://github.com/google/oss-fuzz/issues/864
https://github.com/google/oss-fuzz/pull/4095

Contributor guide

Open the contributing guide

Research direction

Start by reading the LLVM compiler-rt libFuzzer handling around LLVMFuzzerTestOneInput and LLVMFuzzerMutate, then review the related OSS-Fuzz issue and pull request. Determine how libprotobuf-mutator targets are compiled and run with MSAN; the work is complete when a supported approach avoids manual buffer unpoisoning or clearly documents the necessary setup.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
build-system, testing-qa
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.