google / google/oss-fuzz

Issues reproducing - could helper.py pull_images default to using known-good images?

Open
#9,888 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
12.6k
Forks
2.9k
Avg merge
2d 2h
Merged PRs (30d)
62

Description

Echoing #9876: for someone who never had to deal with docker/containerization, the documentation on [reproducing][1] really isn't clear. Having to pull down many gigs of container images and waiting hours for the images to compile only to then fail with opaque errors is, frankly, quite frustrating.

I got a mail containing this info - the [issue itself][2] is private:

```
Project: libressl
Fuzzing Engine: afl
Fuzz Target: cryptofuzz
Job Type: afl_asan_libressl
Platform Id: linux
[...]
Sanitizer: address (ASAN)
```

From [the docs][1] I gather I need to run these commands (I'm glossing over the fact that I need root permissions contrary to what the `$` signs in the shell prompts seem to indicate - a link to some basic docker usage would surely help with that):

```console
$ # pull the latest Docker images
$ git clone --depth=1 https://github.com/google/oss-fuzz.git
$ cd oss-fuzz
$ # build the image and the fuzzers
$ python infra/helper.py build_image libressl
$ python infra/helper.py build_fuzzers --sanitizer address libressl
```

So far, so good. This only took about an hour. Then the instructions tell me to issue this command:

```
$ python infra/helper.py reproduce $PROJECT_NAME
```

It is not clear what the `fuzz_target_name` is supposed to be, and the example doesn't help. Where does `libxml2_xml_read_memory_fuzzer` come from?

From the report I gather the fuzz target name is probably `cryptofuzz` .
So I try this:

```console
$ python infra/helper.py reproduce libressl cryptofuzz ~/clusterfuzz-testcase-minimized-cryptofuzz-5067002814529536
ERROR:root:cryptofuzz does not seem to exist. Please run build_fuzzers first
```

Next guess:

```console
$ python infra/helper.py build_fuzzers cryptofuzz

< snip tons of output >

module.cpp:404:28: note: in implicit default constructor for '_SYMCRYPT_GCM_STATE' first required here
SYMCRYPT_GCM_STATE state;
^
5 warnings generated.
test
make: *** [Makefile:6: module.a] Error 1
ERROR:root:Building fuzzers failed.
```

(On the initial attempt it failed because apparently zig changed something in their sha3 implementation).

If run `docker image ls`, I see that all the images are `latest`. Perhaps latest is not the greatest? I couldn't figure out how to list tags that I can pull, etc.

It would be really great if the instructions just worked. But they don't. I've been trying over the past 4 days and spent a few hours on it.

Cc @guidovranken

[1]: https://google.github.io/oss-fuzz/advanced-topics/reproducing
[2]: https://oss-fuzz.com/testcase-detail/5067002814529536

Contributor guide

Open the contributing guide

Research direction

Start with infra/helper.py and the advanced-topics/reproducing documentation linked in the issue. Trace the build_image, build_fuzzers, and reproduce commands, including how image versions and fuzz target names are selected. Done means reproduction can use known-good images by default and the documented commands clearly identify the required target.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, python
Domain
documentation, testing-qa, tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.