llvm / llvm/llvm-project

LibFuzzer: Corpus minification fails if corpus path contains whitespace

Open
#169,029 0 comments 0 reactions 0 assignees View on GitHub
compiler-rt:fuzzer
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

I originally opened this issue on the [`cargo-fuzz`](https://github.com/rust-fuzz/cargo-fuzz) repository: [cargo-fuzz #428](https://github.com/rust-fuzz/cargo-fuzz/issues/428), and one of the contributors suggested that this might be a bug in LibFuzzer itself.

Please let me know if I can be of assistance.

> When trying to minify the corpus of a fuzzing target, spaces in paths are not properly escaped.
>
> ```bash
> $ cargo fuzz --version
> cargo-fuzz 0.13.1
> # I am running this test on an Apple M1 (Sequoia 15.7.1) with case-insensitive APFS.
> ```
>
> The paragraph below shows the error I'm getting when running the `poc.sh` script in my repo. At [cargo-fuzz-poc](https://github.com/nausicaea/cargo-fuzz-poc) I've created a minimal working example of the issue for verification. An **additional issue** I'm seeing is: if the corpus contains multiple files, `cargo +nightly fuzz cmin parse_cbor` runs into an infinite loop, and I have to kill the processes. Furthermore, I cannot reproduce the same behaviour in fuzzing mode (`cargo +nightly fuzz run parse_cbor`): there whitespace in paths doesn't seem to matter.
>
> I'm willing to provide additional information, should you require anything.
>
> ```bash
> $ sh poc.sh
> Finished `release` profile [optimized + debuginfo] target(s) in 0.02s
> Finished `release` profile [optimized + debuginfo] target(s) in 0.01s
> Finished `release` profile [optimized + debuginfo] target(s) in 0.02s
> Running `target/aarch64-apple-darwin/release/parse_cbor '-artifact_prefix=/private/var/folders/cv/jzjgfjdj42nbzk8_w7plqshm0000gn/T/tmp.VMmLUHg0FJ/poc/path with space/example-crate/fuzz/artifacts/parse_cbor/' -merge=1 '/private/var/folders/cv/jzjgfjdj42nbzk8_w7plqshm0000gn/T/tmp.VMmLUHg0FJ/poc/path with space/example-crate/fuzz/.tmpJMDfRb/corpus' '/private/var/folders/cv/jzjgfjdj42nbzk8_w7plqshm0000gn/T/tmp.VMmLUHg0FJ/poc/path with space/example-crate/fuzz/corpus/parse_cbor'`
> parse_cbor(86522,0x20bdb2140) malloc: nano zone abandoned due to inability to reserve vm space.
> INFO: Running with entropic power schedule (0xFF, 100).
> INFO: Seed: 977339485
> INFO: Loaded 1 modules (3143 inline 8-bit counters): 3143 [0x1023b5ab0, 0x1023b66f7),
> INFO: Loaded 1 PC tables (3143 PCs): 3143 [0x1023b66f8,0x1023c2b68),
> MERGE-OUTER: 2 files, 0 in the initial corpus, 0 processed earlier
> MERGE-OUTER: attempt 1
> parse_cbor(86523,0x20bdb2140) malloc: nano zone abandoned due to inability to reserve vm space.
> ERROR: The required directory "with" does not exist
> MERGE-OUTER: attempt 2
> parse_cbor(86524,0x20bdb2140) malloc: nano zone abandoned due to inability to reserve vm space.
> ERROR: The required directory "with" does not exist
> MERGE-OUTER: the control file has 313 bytes
> MERGE-OUTER: consumed 0Mb (44Mb rss) to parse the control file
> MERGE-OUTER: 0 new files with 0 new features added; 0 new coverage edges
> ```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the report with the linked cargo-fuzz minimal example and its poc.sh script, using cargo +nightly fuzz cmin parse_cbor with a corpus path containing spaces. Compare the cmin invocation and output with fuzz run, including the reported multi-file corpus case. Done means the reported whitespace-path failure and looping behavior are resolved and the reproduction no longer shows them.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
testing
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.