Compilation Error When Building Exiv2 with afl-clang-fast/afl-clang-fast++
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
When I am trying to fuzz `exiv2` with AFL:
```
git clone https://github.com/Exiv2/exiv2.git
cd exiv2
cmake -S . -B build2 \
-DCMAKE_C_COMPILER="/home/AFLplusplus/afl-clang-fast" \
-DCMAKE_CXX_COMPILER="/home/AFLplusplus/afl-clang-fast++" \
-DCMAKE_BUILD_TYPE=Debug \
-DEXIV2_TEAM_USE_SANITIZERS=ON \
-DBUILD_SHARED_LIBS=ON \
-DCMAKE_CXX_STANDARD=20 \
-DEXIV2_ENABLE_CURL=ON \
-DCMAKE_IGNORE_PATH="/root/miniconda3/lib"Duplicate of
cmake --build build2 2>&1 > compile-log
```
Then, crash happened. Since the project instructions mention submitting issues here, I create this issue accordingly, hoping it will help with improvement!
```
clang++: /usr/lib/llvm-14/include/llvm/Support/Casting.h:269: typename cast_retty::ret_type llvm::cast(Y *) [X = llvm::Instruction, Y = llvm::Value]: Assertion `isa(Val) && "cast() argument of incompatible type!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0. Program arguments: /usr/lib/llvm-14/bin/clang++ -Wno-unused-command-line-argument -fno-legacy-pass-manager -fpass-plugin=/home/AFLplusplus/SanitizerCoveragePCGUARD.so -DBanAllEntityUsage=1 -I/home/new-cases/exiv2/exiv2/build2 -isystem /home/new-cases/exiv2/exiv2/xmpsdk/include -fno-omit-frame-pointer -fsanitize=address,undefined -fno-sanitize-recover=all -g3 -gstrict-dwarf -O0 -fPIC -fvisibility=hidden -fvisibility-inlines-hidden -fstack-clash-protection -fstack-protector-strong -D_GLIBCXX_ASSERTIONS -Wall -Wcast-align -Wpointer-arith -Wformat-security -Wmissing-format-attribute -Woverloaded-virtual -W -Wno-error=format-nonliteral -std=gnu++20 -MD -MT xmpsdk/CMakeFiles/exiv2-xmp.dir/src/ExpatAdapter.cpp.o -MF CMakeFiles/exiv2-xmp.dir/src/ExpatAdapter.cpp.o.d -o CMakeFiles/exiv2-xmp.dir/src/ExpatAdapter.cpp.o -c /home/new-cases/exiv2/exiv2/xmpsdk/src/ExpatAdapter.cpp -U_FORTIFY_SOURCE -fsanitize-trap=undefined -g -funroll-loops -D__AFL_COMPILER=1 -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION=1 "-D__AFL_COVERAGE()=int __afl_selective_coverage __attribute__ ((weak)) = 1;extern \"C\" void __afl_coverage_discard();extern \"C\" void __afl_coverage_skip();extern \"C\" void __afl_coverage_on();extern \"C\" void __afl_coverage_off();" "-D__AFL_COVERAGE_START_OFF()=int __afl_selective_coverage_start_off = 1;" -D__AFL_COVERAGE_ON()=__afl_coverage_on() -D__AFL_COVERAGE_OFF()=__afl_coverage_off() -D__AFL_COVERAGE_DISCARD()=__afl_coverage_discard() -D__AFL_COVERAGE_SKIP()=__afl_coverage_skip() -D__AFL_HAVE_MANUAL_CONTROL=1 "-D__AFL_FUZZ_INIT()=int __afl_sharedmem_fuzzing = 1;extern __attribute__((visibility(\"default\"))) unsigned int *__afl_fuzz_len;extern __attribute__((visibility(\"default\"))) unsigned char *__afl_fuzz_ptr;unsigned char __afl_fuzz_alt[1048576];unsigned char *__afl_fuzz_alt_ptr = __afl_fuzz_alt;" "-D__AFL_FUZZ_TESTCASE_BUF=(__afl_fuzz_ptr ? __afl_fuzz_ptr : __afl_fuzz_alt_ptr)" "-D__AFL_FUZZ_TESTCASE_LEN=(__afl_fuzz_ptr ? *__afl_fuzz_len : (*__afl_fuzz_len = read(0, __afl_fuzz_alt_ptr, 1048576)) == 0xffffffff ? 0 : *__afl_fuzz_len)" "-D__AFL_LOOP(_A)=({ static volatile const char *_B __attribute__((used,unused)); _B = (const char*)\"##SIG_AFL_PERSISTENT##\"; extern __attribute__((visibility(\"default\"))) int __afl_connected;__attribute__((visibility(\"default\"))) int _L(unsigned int) __asm__(\"__afl_persistent_loop\"); _L(__afl_connected ? _A : 1); })" "-D__AFL_INIT()=do { static volatile const char *_A __attribute__((used,unused)); _A = (const char*)\"##SIG_AFL_DEFER_FORKSRV##\"; __attribute__((visibility(\"default\"))) void _I(void) __asm__(\"__afl_manual_init\"); _I(); } while (0)"
1. parser at end of file
2. Optimizer
#0 0x00007fffeed3ad01 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/lib/x86_64-linux-gnu/libLLVM-14.so.1+0xe3fd01)
#1 0x00007fffeed38a3e llvm::sys::RunSignalHandlers() (/lib/x86_64-linux-gnu/libLLVM-14.so.1+0xe3da3e)
#2 0x00007fffeed3a0ab llvm::sys::CleanupOnSignal(unsigned long) (/lib/x86_64-linux-gnu/libLLVM-14.so.1+0xe3f0ab)
#3 0x00007fffeec66dff (/lib/x86_64-linux-gnu/libLLVM-14.so.1+0xd6bdff)
#4 0x00007fffed9df520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#5 0x00007fffeda339fc __pthread_kill_implementation ./nptl/./nptl/pthread_kill.c:44:76
#6 0x00007fffeda339fc __pthread_kill_internal ./nptl/./nptl/pthread_kill.c:78:10
#7 0x00007fffeda339fc pthread_kill ./nptl/./nptl/pthread_kill.c:89:10
#8 0x00007fffed9df476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
#9 0x00007fffed9c57f3 abort ./stdlib/./stdlib/abort.c:81:7
#10 0x00007fffed9c571b _nl_load_domain ./intl/./intl/loadmsgcat.c:1177:9
#11 0x00007fffed9d6e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#12 0x00007fffeb73246e (anonymous namespace)::ModuleSanitizerCoverageAFL::InjectCoverage(llvm::Function&, llvm::ArrayRef) /home/AFLplusplus/instrumentation/SanitizerCoveragePCGUARD.so.cc:0:0
#13 0x00007fffeb72e8f0 (anonymous namespace)::ModuleSanitizerCoverageAFL::instrumentFunction(llvm::Function&, llvm::function_ref, llvm::function_ref) /home/AFLplusplus/instrumentation/SanitizerCoveragePCGUARD.so.cc:875:7
#14 0x00007fffeb72e8f0 (anonymous namespace)::ModuleSanitizerCoverageAFL::instrumentModule(llvm::Module&, llvm::function_ref, llvm::function_ref) /home/AFLplusplus/instrumentation/SanitizerCoveragePCGUARD.so.cc:689:5
#15 0x00007fffeb72e8f0 (anonymous namespace)::ModuleSanitizerCoverageAFL::run(llvm::Module&, llvm::AnalysisManager&) /home/AFLplusplus/instrumentation/SanitizerCoveragePCGUARD.so.cc:280:22
#16 0x00007fffeb72e8f0 llvm::detail::PassModel >::run(llvm::Module&, llvm::AnalysisManager&) /usr/lib/llvm-14/include/llvm/IR/PassManagerInternal.h:88:17
#17 0x00007fffeeea860e llvm::PassManager >::run(llvm::Module&, llvm::AnalysisManager&) (/lib/x86_64-linux-gnu/libLLVM-14.so.1+0xfad60e)
#18 0x00007ffff602fb9b (/lib/x86_64-linux-gnu/libclang-cpp.so.14+0x1862b9b)
#19 0x00007ffff6023a52 clang::EmitBackendOutput(clang::DiagnosticsEngine&, clang::HeaderSearchOptions const&, clang::CodeGenOptions const&, clang::TargetOptions const&, clang::LangOptions const&, llvm::StringRef, llvm::Module*, clang::BackendAction, std::unique_ptr >) (/lib/x86_64-linux-gnu/libclang-cpp.so.14+0x1856a52)
#20 0x00007ffff6349855 (/lib/x86_64-linux-gnu/libclang-cpp.so.14+0x1b7c855)
#21 0x00007ffff51d1824 clang::ParseAST(clang::Sema&, bool, bool) (/lib/x86_64-linux-gnu/libclang-cpp.so.14+0xa04824)
#22 0x00007ffff6345b71 clang::CodeGenAction::ExecuteAction() (/lib/x86_64-linux-gnu/libclang-cpp.so.14+0x1b78b71)
#23 0x00007ffff6ce1b57 clang::FrontendAction::Execute() (/lib/x86_64-linux-gnu/libclang-cpp.so.14+0x2514b57)
#24 0x00007ffff6c393a6 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/lib/x86_64-linux-gnu/libclang-cpp.so.14+0x246c3a6)
#25 0x00007ffff6d5b45b clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/lib/x86_64-linux-gnu/libclang-cpp.so.14+0x258e45b)
#26 0x000000000041328b cc1_main(llvm::ArrayRef, char const*, void*) (/usr/lib/llvm-14/bin/clang+++0x41328b)
#27 0x00000000004114bc (/usr/lib/llvm-14/bin/clang+++0x4114bc)
#28 0x00007ffff68b7ed2 (/lib/x86_64-linux-gnu/libclang-cpp.so.14+0x20eaed2)
#29 0x00007fffeec66b6d llvm::CrashRecoveryContext::RunSafely(llvm::function_ref) (/lib/x86_64-linux-gnu/libLLVM-14.so.1+0xd6bb6d)
#30 0x00007ffff68b79c0 clang::driver::CC1Command::Execute(llvm::ArrayRef >, std::__cxx11::basic_string, std::allocator >*, bool*) const (/lib/x86_64-linux-gnu/libclang-cpp.so.14+0x20ea9c0)
#31 0x00007ffff6882183 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&) const (/lib/x86_64-linux-gnu/libclang-cpp.so.14+0x20b5183)
#32 0x00007ffff688240a clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl >&) const (/lib/x86_64-linux-gnu/libclang-cpp.so.14+0x20b540a)
#33 0x00007ffff689c507 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl >&) (/lib/x86_64-linux-gnu/libclang-cpp.so.14+0x20cf507)
#34 0x0000000000410f26 main (/usr/lib/llvm-14/bin/clang+++0x410f26)
#35 0x00007fffed9c6d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#36 0x00007fffed9c6e40 call_init ./csu/../csu/libc-start.c:128:20
#37 0x00007fffed9c6e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#38 0x000000000040e3b5 _start (/usr/lib/llvm-14/bin/clang+++0x40e3b5)
clang: error: clang frontend command failed with exit code 134 (use -v to see invocation)
Ubuntu clang version 14.0.0-1ubuntu1.1
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/lib/llvm-14/bin
clang: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang: note: diagnostic msg: /tmp/ExpatAdapter-3e65ef.cpp
clang: note: diagnostic msg: /tmp/ExpatAdapter-3e65ef.sh
clang: note: diagnostic msg:
********************
gmake[2]: *** [xmpsdk/CMakeFiles/exiv2-xmp.dir/build.make:76: xmpsdk/CMakeFiles/exiv2-xmp.dir/src/ExpatAdapter.cpp.o] Error 134
gmake[1]: *** [CMakeFiles/Makefile2:919: xmpsdk/CMakeFiles/exiv2-xmp.dir/all] Error 2
gmake: *** [Makefile:146: all] Error 2
```
Contributor guide
Assessment
This issue has not been assessed yet.