Possibly incorrect code in libfuzzer?
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
I've been messing around writing a fuzzer with libfuzzer and my fuzzer seemed to have found a bug in libfuzzer itself - the bug was me holding it wrong :D (specifically the standard macosx mismatching system libraries problem)
However while I was trying to find what was going on I found this in `InputCorpus::AddRareFeature`:
```cpp
// Remove most abundant rare feature.
IsRareFeature[Delete] = false;
RareFeatures[Delete] = RareFeatures.back();
RareFeatures.pop_back();
```
which I believe is wrong (I spent a bunch of time looking at this until I realized my crash was an OoB failure in pop_back() due to the ASAN mismatch between the system libraries and my own builds, because I'd dropped the flag to ignore the stdlib. hooray!)
I _think_ this should be
```cpp
// Remove most abundant rare feature.
IsRareFeature[MostAbundantRareFeatureIndices[0]] = false;
RareFeatures[Delete] = RareFeatures.back();
RareFeatures.pop_back();
```
But this is very much an "I think" case (hence an issue rather than a PR)
Contributor guide
Research direction
Start at InputCorpus::AddRareFeature in libFuzzer and trace how Delete, RareFeatures, IsRareFeature, and MostAbundantRareFeatureIndices are computed. Verify which feature should be cleared and removed, then confirm the behavior with relevant project verification; done means the bookkeeping is correct or the issue is clearly shown not to be a bug.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- testing-qa
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 62/100