llvm / llvm/llvm-project

Possibly incorrect code in libfuzzer?

Open
#213,186 0 comments 0 reactions 0 assignees View on GitHub
compiler-rt:fuzzer
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

I've been messing around writing a fuzzer with libfuzzer and my fuzzer seemed to have found a bug in libfuzzer itself - the bug was me holding it wrong :D (specifically the standard macosx mismatching system libraries problem)

However while I was trying to find what was going on I found this in `InputCorpus::AddRareFeature`:

```cpp
// Remove most abundant rare feature.
IsRareFeature[Delete] = false;
RareFeatures[Delete] = RareFeatures.back();
RareFeatures.pop_back();
```

which I believe is wrong (I spent a bunch of time looking at this until I realized my crash was an OoB failure in pop_back() due to the ASAN mismatch between the system libraries and my own builds, because I'd dropped the flag to ignore the stdlib. hooray!)

I _think_ this should be

```cpp
// Remove most abundant rare feature.
IsRareFeature[MostAbundantRareFeatureIndices[0]] = false;
RareFeatures[Delete] = RareFeatures.back();
RareFeatures.pop_back();
```

But this is very much an "I think" case (hence an issue rather than a PR)

Contributor guide

Open the contributing guide

Research direction

Start at InputCorpus::AddRareFeature in libFuzzer and trace how Delete, RareFeatures, IsRareFeature, and MostAbundantRareFeatureIndices are computed. Verify which feature should be cleared and removed, then confirm the behavior with relevant project verification; done means the bookkeeping is correct or the issue is clearly shown not to be a bug.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
testing-qa
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
62/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.