oss-fuzz icon indicating copy to clipboard operation
oss-fuzz copied to clipboard

compile_native_go_fuzzer: only search for fuzz function in .go files

Open kmoe opened this issue 2 years ago • 8 comments

Found this issue while updating HCL fuzzer to Go 1.18 native fuzzing.

Issue

Prior to this change, $fuzzer_filename is populated with a list of all files containing the fuzz $function string, whether they be git index file, README, Go file, or anything else.

These multiple files are passed to rewrite_go_fuzz_harness on line 86 as separate arguments:

+ rewrite_go_fuzz_harness /src/hcl/hclsyntax/fuzz/README.md /src/hcl/hclsyntax/fuzz/fuzz_test.go FuzzParseTemplate

This leads to an error on line 31 as the arguments to rewrite_go_fuzz_harness are now incorrect.

+ fuzzer_filename=/src/hcl/hclsyntax/fuzz/README.md
+ fuzz_function=/src/hcl/hclsyntax/fuzz/fuzz_test.go
[...]
+ fuzzer_fn=/src/hcl/hclsyntax/fuzz/README.md_fuzz_.go
+ echo 'replacing *testing.F'
replacing *testing.F
+ sed -i 's/func /src/hcl/hclsyntax/fuzz/fuzz_test.go(\([a-zA-Z0-9]*\) \*testing\.F)/func /src/hcl/hclsyntax/fuzz/fuzz_test.go(\1 \*go118fuzzbuildutils\.F)/g' /src/hcl/hclsyntax/fuzz/README.md_fuzz_.go
sed: -e expression #1, char 13: unknown option to `s'

Solution

Limiting the grep to .go files (https://github.com/google/oss-fuzz/pull/7903/commits/a47f2e07f90933b712233ae04e41c08baee027f3) fixes the case in which the fuzz $function string is present in one Go file and one or more non-Go files.

Subsequent lines of the script will still break if $function is present in more than one Go file. ca6e880 suggests erroring out in this case.

kmoe avatar Jun 22 '22 09:06 kmoe

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

google-cla[bot] avatar Jun 22 '22 09:06 google-cla[bot]

Thanks a lot for this. Is there any chance you could also get rid of the -r flag?

AdamKorcz avatar Jun 22 '22 15:06 AdamKorcz

Sure, is there any particular reason that was left as a TODO - anything to look out for here?

kmoe avatar Jun 22 '22 16:06 kmoe

Sure, is there any particular reason that was left as a TODO - anything to look out for here?

Not really. There shouldn't be anything contextual in OSS-Fuzz that caused the -r flag to be in that line.

AdamKorcz avatar Jun 22 '22 19:06 AdamKorcz

@kmoe friendly ping :)

Navidem avatar Aug 09 '22 18:08 Navidem

The first commit was superseded by https://github.com/google/oss-fuzz/pull/8238, so I've rebased.

Also removed the redundant grep -r flags.

@AdamKorcz @Navidem, thanks for your patience. This is ready for review.

kmoe avatar Sep 21 '22 22:09 kmoe

/gcbrun trial_build.py go --engine libfuzzer --sanitizer coverage address

jonathanmetzman avatar Feb 10 '23 20:02 jonathanmetzman

Are we still interested in merging this?

jonathanmetzman avatar Feb 10 '23 20:02 jonathanmetzman