From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from forward500p.mail.yandex.net (forward500p.mail.yandex.net [IPv6:2a02:6b8:0:1472:2741:0:8b7:110]) by sourceware.org (Postfix) with ESMTPS id 756503858407 for ; Tue, 22 Mar 2022 17:00:01 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 756503858407 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=ya.ru Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=ya.ru Received: from myt5-95f184467838.qloud-c.yandex.net (myt5-95f184467838.qloud-c.yandex.net [IPv6:2a02:6b8:c12:5981:0:640:95f1:8446]) by forward500p.mail.yandex.net (Yandex) with ESMTP id 354C8F02106; Tue, 22 Mar 2022 19:59:59 +0300 (MSK) Received: from myt5-89cdf5c4a3a5.qloud-c.yandex.net (myt5-89cdf5c4a3a5.qloud-c.yandex.net [2a02:6b8:c12:289b:0:640:89cd:f5c4]) by myt5-95f184467838.qloud-c.yandex.net (mxback/Yandex) with ESMTP id iPHpSmLQKI-xwfeSUoO; Tue, 22 Mar 2022 19:59:59 +0300 X-Yandex-Fwd: 2 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ya.ru; s=mail; t=1647968399; bh=ylMDU6TLF77szDSX/KVmUe0DlAThamxi6QExtDWnsB8=; h=References:Date:In-Reply-To:Subject:Cc:From:Message-Id:To; b=TGr1X+L8fU+gW6DM7PCPlnAiMyhUsNzDJA7yBwKjZWofhBhDB3xcKLf3evEPA/Z2b yQBS1ejqTI9ZD12LAVOfvQT6SkgM0/8JWfvw46UeXJcbcNa8doyRXNmmnT6TzxLYTF fU1Tk2o5w7t6i/PlHa+u17b3TdCTyFwlKYZCujb4= Authentication-Results: myt5-95f184467838.qloud-c.yandex.net; dkim=pass header.i=@ya.ru Received: by myt5-89cdf5c4a3a5.qloud-c.yandex.net (smtp/Yandex) with ESMTPSA id WYIaiSXKyu-xwJOsWbv; Tue, 22 Mar 2022 19:59:58 +0300 (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client certificate not present) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.21\)) Subject: Re: Some fuzzer workarounds From: Evgeny Vereshchagin In-Reply-To: <289F0554-4E5C-42F1-A3C9-773C828CA168@ya.ru> Date: Tue, 22 Mar 2022 19:59:57 +0300 Cc: david korczynski , elfutils-devel@sourceware.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <20220317133051.100876-1-mark@klomp.org> <741FAE40-F8E9-4DA7-A160-E30A76210AC8@ya.ru> <289F0554-4E5C-42F1-A3C9-773C828CA168@ya.ru> To: Mark Wielaard X-Mailer: Apple Mail (2.3445.104.21) X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, RCVD_IN_DNSWL_LOW, SPF_HELO_NONE, SPF_PASS, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: elfutils-devel@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Elfutils-devel mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Mar 2022 17:00:08 -0000 Hi Mark, >> So I took the fuzz-libelf.c and fuzz-libdwfl.c files from the = oss-fuzz >> repo, tweaked them so they have a normal main that takes one file >> argument to try to replicate the reports. That found some "real" >> issues I submitted patches for. Then I ran afl-fuzz on them locally >> during the weekend and found another issue for which I also submitted >> a patch. >=20 > FWIW to test the "fuzz" branch I integrated the new fuzz targets into = the elfutils build system > by analogy with = https://sourceware.org/pipermail/elfutils-devel/2021q4/004615.html and > there they are linked with the main function automatically and it's = also possible to pass --enable-afl > to ./configure to automatically run it with AFL. I sent it to the mailing list: = https://sourceware.org/pipermail/elfutils-devel/2022q1/004767.html >=20 >> There are several duplicates though and all the MSAN reported >> issues seem bogus. >=20 >=20 > I'm not sure all of them are bogus but I would ignore them for now. = Once the new fuzz targets > are linked with zlib built with MSan bogus reports will be closed and = I'll take a look at what's left > there. I can also prevent OSS-Fuzz from reporting new bugs found by MSan by setting the experimental flag =46rom = https://google.github.io/oss-fuzz/getting-started/new-project-guide/#sanit= izers > If you want to test a particular sanitizer to see what crashes it = generates > without filing them in the issue tracker, you can set an experimental = flag It should help to figure out whether it makes sense to keep it without = spamming the mailing list in the process. What do you think? Thanks, Evgeny Vereshchagin=