Re: Some fuzzer workarounds

[Mark Wielaard <mark@klomp.org>]

Hi,

On Fri, Mar 18, 2022 at 10:26:16AM +0300, Evgeny Vereshchagin wrote:
> I think before looking at those reports it would make sense to
> figure out what they are supposed to test and how they were tested
> to make sure they don't produce false positives. If they weren't
> actually tested I think it would make sense to revert them to avoid
> getting auto-generated CVEs until they're in more or less good shape
> at least.

So I took the fuzz-libelf.c and fuzz-libdwfl.c files from the oss-fuzz
repo, tweaked them so they have a normal main that takes one file
argument to try to replicate the reports. That found some "real"
issues I submitted patches for. Then I ran afl-fuzz on them locally
during the weekend and found another issue for which I also submitted
a patch. There are several duplicates though and all the MSAN reported
issues seem bogus.

> > There are also some other
> > misaligned type access checks reported by ubsan, but I don't know if
> > that is because of ALLOW_UNALIGNED is still defined or not (when
> > configuring with --enable-analyze-undefined ALLOW_UNALIGNED is not
> > defined, otherwise it is for some arches, including x86_64).
> 
> Looking at
> https://github.com/google/oss-fuzz/commit/8747524f04b1b906d4a21a6ade87f7803b3f9b8c,
> I think I turned ALLOW_UNALIGNED off with UBSan there (and tested it
> in https://sourceware.org/bugzilla/show_bug.cgi?id=28720).

Yes, you are right, all the unaligned type access issues were "real"
(they occur with or without ALLOW_UNALIGNED on). It is not really a
big issue, but could potentially cause the compiler to do some
surprising optimisations. So I did fix them all.

Cheers,

Mark