Fix fuzz target source path and binary name in gnutls.yaml #750
Conversation
|
/gcbrun skip |
|
fyi, the approach you take is the one that Fuzz Introspector use: https://github.com/ossf/fuzz-introspector/blob/28009df5d005f9c1c5131902aa7efc7e77856d48/src/fuzz_introspector/utils.py#L185-L196 problems that happen now can be the project doesn't compile with FI's C/C++ frontend (i.e. light only) and thus the approach is not used, or, some optimisations forced the strings out. |
Thanks for the information, @DavidKorczynski. Given FI proves this approach works on most projects but some projects are incompatible with FI, would you think it is a good idea for me to implement the approach in bash commands now so that it does not rely on FI? Just to double-check to ensure I don't redo anything that's already done/planned by FI. |
…ml (#752) This is another strange case: 1. The project is [compatible](https://oss-fuzz-build-logs.storage.googleapis.com/index.html#librawspeed) with FI. 2. FI API [did not report](https://introspector.oss-fuzz.com/api/harness-source-and-executable?project=librawspeed) any pair. 3. The trick from #750 works: ```bash #!/usr/bin/env bash # First, find all matching files FILES=$(find /src \ -type f \( -name '*.c' -o -name '*.cc' -o -name '*.cpp' -o -name '*.cxx' \) \ -not -path '*/aflplusplus/*' \ -not -path '*/fuzztest/*' \ -not -path '*/honggfuzz/*' \ -not -path '*/libfuzzer/*' \ -exec grep -l 'LLVMFuzzerTestOneInput' {} \;) # For each file, insert a build_id line at the top of the file for file in $FILES; do # Escape any slashes so the file path can be safely inserted by sed file_escaped=$(echo "$file" | sed 's/\//\\\//g') # Insert the build_id line at the top of the file # Adjust the insertion point as needed (e.g., after includes) if desired sed -i "1i const volatile char* build_id = \"$file_escaped\";" "$file" done echo "build_id line inserted in all matched files." ```
This is a tricky case because the old target path (
/src/libtasn1/fuzz/libtasn1_gnutls_der_fuzzer.c) is indeed a fuzz target, but it was not used.I found the new one and its corresponding binary with @jonathanmetzman's trick:
const volatile char* build_id = "BUILD_TRACKER_my_unique_identifier_123";) to the fuzz target before compilation.find /out -type f -executable -print0 | xargs -0 sh -c 'for file do if strings "$file" | grep "BUILD_TRACKER_" >/dev/null; then basename "$file"; fi; done') after compilation.I reckon we can do this systematically and automatically:
BUILD_TRACKER_my_unique_identifier_1,BUILD_TRACKER_my_unique_identifier_2) to all c/c++ files containingLLVMFuzzerTestOneInput.