-
Notifications
You must be signed in to change notification settings - Fork 2.5k
Closed as not planned
Description
#7055 implements native Go 1.18 fuzzing but the corpus formats remain incompatible: OSS-Fuzz uses raw byte arrays, Go fuzzers support multiple arguments of various types (see https://go.dev/doc/fuzz/). #7055 solves some of this mismatch by implementing an encoding, https://github.com/AdaLogics/go-fuzz-headers/blob/main/consumer.go, to generate compatible parameters from OSS-Fuzz' byte array input.
However, several issues remain:
- Native Go corpus entries in testdata/fuzz/FuzzXXX have to be converted to OSS-Fuzz format during fuzz building. https://github.com/orijtech/otils/blob/master/corpus2ossfuzz/main.go implements this (see https://github.com/tendermint/tendermint/blob/cbae5f9f5336bd9882cb0b02912f7ae948fac5b4/test/fuzz/oss-fuzz-build.sh#L11 for example use), but it would be nice if OSS-Fuzz did this automatically.
- Testcases and corpus entries generated by OSS-Fuzz have to be converted to native Go format, through
go-fuzz-headers
or similar, before a crash can be reproduced. - The byte array to multiple arguments encoding may not be optimal. For example, it encodes array length in a byte, making
[]byte
slices longer than 255 bytes impossible: https://github.com/AdaLogics/go-fuzz-headers/blob/main/consumer.go#L422.
Maybe this is a duplicate of golang/go#50192. In any case, I'd love to know what plans there are for native Go corpus support.
hickford, klauspost, brackendawson and Nukitt
Metadata
Metadata
Assignees
Labels
No labels