Repository navigation
fuzzing: build with the sanitizers, seed the corpus, leave the caller's tree alone - #178
Merged
Merged
Conversation
hfuzz-clang decides whether to add -fsanitize=address and -fsanitize=undefined by looking HFUZZ_CC_ASAN and HFUZZ_CC_UBSAN up with getenv(2) as it compiles. They were passed to configure as arguments, which puts them in the environment of configure and nowhere else, so the compiler invocations make runs never saw them. Export them instead: the fuzzing binary goes from no __asan_report* symbols at all to 48 of them, and the number of coverage guards honggfuzz reports from 13821 to 36707. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
The script ran git clean -fdx and a full build in /libocispec, which is the directory the caller bind mounts. In CI that is a fresh checkout, but anyone following the same recipe locally loses every untracked file in their working tree and gets a hfuzz-clang build left in it afterwards. Copy the tree to /tmp first and work there. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Every run started from the seven JSON files in tests/data, and honggfuzz stores the units it discovers in its input directory, which is inside the tree the run begins by wiping. Seed the corpus from giuseppe/containers-fuzzing-corpus instead, whose config-json directory is 923 config.json units the three runtime-spec modes can use, and keep it out of the source tree. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Collaborator
Author
|
@giuseppe PTAL |
giuseppe
approved these changes
Oct 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The fuzzing job does fuzz -- unlike the one in crun, the harness is linked
and coverage is real -- but it has been running without the sanitizers it
asks for, from a seven-file corpus, and it wipes and builds in whatever tree
the caller mounted.
The sanitizers were not in the build.
hfuzz-clangdecides whether to add-fsanitize=addressand-fsanitize=undefinedby lookingHFUZZ_CC_ASANandHFUZZ_CC_UBSANup withgetenv(2)as it compiles, but they were passed toconfigureas arguments, which puts them in the environment ofconfigureandnowhere else, so none of the compiler invocations
makeruns ever saw them.Exporting them takes the binary from no
__asan_report*symbols at all to 48of them, and the coverage guards honggfuzz reports from 13821 to 36707.
(The
__ubsan*symbols are in the binary either way -- libhfuzz brings theruntime along -- so they are not evidence that UBSan is instrumenting anything.)
The job built in the caller's tree.
git clean -fdxand a full hfuzz-clangbuild ran in
/libocispec, the bind mount. In CI that is a fresh checkout, butanyone following the same recipe locally loses every untracked file in their
working tree. The script now copies the tree to
/tmpand works there.The corpus was seven files. Seeded from
giuseppe/containers-fuzzing-corpus
now, whose
config-jsondirectory is 923config.jsonunits the threeruntime-spec modes can use, and kept outside the source tree so honggfuzz can
write to it.
Measured with the job run end to end from
tests/fuzzing/Dockerfile:__asan_report*symbolsAll seven modes report
crashes_count:0on a clean tree with the sanitizersin, so nothing here needed a fix in the library itself. The failure path was
checked separately: an
abort()reachable from a crafted input makes the jobreport
crashes_count:1and exit 1.