Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fuzz_mutator seems to not work with stripping dead code by default #396

Open
0xalpharush opened this issue Feb 7, 2025 · 0 comments
Open

Comments

@0xalpharush
Copy link
Contributor

0xalpharush commented Feb 7, 2025

Using the package from crates prior to #394:

$ cargo fuzz --version
cargo-fuzz 0.12.0
$ git clone [email protected]:rust-fuzz/libfuzzer.git && cd libfuzzer/example_mutator
$ cargo fuzz run boom  
...
thread '<unnamed>' panicked at
...

If I install from git cargo install --git https://github.com/rust-fuzz/cargo-fuzz, it not longer panics nearly instantly (finds an input that is prefixed with "boom"). I suspect this is because fuzz_mutator is stripped due to #394. That said, I did notice stripping dead code fixed errors llvm-cov produced when I was trying to generating coverage reports.

More info:
If I compile the example in a standalone project without cargo-fuzz, I can reproduce the behavior more clearly.

$ cargo new example_mutator && cargo add flate2 libfuzzer-sys && mv ~/libfuzzer/example_mutator/fuzz_targets/boom.rs ~/example_mutator/main.rs
$ cargo +nightly rustc -- \                                      
    -C passes='sancov-module' \
    -C llvm-args='-sanitizer-coverage-level=4' \
    -C llvm-args='-sanitizer-coverage-inline-8bit-counters' \
    -C link-dead-code

Next, add a panic!(); to fuzz_mutator! and run ./target/debug/example_mutator. I get a crash at the inserted panic.

If I remove -C link-dead-code, the panic isn't reached.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant