li-lizhe opened a new pull request, #3579:
URL: https://github.com/apache/brpc/pull/3579
`LLVMFuzzerTestOneInput` may only return `0` (input consumed) or `-1` (input
rejected). libFuzzer enforces this after every call — `assert(CBRes == 0 ||
CBRes == -1)` in `compiler-rt/lib/fuzzer/FuzzerLoop.cpp:622` — and its first
input is the empty one, so every harness here aborts an assert-enabled
libFuzzer at startup.
All 18 harnesses under `test/fuzzing/` open with
```c
if (size < kMinInputLength || size > kMaxInputLength){
return 1; // not a legal return value
}
```
Fixes #3578 — `return 1;` becomes `return 0;` in all 18 files.
`return -1` would also satisfy the contract if these inputs should be
rejected outright; `return 0` is used here because it matches what the newer
harnesses already do (`test/fuzzing/fuzz_rtmp.cpp` in #3516). Either way the
body is still skipped, so behaviour for in-range inputs is unchanged.
### Verification
Standalone driver asserting the exact contract libFuzzer enforces (`assert(r
== 0 || r == -1)`, clang 17.0.6, openEuler 24.03, aarch64):
| build | `LLVMFuzzerTestOneInput(empty, 0)` | result |
| --- | --- | --- |
| before (`return 1`) | `1` | `Assertion 'r == 0 || r == -1' failed` →
`Aborted (core dumped)`, exit 134 |
| after (`return 0`) | `0` | `return-value contract satisfied: CBRes=0`,
exit 0 |
The fixed harness also links and runs under a real libFuzzer (`clang++
-std=c++17 -fsanitize=fuzzer`, `./fuzz -runs=5` → `Done 5 runs in 0 second(s)`,
exit 0).
Not tested: a full brpc build + OSS-Fuzz run — the harnesses link the brpc
libraries, which were not built here. The change is a single return value per
file and touches no harness logic.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
