Re: [Libguestfs] [PATCH nbdkit 3/3] fuzzing: Recommend combining fuzzing with ASAN

ASAN (ie. Address Sanitizer or -fsanitize=address) adds extra checks for out-of-bounds memory access, use-after-free and other memory checks. It's useful to combine this with fuzzing. Fuzzing can normally only detect paths which cause the binary to crash. But some serious, latent bugs might not cause crashes (eg. a rogue pointer overwrites another object in memory, but the other object is not used or not used in a way that will cause a crash). ASAN turns these kinds of bugs into crashes. See also: https://clang.llvm.org/docs/AddressSanitizer.html https://aflplus.plus/docs/notes_for_asan/ Cherry picked from libnbd commit 43b1b95c981861c5c03cd563cf1b90e1f4c52cf8. RWMJ: Some modifications were required for fuzzing to work with nbdkit. --- fuzzing/README | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fuzzing/README b/fuzzing/README index eeab9744..b2bc6f08 100644 --- a/fuzzing/README +++ b/fuzzing/README @@ -15,6 +15,7 @@ You will need to recompile nbdkit with AFL instrumentation: To use clang instead (recommended with AFL++): + export AFL_USE_ASAN=1 ./configure CC=/usr/bin/afl-clang-lto CXX=/usr/bin/afl-clang-lto++ make clean make @@ -29,14 +30,16 @@ Master: mkdir -p fuzzing/sync_dir export AFL_PRELOAD=./plugins/memory/.libs/nbdkit-memory-plugin.so - afl-fuzz -i fuzzing/testcase_dir -o fuzzing/sync_dir -m 256 -M fuzz01 \ + export ASAN_OPTIONS="allocator_may_return_null=1 detect_leaks=false" + afl-fuzz -i fuzzing/testcase_dir -o fuzzing/sync_dir -M fuzz01 \ ./server/nbdkit -s -t 1 ./plugins/memory/.libs/nbdkit-memory-plugin.so 1M Slaves: # replace fuzzNN with fuzz02, fuzz03, etc. export AFL_PRELOAD=./plugins/memory/.libs/nbdkit-memory-plugin.so - afl-fuzz -i fuzzing/testcase_dir -o fuzzing/sync_dir -m 256 -S fuzzNN \ + export ASAN_OPTIONS="allocator_may_return_null=1 detect_leaks=false" + afl-fuzz -i fuzzing/testcase_dir -o fuzzing/sync_dir -S fuzzNN \ ./server/nbdkit -s -t 1 ./plugins/memory/.libs/nbdkit-memory-plugin.so 1M Test Coverage