(original) (raw)

Kostya,

I took a quick stab at patching libFuzzer for Apple, but so far I'm thinking something else is incorrect. Patch is attached but when I went to reproduce the examples, the toy example went fine, but with PCRE and Heartbleed I noticed the coverage statistics were pretty poor, and didn't find anything. Admittedly I moved onto Heartbleed pretty quickly so PCRE probably isn't the best judge. But here's a sample log from the Heartbleed session (they were all similar):

$ cat fuzz-11.log

Seed: 3157140177

SetTimer 601

PreferSmall: 1

#0 READ cov 0 bits 0 units 1 exec/s 0

#1 pulse cov 0 bits 0 units 1 exec/s 0

#1 INITED cov 0 bits 0 units 0 exec/s 0

Done 1 runs in 4 second(s)

Any thoughts? Obviously I'm not attached to anything in the patch, just trying to get something working on OS X.

On Wed, Jul 8, 2015 at 11:42 AM, Juan Ceasar <juan.d.ceasar@gmail.com> wrote:

Thanks! I'll give it a shot and see what I can do to give some patches back.

On Wed, Jul 8, 2015 at 9:42 AM, Alexander Potapenko <glider@google.com> wrote:

FWIW see also http://lists.cs.uiuc.edu/pipermail/cfe-dev/2015-June/043301.html
As far as I understand DFSan functionality isn't required for
libFuzzer to work, so it should be safe to disable DFSan support on
Mac.

On Wed, Jul 8, 2015 at 7:45 AM, Kostya Serebryany <kcc@google.com> wrote:

> +pcc , glider
\>
\> On Mon, Jul 6, 2015 at 12:59 PM, Juan Ceasar <juan.d.ceasar@gmail.com>
\> wrote:
\>>
\>> Afternoon,
\>>
\>> I had an issue with trying to link a program with the DataFlowSanitizer
\>> functionality, this is from the libFuzzer project, and I was seeing:
\>>
\>> clang++ -fsanitize=address -fsanitize-coverage=edge test\_fuzzer.cc
\>> Fuzzer\*.o
\>>
\>> Undefined symbols for architecture x86\_64:
\>>
\>> "\_dfsan\_create\_label", referenced from:
\>>
\>> fuzzer::TraceState::DFSanCmpCallback(unsigned long, unsigned long,
\>> unsigned long, unsigned long long, unsigned long long, unsigned short,
\>> unsigned short) in FuzzerTraceState.o
\>>
\>> fuzzer::Fuzzer::InitializeTraceState() in FuzzerTraceState.o
\>>
\>> "\_dfsan\_get\_label\_info", referenced from:
\>>
\>> fuzzer::TraceState::GetLabelRange(unsigned short) in
\>> FuzzerTraceState.o
\>>
\>> .....
\>>
\>> But then looking at the docs:
\>> http://clang.llvm.org/docs/DataFlowSanitizer.html
\>>
\>> It appears that this is only supported under Linux? Is that right?
\>>
\>
\> Correct. AFAICT, DFSan was only tested on Linux.
\> It is quite hard to make it work on Mac because there are too many closed
\> source libraries there.
\> Nothing impossible though -- it's just that nobody has worked on it.
\>
\> libFuzzer was also never tested on Mac, but I think it should be trivial to
\> make it work there.
\> I suspect that the errors you see are caused by the weak function
\> declarations which don't (???) work on Mac.
\> You'll need to #ifdef the weak functions on Mac somehow. Patches and Mac
\> buildbots are welcome :)
\>
\> --kcc
\>
\>>
\>>
\>>
\>> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
\>> LLVM Developers mailing list
\>> LLVMdev@cs.uiuc.edu http://llvm.cs.uiuc.edu
\>> http://lists.cs.uiuc.edu/mailman/listinfo/llvmdev
\>>
\>

--
Alexander Potapenko
Software Engineer

Google Germany GmbH
Dienerstraße 12
80331 München