build.sh example for go test -fuzz about clusterfuzzlite HOT 16 CLOSED

@AdamKorcz could you perhaps make a sample go 1.18 ClusterFuzzLite integration if this would help?

from clusterfuzzlite.

Ah reading https://google.github.io/clusterfuzzlite/build-integration/#prerequisites it looks like ClusterFuzzLite wants some other kind of fuzz target

ClusterFuzzLite supports libFuzzer targets built with Clang on Linux.

from clusterfuzzlite.

Perhaps I can follow https://google.github.io/oss-fuzz/getting-started/new-project-guide/go-lang/#native-go-fuzzing-support though ? It mentions compile_native_go_fuzzer

from clusterfuzzlite.

ClusterFuzzLite definitely supports non-clang targets. I will change this, this is talking about C/C++ code.
ClusterFuzzLite does support go targets, but it supports go targets fuzzed with libFuzzer, which means I don't think we support go 1.18 fuzzing. We share a lot of the infra with oss-fuzz, and here is the unsubmitted PR: google/oss-fuzz#7519

tl;dr no unless we can fuzz this target with libfuzzer.

from clusterfuzzlite.

@DavidKorczynski just confirming, oss-fuzz doesn't support go 1.18 fuzzing right?

from clusterfuzzlite.

tldr: yes it does and I think it should work here.

@AdamKorcz can you clarify details here?

My personal summary, although Adam knows a lot more about this: OSS-Fuzz supports fuzzing of targets written syntactically for go 1.18 native. These targets, however, are compiled such that they run by way of libFuzzer. A consequence of this is the corpus used for native fuzzing and the OSS-Fuzz style will be incompatible. i.e. you cannot upload your own corpus and reproduction of issues should happen by way of OSS-Fuzz. But besides that, OSS-Fuzz is fully compatible with go 1.18 targets and already larger projects are using it, e.g. Istio (google/oss-fuzz#7992).

from clusterfuzzlite.

Go 1.18 fuzz targets can run on OSS-Fuzz using compile_native_go_fuzzer which changes &testing.F{} to run with libFuzzer. As such, in the process of building Go 1.18 fuzzers on OSS-Fuzz they are made into libFuzzer binaries. All features in libFuzzer will subsequently be available whereas not all features in Go 1.18 fuzzing will.

from clusterfuzzlite.

Perhaps I can follow https://google.github.io/oss-fuzz/getting-started/new-project-guide/go-lang/#native-go-fuzzing-support though ? It mentions compile_native_go_fuzzer

This should work.

from clusterfuzzlite.

tl;dr no unless we can fuzz this target with libfuzzer.

And we should be able to do that with all go 1.18 fuzzers as long as they are compiled by way of compile_native_go_fuzzer (https://github.com/google/oss-fuzz/blob/master/infra/base-images/base-builder/compile_native_go_fuzzer)

from clusterfuzzlite.

Thanks I now have ClusterFuzzLite running in GitHub Actions hickford/merkle#1

my setup https://github.com/hickford/merkle/blob/main/.clusterfuzzlite/Dockerfile and https://github.com/hickford/merkle/blob/main/.clusterfuzzlite/build.sh

However when I tested it by deliberately breaking the test, the workflow succeeded regardless. Any ideas?

2022-07-22 17:01:27,849 - root - INFO - Running fuzzer: FuzzRangeNodes.
[20](https://github.com/hickford/merkle/runs/7472433593?check_suite_focus=true#step:5:21)22-07-22 17:01:27,849 - root - INFO - Downloading corpus for FuzzRangeNodes to /github/workspace/cifuzz-corpus/FuzzRangeNodes.
2022-07-22 17:01:28,056 - root - WARNING - Could not find artifact: cifuzz-corpus-FuzzRangeNodes.
2022-07-22 17:01:28,056 - root - WARNING - Could not download artifact: cifuzz-corpus-FuzzRangeNodes.
2022-07-22 17:01:28,057 - root - INFO - Done downloading corpus. Contains 0 elements.
2022-07-22 17:01:28,057 - root - INFO - Starting fuzzing
INFO: Seed: 1337
INFO: A corpus is not provided, starting from an empty corpus
#2	INITED ft: 43 corp: 1/1b exec/s: 0 rss: 45Mb
#4	NEW    ft: 47 corp: 2/3b lim: 4096 exec/s: 0 rss: 45Mb L: 2/2 MS: 2 ChangeBit-InsertByte-
#6	NEW    ft: 435 corp: 3/124b lim: 4096 exec/s: 0 rss: 45Mb L: 1[21](https://github.com/hickford/merkle/runs/7472433593?check_suite_focus=true#step:5:22)/121 MS: 2 CopyPart-InsertRepeatedBytes-

Fuzz test fails locally as expected within seconds

> go test -fuzz=Range
fuzz: elapsed: 0s, gathering baseline coverage: 0/42 completed
failure while testing seed corpus entry: FuzzRangeNodes/27d3f847ee8ebbcea67cc43e524feee604c2cfaf057db1c57a3d10b5bafd70cf
fuzz: elapsed: 0s, gathering baseline coverage: 0/42 completed
--- FAIL: FuzzRangeNodes (0.05s)
    --- FAIL: FuzzRangeNodes (0.00s)
        node_fuzz_test.go:16: begin=526, end=776
        node_fuzz_test.go:18: nodes=[{1 13} {2 7} {5 1} {6 1} {7 1} {8 1} {8 2} {3 96}]
        node_fuzz_test.go:25: got=26, want=526
    
FAIL
exit status 1
FAIL    github.com/transparency-dev/merkle/compact      2.868s

from clusterfuzzlite.

Thanks I now have ClusterFuzzLite running in GitHub Actions hickford/merkle#1

However when I tested it by deliberately breaking the test, the workflow succeeded regardless. Any ideas?

Fuzz test fails locally

> go test -fuzz=Range
fuzz: elapsed: 0s, gathering baseline coverage: 0/42 completed
failure while testing seed corpus entry: FuzzRangeNodes/27d3f847ee8ebbcea67cc43e524feee604c2cfaf057db1c57a3d10b5bafd70cf
fuzz: elapsed: 0s, gathering baseline coverage: 0/42 completed
--- FAIL: FuzzRangeNodes (0.05s)
    --- FAIL: FuzzRangeNodes (0.00s)
        node_fuzz_test.go:16: begin=526, end=776
        node_fuzz_test.go:18: nodes=[{1 13} {2 7} {5 1} {6 1} {7 1} {8 1} {8 2} {3 96}]
        node_fuzz_test.go:25: got=26, want=526
    
FAIL
exit status 1
FAIL    github.com/transparency-dev/merkle/compact      2.868s

ClusterFuzzLite is not running the libFuzzer binary here. The fuzzer is being run by way of go test -fuzz=.

Your workflow is correctly building the fuzzer with compile_native_go_fuzzer github.com/transparency-dev/merkle/compact FuzzRangeNodes FuzzRangeNodes. This produces the FuzzRangeNodes binary which must run in ClusterFuzzLite.

EDIT: Sorry, I thought that the stacktrace you added was from the CI. Please disregard this message and see the one below.

from clusterfuzzlite.

Thanks I now have ClusterFuzzLite running in GitHub Actions hickford/merkle#1

However when I tested it by deliberately breaking the test, the workflow succeeded regardless. Any ideas?

Fuzz test fails locally as expected

> go test -fuzz=Range
fuzz: elapsed: 0s, gathering baseline coverage: 0/42 completed
failure while testing seed corpus entry: FuzzRangeNodes/27d3f847ee8ebbcea67cc43e524feee604c2cfaf057db1c57a3d10b5bafd70cf
fuzz: elapsed: 0s, gathering baseline coverage: 0/42 completed
--- FAIL: FuzzRangeNodes (0.05s)
    --- FAIL: FuzzRangeNodes (0.00s)
        node_fuzz_test.go:16: begin=526, end=776
        node_fuzz_test.go:18: nodes=[{1 13} {2 7} {5 1} {6 1} {7 1} {8 1} {8 2} {3 96}]
        node_fuzz_test.go:25: got=26, want=526
    
FAIL
exit status 1
FAIL    github.com/transparency-dev/merkle/compact      2.868s

The fuzzer should find this bug in the CI. Could you try increasing the fuzz time to 30 minutes?

from clusterfuzzlite.

Okay, I see the issue here. I will get a fix ready for this.

from clusterfuzzlite.

@hickford This should now have been fixed in https://github.com/AdamKorcz/go-118-fuzz-build. Could you trigger the CI job again and ensure that you are using the latest version of github.com/AdamKorcz/go-118-fuzz-build?

from clusterfuzzlite.

@AdamKorcz Thanks, yes working as expected now. hickford/merkle#1 When I try to break the test, the workflow fails. https://github.com/hickford/merkle/actions/runs/2732014085

from clusterfuzzlite.

@AdamKorcz Thanks, yes working as expected now. hickford/merkle#1 When I try to break the test, the workflow fails. https://github.com/hickford/merkle/actions/runs/2732014085

That is great!

@jonathanmetzman this issue can be closed.

from clusterfuzzlite.