[pull] master from google:master - #211
Merged
Merged
Conversation
[hobbes](https://github.com/morganstanley/hobbes) is an embedded compiler and JIT for structured data, used to write low-latency trading systems and to store and query the data they produce. I am the primary contact and a maintainer on the project; the harnesses and the build script were merged upstream in [morganstanley/hobbes#531](morganstanley/hobbes#531). ## Fuzz targets Three harnesses, covering the surfaces that take untrusted bytes: | target | surface | |---|---| | `fuzz-type-decode` | the binary type decoder | | `fuzz-fregion-reader` | the fregion structured-log file reader | | `fuzz-parse-expr` | the expression parser (ships a dictionary and a seed corpus) | They live in `fuzz/` in the project tree alongside the real build script, which `projects/hobbes/build.sh` is a one-line wrapper around, so that a change to a harness and the change to its build land in one commit. ## Configuration notes - **MemorySanitizer is not enabled.** hobbes links LLVM from an apt package, and MSan needs every dependency instrumented. - **Centipede is not enabled.** Its prebuilt runner is compiled against libc++, while this build must drop `-stdlib=libc++` to match the libstdc++ LLVM it links; the two cannot be linked together (`undefined reference to std::__1::bad_function_call`). - **A per-target `.options` file disables ASan's `detect_container_overflow`.** hobbes links an LLVM that OSS-Fuzz did not build, so the two disagree about `std::vector`'s container annotations. - **`fuzz-parse-expr` also disables leak detection.** It reuses one `hobbes::cc` whose boot-code arenas are not reclaimed per input, so LSan reports them (23166 bytes in 422 allocations, from `hobbes::cc::cc()`). ## Testing Built and run locally against the current `main` of the project, in the OSS-Fuzz container: | command | result | |---|---| | `build_fuzzers --sanitizer address` + `check_build` | pass | | `build_fuzzers --sanitizer undefined` + `check_build` | pass | | `build_fuzzers --engine afl` + `check_build` | pass | | `build_fuzzers --engine honggfuzz` + `check_build` | pass | | `run_fuzzer` × 3 targets, `-runs=2000` | pass, no crashes | `$OUT` is about 120 MB, and a fuzzer build takes roughly three minutes on eight cores. `ldd` on each target inside `base-runner` resolves every dependency; LLVM is linked statically. The same harnesses also run on every pull request to the project through ClusterFuzzLite, sharing this build script.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )