MozillaSecurity / lithium

Line-based testcase reducer
Mozilla Public License 2.0
95 stars 25 forks source link

No progress after character reduction #20

Closed kamikazejunk closed 7 years ago

kamikazejunk commented 7 years ago

After I hit character reduction on lithium, there is no progress...:(

Tested on Ubuntu 16.04

After this message was displayed, nothing happened(waited for a hour)... line reduction was succeeded, so I assume my install is fine.


Running character reduction...

/home/kaze/lithium/lithium/lithium.py --char /home/kaze/funfuzz/js/jsInteresting.py --minlevel=5 --timeout=20 mozilla-central shell-cache/js-64-dm-linux-cc65f9233e5b/js-64-dm-linux-cc65f9233e5b --fuzzing-safe --non-writable-jitcode --gc-zeal=8 --no-sse3 --no-baseline --ion-offthread-compile=off --ion-eager --ion-edgecase-analysis=off --ion-limit-script-size=off wtmp2/w16-reduced.js Preparing to run Lithium, log file wtmp2/w16-5-lines-lith-out.txt /usr/bin/python -u /home/kaze/funfuzz/util/../../lithium/lithium/lithium.py --tempdir=wtmp2/w16-5-lines-lith-tmp --char /home/kaze/funfuzz/js/jsInteresting.py --minlevel=5 --timeout=20 mozilla-central shell-cache/js-64-dm-linux-cc65f9233e5b/js-64-dm-linux-cc65f9233e5b --fuzzing-safe --non-writable-jitcode --gc-zeal=8 --no-sse3 --no-baseline --ion-offthread-compile=off --ion-eager --ion-edgecase-analysis=off --ion-limit-script-size=off wtmp2/w16-reduced.js


My temp folder was getting bigger and bigger... I think lithium is looping forever

This is my log file. Am I missing something?

w16-5-lines-lith-out.txt

nth10sd commented 7 years ago

It still hasn't finished yet. The bottom of your log file shows:

Removing a chunk of size 1 starting at 152 of 1223 was a successful reduction :)

and then it was cut out by a KeyboardInterrupt, which I presume to be a Ctrl-C to cancel the command. I'd say let it run a little longer.

nth10sd commented 7 years ago

Moreover we ignore the unhandlable oom assertion messages, so I'm not sure if this testcase is particularly interesting.

kamikazejunk commented 7 years ago

Is there a way to skip this assertion? Everytime I hit this assertion, I need to wait for long time...:(

nth10sd commented 7 years ago

If you have a local FuzzManager instance, you can create a bucket for this type of assertion that the harness will then ignore for future runs. Same goes for other bugs.

kamikazejunk commented 7 years ago

Do I need to configure FuzzManager? or will lithium ignore the same assertion without configuration?

I looked for a documentation, but I can't find how to skip a bug...

nth10sd commented 7 years ago

FuzzManager is located in this repo with setup instructions. You need to create a bucket to "skip" the bug, as funfuzz will check if a bucket of your signature is present before reporting to your instance of FuzzManager.

kamikazejunk commented 7 years ago

In order to skip the bug, is this setting correct?


  1. Go to http://ip-address/crashmanager/signatures/new/?crashid=[crash id]

  2. Check "Mark this bucket as a frequent bucket" and "Reassign matching crashes"

  3. Save

nth10sd commented 7 years ago

If the local cache of signatures that FuzzManager creates, contains your required signature (via your bucket creation), the assertion will be ignored.

Anyway this is now beyond the scope of Lithium. The repo now contains much better tests (thanks @jschwartzentruber!), so please continue to file bugs if Lithium does not work properly for you.