search

aws / s2n-tls

An implementation of the TLS/SSL protocols
https://aws.github.io/s2n-tls/usage-guide/
Apache License 2.0
4.48k stars 702 forks source link

Compiler flags for FUZZ_COVERAGE break gcc 4.8,6,9 #2205

Open dougch opened 4 years ago

dougch commented 4 years ago

Security issue notifications

If you discover a potential security issue in s2n we ask that you notify AWS Security via our vulnerability reporting page. Please do not create a public github issue.

Problem:

The error is similar for all gcc versions mentioned

gcc-6: error: unrecognized command line option '-fprofile-instr-generate'; did you mean '-fprofile-generate'?
gcc-6: error: unrecognized command line option '-fcoverage-mapping'; did you mean '-Wcoverage-mismatch'?
Makefile:32: recipe for target 'libs2n.so' failed
make[1]: *** [libs2n.so] Error 1
make[1]: *** Waiting for unfinished jobs....
ranlib libs2n.a
make[1]: Leaving directory '/codebuild/output/src801508609/src/git-codecommit.us-west-2.amazonaws.com/v1/repos/s2n_replica/third-party-src/lib'
Makefile:67: recipe for target 'libs' failed
make: *** [libs] Error 2

[Container] 2020/08/04 20:27:05 Command did not exit successfully $CB_BIN_DIR/s2n_codebuild.sh exit status 2
[Container] 2020/08/04 20:27:05 Phase complete: BUILD State: FAILED
[Container] 2020/08/04 20:27:05 Phase context status code: COMMAND_EXECUTION_ERROR Message: Error while executing command: $CB_BIN_DIR/s2n_codebuild.sh. Reason: exit status 2

Solution:

Tie FUZZ_COVERAGE to a specific CLANG setup, alter these flags for gcc, or explicitly fail fuzz testing if GCC_VERSION is set.

Requirements / Acceptance Criteria:

What must a solution address in order to solve the problem? How do we know the solution is complete?

Builds succeed with FUZZ_COVERAGE=true under gcc versions mentioned.

Out of scope:

Is there anything the solution will intentionally NOT address?

dougch commented 3 years ago

Based on other comments in the Fuzz sections, clang is the only intended target for fuzzing (please correct me if that is not explicitly true). A better outcome might be to stop earlier in the build with an error explaining that GCC_VERSION and TESTS=fuzz is not supported?