search

dvyukov / go-fuzz

Randomized testing for Go
Apache License 2.0
4.79k stars 279 forks source link

go-fuzz hangs when the testee forks a subprocess then crashes #310

Open yasushi-saito opened 3 years ago

yasushi-saito commented 3 years ago

The problem is that the three control FDs (3, 4, 5) used by the testee to communicate with the tester aren't marked close-on-exec. So if the testee forks and dies, the child will keep the tester from completing the reads of the descriptors. Adding

    for _, fd := range []uintptr{3, 4, 5} {
        r1, r2, err := syscall.Syscall(syscall.SYS_FCNTL, fd, syscall.F_GETFD, 0)
        _, _, err = syscall.Syscall(syscall.SYS_FCNTL, fd, syscall.F_SETFD, r1|syscall.FD_CLOEXEC)
    }

at the beginning of Fuzz function fixes this problem. This logic should really be added somewhere go-fuzz-dep/main.go.