search

google / atheris

Apache License 2.0
1.38k stars 111 forks source link

Unable to execute target in fork mode #50

Closed arisKoutsou closed 1 year ago

arisKoutsou commented 1 year ago

I am trying to achieve parallel fuzzing with -fork=1. When the invocation looks like

/usr/bin/python3.9 /fuzz_harness.py -shuffle=1 -fork=1 -ignore_crashes=1 -ignore_timeouts=1 -ignore_oom=1

I am getting the following error:

INFO: Loaded 1 PC tables (2722 PCs): 2722 [0xfbf410,0xfc9e30), 
INFO: -fork=1: fuzzing in separate process(s)
INFO: -fork=1: 0 seed inputs, starting to fuzz in /tmp/libFuzzerTemp.FuzzWithFork8.dir
#0: cov: 0 ft: 0 corp: 0 exec/s 0 oom/timeout/crash: 0/0/0 time: 0s job: 1 dft_time: 0
INFO: log from the inner process:
sh: 1: fuzz_harness.py: not found
INFO: exiting: 127 time: 0s

This is due to sys.argv being set to ['fuzz_harness.py'] in atheris.Setup(sys.argv, TestOneInput). The error is even worse with -ignore_crashes=1 where the fuzzer keeps on restarting and reporting 0 stats. I was able to work around this by making the python file executable by adding a shebang line at the top. Can this be handled in some other way?

TheShiftedBit commented 1 year ago

Your solution is likely the best, and what I typically do.

We could solve this for the normal case by prepending sys.executable to the argv array passed to libFuzzer. However, that would cause issues in weirder caser. For example, with PyInstaller, sys.executable isn't quite the right thing to run. (PyInstaller is important to support, as it's used by OSS-Fuzz).

jvoisin commented 1 year ago

I agree, the shebang is the least worse way.