google / oss-fuzz

OSS-Fuzz - continuous fuzzing for open source software.
https://google.github.io/oss-fuzz
Apache License 2.0
10.13k stars 2.15k forks source link

immer: Use latest builder #12087

Open maflcko opened 2 weeks ago

github-actions[bot] commented 2 weeks ago

maflcko has previously contributed to projects/immer. The previous PR was #11714

maflcko commented 2 weeks ago

cc @pinotree could you please take a look at the newly reported ubsan error? (I am not familiar with the immer internals myself)


BAD BUILD: /tmp/not-out/tmp1ufsi84i/set-st seems to have either startup crash or exit:
vm.mmap_rnd_bits = 28
/tmp/not-out/tmp1ufsi84i/set-st -rss_limit_mb=2560 -timeout=25 -seed=1337 -runs=4 < /dev/null
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 1337
INFO: Loaded 1 modules   (1565 inline 8-bit counters): 1565 [0x55851266bf88, 0x55851266c5a5), 
INFO: Loaded 1 PC tables (1565 PCs): 1565 [0x55851266c5a8,0x558512672778), 
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
/src/immer/immer/detail/hamts/node.hpp:229:26: runtime error: constructor call on address 0x558513d3afa0 with insufficient space for an object of type 'node_t' (aka 'immer::detail::hamts::node<unsigned long, colliding_hash_t, std::equal_to<void>, immer::memory_policy<immer::heap_policy<immer::cpp_heap>, immer::unsafe_refcount_policy, immer::no_lock_policy, immer::no_transience_policy, false>, 5>')
0x558513d3afa0: note: pointer points here
 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00
              ^ 
    #0 0x5585125e6ce2 in make_inner_n /src/immer/immer/detail/hamts/node.hpp:229:18
    #1 0x5585125e6ce2 in immer::detail::hamts::champ<unsigned long, colliding_hash_t, std::__1::equal_to<void>, immer::memory_policy<immer::heap_policy<immer::cpp_heap>, immer::unsafe_refcount_policy, immer::no_lock_policy, immer::no_transience_policy, false, true>, 5u>::empty() /src/immer/immer/detail/hamts/champ.hpp:142:34
    #2 0x5585125e5170 in set /src/immer/immer/set.hpp:292:20
    #3 0x5585125e5170 in LLVMFuzzerTestOneInput /src/immer/extra/fuzzer/set-st.cpp:38:46
    #4 0x558512547af0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
    #5 0x558512548ff1 in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::__Fuzzer::vector<fuzzer::SizedFile, std::__Fuzzer::allocator<fuzzer::SizedFile>>&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:807:3
    #6 0x5585125495d7 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector<fuzzer::SizedFile, std::__Fuzzer::allocator<fuzzer::SizedFile>>&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:867:3
    #7 0x558512537be6 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:914:6
    #8 0x558512564112 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #9 0x7fe668747082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 0702430aef5fa3dda43986563e9ffcc47efbd75e)
    #10 0x558512528d5d in _start (/tmp/not-out/tmp1ufsi84i/set-st+0x2ad5d)

DEDUP_TOKEN: make_inner_n--immer::detail::hamts::champ<unsigned long, colliding_hash_t, std::__1::equal_to<void>, immer::memory_policy<immer::heap_policy<immer::cpp_heap>, immer::unsafe_refcount_policy, immer::no_lock_policy, immer::no_transience_policy, false, true>, 5u>::empty()--set
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /src/immer/immer/detail/hamts/node.hpp:229:26 in 
MS: 0 ; base unit: 0000000000000000000000000000000000000000
pinotree commented 1 week ago

cc @pinotree could you please take a look at the newly reported ubsan error? (I am not familiar with the immer internals myself)

I'm not a immer developer myself; you better want @arximboldi here.

maflcko commented 1 day ago

I've clarified that the issue is known (https://www.github.com/arximboldi/immer/issues/274) and documented it.

@arximboldi Do you approve the temporary workaround?

DonggeLiu commented 4 hours ago

Temporarily converting this to a draft. Please feel free to convert it back if @arximboldi approves it too.