search

google / oss-fuzz

OSS-Fuzz - continuous fuzzing for open source software.
https://google.github.io/oss-fuzz
Apache License 2.0
10.53k stars 2.23k forks source link

ASAN Rust Timeout #6501

Closed catenacyber closed 3 years ago

catenacyber commented 3 years ago

This is https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39047

I can reproduce the timeout with ASAN :

time /out/fuzz_applayerparserparse_http2 /out/clusterfuzz-testcase-minimized-fuzz_applayerparserparse_http2-4798926234976256 
real    1m48.332s
user    1m47.277s
sys 0m1.048s

But with UBSAN, there is no timeout :

time /out/fuzz_applayerparserparse_http2 /out/clusterfuzz-testcase-minimized-fuzz_applayerparserparse_http2-4798926234976256 
real    0m0.183s
user    0m0.160s
sys 0m0.024s

So, I think the problem is in the sanitizing, not in the software, right ?

By the way, when compiled with export SANITIZER=undefined, there are no additions to RUSTFLAGS...

catenacyber commented 3 years ago

With removing export RUSTFLAGS="$RUSTFLAGS -Cpasses=sancov etc... from the build script, I get in the middle : 


time /out/fuzz_applayerparserparse_http2 /out/clusterfuzz-testcase-minimized-fuzz_applayerparserparse_http2-4798926234976256 
real    0m17.759s
user    0m16.986s
sys 0m0.772s
``
nikic commented 3 years ago

I don't have access to the report, so this is without context: It's possible that asan builds can be very slow due to an implementation issue. I've encountered this in the past with naive realloc usage, where a very large list was created by reallocating by one element each time. For most allocators this is pretty fast, but with asan this will have quadratic runtime due to quarantining.

catenacyber commented 3 years ago

I guess I should do flame graphs so see where the CPU time is spent

maflcko commented 3 years ago

I can also recommend flamegraphs to debug timeout issues, where the underlying cause isn't trivially visible.

catenacyber commented 3 years ago

I guess this has been fixed with latest rust nightly...