search

google / oss-fuzz

OSS-Fuzz - continuous fuzzing for open source software.
https://google.github.io/oss-fuzz
Apache License 2.0
10.31k stars 2.19k forks source link

`compile_native_go_fuzzer`: support _test suffixed packages #7923

Open howardjohn opened 2 years ago

howardjohn commented 2 years ago

Go supports defining tests in package and package_test packages. (https://jdkaplan.dev/thinkin-logs/2021-10-07/). However, when using the latter form we end up with issues:

-: found packages mesh (mesh.go) and mesh_test (mesh_test.go_fuzz_.go) in /src/istio/pkg/config/mesh

cc @AdamKorcz

oliverchang commented 2 years ago

@AdamKorcz @DavidKorczynski friendly ping, thanks!

AdamKorcz commented 2 years ago

This will be fixed once Go fuzzing is fully integrated into Clusterfuzz.

The issue is not a blocker for running the fuzzers in OSS-Fuzz. Istio solved it by not placing tests in package_test but just in package, and their fuzzers are running fine.

I will see if I can find a temporary solution for this until Go fuzzing is fully integrated into Clusterfuzz. I haven't heard of any projects that have to have their tests in package_test which IMO makes this a low-priority issue. If there are any such projects, feel free to leave a comment in this issue.

hickford commented 2 years ago

This will be fixed once Go fuzzing is fully integrated into Clusterfuzz.

@AdamKorcz do you know an issue in https://github.com/google/clusterfuzz to follow?

howardjohn commented 2 years ago

Similar issue - since we move out of the _test.go world, we cannot access things defined in other _test.go files.

example:

common_test.go:

type Foo struct {}

fuzz_test.go:

var x Foo

This compiles in normal go, but with compile_native_go_fuzzer we cannot access Foo.

The workaround is to move test only code into the main code, but that may have wider impacts

howardjohn commented 2 months ago

@AdamKorcz this is really blocking us quite a bit in Istio. We are constantly getting our builds broken by this, and fixing gets increasingly complex for non-trivial packages. Worse, it often involves changing code pretty extensively to workaround OSS-Fuzz specific limitations. Is there any pathway to resolving this?

Istio's fuzzers have been blocked for months on these issues repeatedly popping up

AdamKorcz commented 2 months ago

I am looking into this.