Open Shnatsel opened 5 years ago
Shnatsel
commented
5 years ago In an ideal world I'd like to toggle this behavior persistently for each fuzzing target, but unconditional -Cpanic=abort makes it impossible. The best way forward that I see is --ignore-panics flag for cargo fuzz run
Manishearth
commented
5 years ago I think the panic infrastructure messes with fuzzing somehow so it's disabled for that reason too. You're free to try it and if it works, make a PR with the flag.
The expected thing to do with such cases is to filter the input beforehand
Shnatsel
commented
5 years ago For future reference, I currently have no plans to implement this feature by myself because use of libfuzzer in my project is blocked by #174 anyway.
douglas-raillard-arm
commented
11 months ago I was also looking into fuzzing but my only goal is to find hard crashes (segfaults). I know my API can panic in some circumstances, so cargo fuzz stopping on them is not very useful to me.
EDIT: for reference, I'm trying to fuzz a file format parser, so filtering the input is basically impossible
kpcyrd
commented
11 months ago I was wondering if maybe std::panic::catch_unwind would work for this, but it didn't:
#![no_main]
use libfuzzer_sys::fuzz_target;
fn this_panics(buf: &[u8]) {
if buf.len() > 5 {
panic!("oh no");
}
}
fuzz_target!(|data: &[u8]| {
std::panic::catch_unwind(|| {
this_panics(data);
}).ok();
});
I'm looking into fuzzing parts of Rust standard library to detect bugs such as CVE-2018-1000810. See also: the fix.
However, this is currently impossible with cargo-fuzz because it passes
-Cpanic=abortduring compilation, while for this function panic on overflow is the expected behavior. I need a way to disable that.