rust-fuzz / libfuzzer

Rust bindings and utilities for LLVM’s libFuzzer
Apache License 2.0
208 stars 44 forks source link

How i can downgrade libFuzzer ? #66

Closed hpkit closed 3 years ago

hpkit commented 3 years ago

I try use https://lib.rs/crates/libfuzzer-sys information to fuzz rust code.

After run: cargo rustc -- \ -C passes='sancov' \ -C llvm-args='-sanitizer-coverage-level=3' \ -Z sanitizer=address

I run my target/debug/fuzzed

And see: -fsanitize-coverage=trace-pc-guard is no longer supported by libFuzzer. Please either migrate to a compiler that supports -fsanitize=fuzzer or use an older version of libFuzzer

How i can use an older version of libFuzzer ?

frewsxcv commented 3 years ago

are you using cargo-fuzz? if so you may need to update https://github.com/rust-fuzz/cargo-fuzz/issues/189

hpkit commented 3 years ago

I try to do this:

1) First create a new cargo project:

$ cargo new --bin fuzzed $ cd fuzzed

2) Then add a dependency on the fuzzer-sys crate and your own crate:

[dependencies] libfuzzer-sys = "0.3.4" your_crate = { path = "../path/to/your/crate" }

3) Change the fuzzed/src/main.rs to fuzz your code:

![no_main]

use libfuzzer_sys::fuzz_target;

fuzz_target!(|data: &[u8]| { // code to fuzz goes here });

4) Build by running the following command: cargo rustc -- -C passes='sancov' -C llvm-args='-sanitizer-coverage-level=3' -Z sanitizer=address

5) And finally, run the fuzzer:

$ ./target/debug/fuzzed

OS Ubuntu 20.04.

frewsxcv commented 3 years ago

Thanks for the info. I can reproduce this on my Mac

frewsxcv commented 3 years ago

If you change it to:

cargo rustc --
  -C passes='sancov'
  -C llvm-args='-sanitizer-coverage-level=3'
  -C llvm-args='-sanitizer-coverage-inline-8bit-counters \
  -Z sanitizer=address

This should resolve your issue. I guess it defaults to -fsanitize-coverage=trace-pc-guard, which is apparently now deprecated. Some more info here: https://clang.llvm.org/docs/SanitizerCoverage.html

I'll update the README

thejh commented 3 years ago

https://github.com/llvm/llvm-project/commit/a523135f97b759040da328e138c911e2b3fdb862 is where the instrumentation was switched over; that's in clang. the deprecation warning is in libfuzzer. therefore, if your libfuzzer is newer than your LLVM/clang version, this happens.