Skip to content

parallel-fuzzing unlikely reports crashes #142

@kateinoigakukun

Description

@kateinoigakukun

When parallel-fuzzing is enabled, libFuzzer tries to find multiple crashes.

For instance:

  1. On a recent GitHub Actions Ubuntu instance with 4 cores, cifuzz passes -jobs=4 to libFuzzer.
  2. libFuzzer limits the number of active workers to half the available cores, resulting in 2 workers.

In this configuration, libFuzzer often times out even if it successfully detects crashes, as it does not timeout only when both workers identify at least one crash. However, cifuzz does not report crashes if the libFuzzer driver times out, even when crashes are detected. This behavior can be observed in the cifuzz implementation: source code.

Consequently, when parallel fuzzing is enabled, cifuzz rarely reports crashes under these conditions.

Example of a live case where crashes were detected but not reported:

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions