Skip to content

Regression in loading dictionary #1675

@ligurio

Description

@ligurio

I'm maintaining a Lua project in OSS Fuzz and recently discovered that Centipede cannot parse dictionaries for a couple of tests (fuzz_lua and lua_dump_test):

Step #23 - "build-check-centipede-none-x86_64": /tmp/not-out/tmpu8iz7olo/centipede --workdir=/tmp/tmpmk27ueot --corpus_dir="/tmp/fuzz_lua_corpus" --fork_server=1 --exit_on_crash=1 --timeout=1200 --rss_limit_mb=4096 --address_space_limit_mb=5120 --dictionary fuzz_lua.dict --binary="/tmp/not-out/tmpu8iz7olo/fuzz_lua"
Step #23 - "build-check-centipede-none-x86_64": I0430 06:31:55.624831   26982 environment.cc:365] --timeout_per_batch default wasn't overridden; auto-computed to be 4616 sec (see --help for details)
Step #23 - "build-check-centipede-none-x86_64": I0430 06:31:55.631664   26982 centipede.cc:177] shard=0 inputs_added=0 inputs_ignored=0 num_shard_bytes=0 shard_data.size()=0 
Step #23 - "build-check-centipede-none-x86_64": I0430 06:31:55.631881   26982 centipede_interface.cc:220] Coverage dir: /tmp/tmpmk27ueot/fuzz_lua-ce5d6128477ed6243045ff61a9906edc8526d5ed; temporary dir: /tmp/centipede-26982-140463982925632
Step #23 - "build-check-centipede-none-x86_64": F0430 06:31:55.633569   26982 centipede_callbacks.cc:279] Check failed: !unpacked_dictionary.empty() Empty or corrupt dictionary file: fuzz_lua.dict
Step #23 - "build-check-centipede-none-x86_64": *** Check failure stack trace: ***
Step #23 - "build-check-centipede-none-x86_64":     @     0x555dc14475f4  absl::lts_20230125::log_internal::LogMessage::SendToLog()
Step #23 - "build-check-centipede-none-x86_64":     @     0x555dc1447353  absl::lts_20230125::log_internal::LogMessage::Flush()
Step #23 - "build-check-centipede-none-x86_64":     @     0x555dc1447989  absl::lts_20230125::log_internal::LogMessageFatal::~LogMessageFatal()
Step #23 - "build-check-centipede-none-x86_64":     @     0x555dc140d2be  centipede::CentipedeCallbacks::LoadDictionary()
Step #23 - "build-check-centipede-none-x86_64":     @     0x555dc13e2ca3  centipede::CentipedeDefaultCallbacks::CentipedeDefaultCallbacks()
Step #23 - "build-check-centipede-none-x86_64":     @     0x555dc13e2ab2  centipede::DefaultCallbacksFactory<>::create()
Step #23 - "build-check-centipede-none-x86_64":     @     0x555dc13e519c  centipede::CentipedeMain()
Step #23 - "build-check-centipede-none-x86_64":     @     0x555dc13e24a8  main
Step #23 - "build-check-centipede-none-x86_64":     @     0x7fc051d0e083  __libc_start_main
Step #23 - "build-check-centipede-none-x86_64": /usr/local/bin/run_fuzzer: line 227: 26982 Aborted   

How to reproduce

git clone https://github.com/google/oss-fuzz
cd oss-fuzz
python infra/helper.py build_image lua
python infra/helper.py build_fuzzers --sanitizer none --engine centipede --architecture x86_64 lua

python infra/helper.py check_build --sanitizer none --engine centipede --architecture x86_64 lua lua_dump_test

or 

python infra/helper.py check_build --sanitizer none --engine centipede --architecture x86_64 lua fuzz_lua

The dictionaries used by these tests:

https://github.com/ligurio/lua-c-api-corpus/blob/198cc2c8de50d7dcf76c7840889059da4e6ae3f8/lua_dump_test.dict
https://github.com/ligurio/lua-c-api-corpus/blob/198cc2c8de50d7dcf76c7840889059da4e6ae3f8/fuzz_lua.dict

The commit 1635d42 is suspicious.

Related issue in OSS Fuzz repository - google/oss-fuzz#13273

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions