experimentally enable msan for more projects

[oliverchang]

Based on looking at the apt-get dependencies (build dependencies only) and linking command, here's a list of candidates that we can try turning on MSan for:

• arduinojson
• botan
• brotli
• c-ares
• expat
• file
• icu
• libjpeg-turbo
• libplist
• libteken
• libtsm
• libxml2
• libyaml
• llvm_libcxxabi
• nghttp2
• opus
• pcre2
• re2
• sqlite3
• woff2
• zlib

[oliverchang]

I'll enable these in batches. They will be marked as experimental so ClusterFuzz won't file any bugs.

[oliverchang]

Looks like we have some reports now. Will go through them later today to see if they're legit.

@kcc We are seeing frequent reports of (https://oss-fuzz.com/v2/testcase-detail/6400619004821504). Is there a bug in libFuzzer?

INFO: Seed: 1239563408
INFO: Loaded 1 modules (10616 guards): [0xbe1bf0, 0xbec1d0),
Loading corpus dir: /new
Loading corpus dir: /subset
#0	READ units: 2
==1==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x4e357e in unsigned long fuzzer::TracePC::CollectFeatures<fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long)::$_1>(fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long)::$_1) const::{lambda(unsigned long)#1}::operator()(unsigned long) const /src/libfuzzer/FuzzerTracePC.h:0:11
#1 0x4e30cb in void fuzzer::ValueBitMap::ForEach<unsigned long fuzzer::TracePC::CollectFeatures<fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long)::$_1>(fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long)::$_1) const::{lambda(unsigned long)#1}>(unsigned long fuzzer::TracePC::CollectFeatures<fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long)::$_1>(fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long)::$_1) const::{lambda(unsigned long)#1}) const /src/libfuzzer/FuzzerValueBitMap.h:84:13
#2 0x4d7b64 in CollectFeatures<(lambda at /src/libfuzzer/FuzzerLoop.cpp:411:48)> /src/libfuzzer/FuzzerTracePC.h:138:21
#3 0x4d7b64 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:411
#4 0x4d5dd2 in RunOne /src/libfuzzer/FuzzerInternal.h:95:41
#5 0x4d5dd2 in fuzzer::Fuzzer::ShuffleAndMinimize(std::__1::vector<std::__1::vector<unsigned char, std::__1::allocator<unsigned char> >, std::__1::allocator<std::__1::vector<unsigned char, std::__1::allocator<unsigned char> > > >*) /src/libfuzzer/FuzzerLoop.cpp:389
#6 0x4a7609 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:642:6
#7 0x4981b1 in main /src/libfuzzer/FuzzerMain.cpp:20:10
#8 0x7fd7d1dc282f in __libc_start_main
#9 0x41eb48 in _start
Uninitialized value was created by an allocation of tmp in the stack frame of function _ZNSt3__124uniform_int_distributionIlEclIN6fuzzer6RandomEEElRT_RKNS1_10param_typeE
#0 0x4e5b30 in long std::__1::uniform_int_distribution<long>::operator()<fuzzer::Random>(fuzzer::Random&, std::__1::uniform_int_distribution<long>::param_type const&) /usr/local/include/c++/v1/algorithm:3007
SUMMARY: MemorySanitizer: use-of-uninitialized-value (/mnt/scratch0/clusterfuzz/slave-bot/builds/clusterfuzz-builds_harfbuzz_48132c6a9f4eb8caa27a0464b39f9f1b60230b41/revisions/hb-fuzzer+0x4e357e)
Unique heap origins: 95
Stack depot allocated bytes: 7328
Unique origin histories: 8
History depot allocated bytes: 192
Exiting
MS: 0 ; base unit: 0000000000000000000000000000000000000000

[kcc]

I've done some changes in this code and after objdump inspection I think this problem should be gone now.
Sadly, I still don't have proper testing of libFuzzer with msan upstream.

[oliverchang]

Looks like #473 (comment) stopped happening. Thanks!

[inferno-chromium]

https://oss-fuzz.com/v2/testcases?open=yes&q=msan list looks clean.

[inferno-chromium]

Enabling msan experimental on next batch.

[inferno-chromium]

https://oss-fuzz.com/v2/testcase-detail/5755424336773120 - libteken has a startup bug, but seems legit now seeing other inits like http://web.mit.edu/freebsd/head/sys/teken/stress/teken_stress.c.

[inferno-chromium]

Following are left

./nss/project.yaml
./ffmpeg/project.yaml
./weechat/project.yaml
./lcms/project.yaml
./dlplibs/project.yaml
./util-linux/project.yaml
./libpng/project.yaml
./postgresql/project.yaml
./strongswan/project.yaml
./mosh/project.yaml
./h2o/project.yaml
./curl/project.yaml
./netdata/project.yaml
./tpm2/project.yaml
./dropbear/project.yaml
./tor/project.yaml
./freetype2/project.yaml
./libarchive/project.yaml
./guetzli/project.yaml
./pidgin/project.yaml
./speex/project.yaml
./realm-core/project.yaml
./libprotobuf-mutator/project.yaml
./libass/project.yaml
./libchewing/project.yaml
./wireshark/project.yaml
./nodejs/project.yaml
./qpid-proton/project.yaml
./grpc/project.yaml
./coreutils/project.yaml
./gnutls/project.yaml
./libreoffice/project.yaml
./libssh/project.yaml
./openssl/project.yaml
./irssi/project.yaml
./nginx/project.yaml
./ots/project.yaml

[oliverchang]

I think we're going to see a lot more false positives from these. I based on the original list on the apt-get dependencies and link command in build.sh