Skip to content

[fuzzer] Run fuzzers both against unmodified libraries, and modified #1237

@behdad

Description

@behdad

For oss-fuzz, we use following options to build library:

FUZZING_CPPFLAGS = \
        -DHB_NDEBUG \
        -DHB_MAX_NESTING_LEVEL=3 \
        -DHB_SANITIZE_MAX_EDITS=3 \
        -DHB_SANITIZE_MAX_OPS_FACTOR=3 \
        -DHB_SANITIZE_MAX_OPS_MIN=128 \
        -DHB_BUFFER_MAX_LEN_FACTOR=3 \
        -DHB_BUFFER_MAX_LEN_MIN=8 \
        -DHB_BUFFER_MAX_LEN_DEFAULT=128 \
        -DHB_BUFFER_MAX_OPS_FACTOR=8 \
        -DHB_BUFFER_MAX_OPS_MIN=64 \
        -DHB_BUFFER_MAX_OPS_DEFAULT=1024 \

This speeds up fuzzing, but can also sometimes limit what fuzzer tests... @kcc always said ideally we should be fuzzing the production library. Indeed, looks like Chrome's clusterfuzz setup runs our fuzzers without the above definition. As such, for example, one of their reproducer fonts would only crash the fuzzer if I removed the above definitions.

So, I'm proposing that we (inside harfbuzz itself), build fuzzer both with and without the above, and test the locally included fonts against both.

Or maybe remove the definitions above completely and monitor oss-fuzz speed to see if there's significant drop in fuzzing speed.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions