Skip to content
Merged
Show file tree
Hide file tree
Changes from 12 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions infra/experimental/chronos/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
# Usage
Under `OSS-Fuzz` root directory:
```bash
export PROJECT=libiec61850
export FUZZ_TARGET=fuzz_mms_decode.c
export FUZZING_LANGUAGE=c
infra/experimental/chronos/prepare-recompile "$PROJECT" "$FUZZ_TARGET" "$FUZZING_LANGUAGE"
python infra/helper.py build_image "$PROJECT"
docker run -ti --entrypoint="compile" --name "${PROJECT}-origin" "gcr.io/oss-fuzz/${PROJECT}"
Copy link
Collaborator

@DavidKorczynski DavidKorczynski Aug 7, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

when compile is run here, SANITIZER wont be set and consequently we won't set the any sanitizer flags in the following code (since sanitizer is '') (

if [ -z "${SANITIZER_FLAGS-}" ]; then
FLAGS_VAR="SANITIZER_FLAGS_${SANITIZER}"
export SANITIZER_FLAGS=${!FLAGS_VAR-}
fi
) as we want the relevant variables here
ENV SANITIZER_FLAGS_address "-fsanitize=address -fsanitize-address-use-after-scope"
ENV SANITIZER_FLAGS_hwaddress "-fsanitize=hwaddress -fuse-ld=lld -Wno-unused-command-line-argument"
# Set of '-fsanitize' flags matches '-fno-sanitize-recover' + 'unsigned-integer-overflow'.
ENV SANITIZER_FLAGS_undefined "-fsanitize=array-bounds,bool,builtin,enum,function,integer-divide-by-zero,null,object-size,return,returns-nonnull-attribute,shift,signed-integer-overflow,unsigned-integer-overflow,unreachable,vla-bound,vptr -fno-sanitize-recover=array-bounds,bool,builtin,enum,function,integer-divide-by-zero,null,object-size,return,returns-nonnull-attribute,shift,signed-integer-overflow,unreachable,vla-bound,vptr"
# Don't include "function" since it is unsupported on aarch64.
ENV SANITIZER_FLAGS_undefined_aarch64 "-fsanitize=array-bounds,bool,builtin,enum,integer-divide-by-zero,null,object-size,return,returns-nonnull-attribute,shift,signed-integer-overflow,unsigned-integer-overflow,unreachable,vla-bound,vptr -fno-sanitize-recover=array-bounds,bool,builtin,enum,integer-divide-by-zero,null,object-size,return,returns-nonnull-attribute,shift,signed-integer-overflow,unreachable,vla-bound,vptr"
ENV SANITIZER_FLAGS_memory "-fsanitize=memory -fsanitize-memory-track-origins"
ENV SANITIZER_FLAGS_thread "-fsanitize=thread"
ENV SANITIZER_FLAGS_introspector "-O0 -flto -fno-inline-functions -fuse-ld=gold -Wno-unused-command-line-argument"
# Do not use any sanitizers in the coverage build.
ENV SANITIZER_FLAGS_coverage ""

For OFG we need to have two different builds:
SANITIZER == 'coverage'
SANITIZER == 'address'
but I assume in general it's intended to use this with sanitizers, which might make it nice to show how to do this in the README. I think just adding -e SANITIZER="address" to the docker run command would do the job

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@DonggeLiu re #11937 (comment) -- I think my comment only applies to the README for now

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK Done

docker commit "${PROJECT}-origin" "gcr.io/oss-fuzz/${PROJECT}-ofg-cached"
docker run -ti --entrypoint="recompile" "gcr.io/oss-fuzz/${PROJECT}-ofg-cached"
```
74 changes: 74 additions & 0 deletions infra/experimental/chronos/chronos.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,74 @@
# Copyright 2024 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
################################################################################

# This script records the ENV and commands needed for fuzz target recompilation.
# It intercepts bash commands to save: 1) the ENV variable values before
# building the fuzz target (`recompile_env.sh`) and 2) all subsequent bash
# commands from that point (`recompile`). Combined with Docker, this setup
# allows for recompiling the fuzz target without rebuilding the entire project.
# Usage:
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please add a general high level few sentences as a comment to describe how this script works?

e.g.

# This script intercepts commands in the build process of a project, and records all bash commands (and env variable values) from the point that the fuzz target source is encountered....

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done, thanks

# 1. Set FUZZ_TARGET (e.g., in project's Dockerfile)
# 2. Source this file before compiling the fuzz target (e.g., source chronos.sh
# at the beginning of project's build.sh).

export START_RECORDING="false"
RECOMPILE_ENV="/usr/local/bin/recompile_env.sh"


# Initialize the recompile script.
initialize_recompile_script() {
export RECOMPILE_SCRIPT="/usr/local/bin/recompile"
echo "#!/bin/bash" > "$RECOMPILE_SCRIPT"
echo "source $RECOMPILE_ENV" >> "$RECOMPILE_SCRIPT"
chmod +x "$RECOMPILE_SCRIPT"
}


# Execute or record command for recompilation.
execute_or_record_command() {
record_command() {
echo "cd \"$(pwd)\"" >> "$RECOMPILE_SCRIPT"
echo "$@" >> "$RECOMPILE_SCRIPT"
}

# Check if any element in the command array contains the FUZZ_TARGET.
if [[ "$BASH_COMMAND" == *"$FUZZ_TARGET"* ]]; then
export START_RECORDING="true"
# Save all environment variables, excluding read-only ones
declare -p | grep -Ev 'declare -[^ ]*r[^ ]*' > "$RECOMPILE_ENV"
fi

if [[ "$START_RECORDING" == "true" ]]; then
record_command "$BASH_COMMAND"
echo "Recorded execution of: $BASH_COMMAND"
fi
}


main() {
# Initialize.
initialize_recompile_script

# Set up trap for DEBUG to intercept commands.
trap 'execute_or_record_command' DEBUG

# Enable extended debugging mode
shopt -s extdebug
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

neat!

# Ensure trap works in subshells and functions.
set -T
}

main
42 changes: 42 additions & 0 deletions infra/experimental/chronos/prepare-recompile
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
#!/usr/bin/bash
# Copyright 2024 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
################################################################################

# Prepare a project for fuzz target recompilation via chronos.sh
# Usage:
# (in OSS-Fuzz root dir) infra/experimental/chronos/prepare-recompile.sh <project> <fuzz-target-name> <fuzzing-language>
# E.g.:
#infra/experimental/chronos/prepare-recompile.sh libiec61850 fuzz_mms_decode.c c



PROJECT=$1
FUZZ_TARGET=$2
FUZZING_LANGUAGE=$3

# Step 1: Copy chronos.sh to its project directory.
cp infra/experimental/chronos/chronos.sh "projects/$PROJECT/"

# Step 2: Copy chronos.sh to image and set FUZZ_TARGET and FUZZING_LANGUAGE in its Dockerfile.
{
echo "COPY chronos.sh /src";
echo "ENV FUZZ_TARGET=\"$FUZZ_TARGET\"";
echo "ENV FUZZING_LANGUAGE=\"$FUZZING_LANGUAGE\"";
} >> "projects/$PROJECT/Dockerfile"

# Step 3: Source chronos.sh at the beginning of its build.sh.
sed -i.bak "1s|^|source \"/src/chronos.sh\"\n|" "projects/$PROJECT/build.sh"

Loading