The elfutils project was integrated into OSS-Fuzz in
https://github.com/google/oss-fuzz/pull/6670 where
Dockerfile pointed to a fork of the official repository
with a series of patches that were supposed to make it compile
on OSS-Fuzz. Apart from that there was a fuzz target that
effectively wrapped the readelf utility by applying a patch
to its source code. On the whole it worked at the time
but I think there are a few issues:
1. It's hard to point OSS-Fuzz to the official repository
(because most of the patches touch the build system and
they can't always be applied cleanly);
2. It's almost impossible to add new fuzz targets covering
other use cases;
3. It's not possible to build fuzz targets without Docker
4. Since the fuzz target mostly wraps the readelf utility
it looks more like a CLI tool than a fuzz target. It calls
exit when it should just return 0 to let it keep going
and so on.
This PR should addresses all those issues apart from 4. The fuzz
target was just removed and another one was added instead. (It can
be added later though but since it isn't exactly maintainable with
the build script pointing at the official repository it should
probably be rewritten:
https://sourceware.org/pipermail/elfutils-devel/2021q4/004295.html)
The new fuzz target covers the code that `systemd` uses to parse
untrusted data. Currently it can be used to trigger various issues
like heap-buffer-overflows and inifinite loops that in theory can bring down
coredump processing on machines where systemd-coredump is used by
default. Even though those issues were discovered by one of `systemd`
fuzz targets I think elfutils bugs should be caught and reported
by elfutils fuzz targets.
Evgeny Vereshchagin