While investigating the urllib3 performance with the `fuzz_requests` I
saw that a lot of tests had been failing with timeouts. I had some
misunderstandings about how oss-fuzz works and that you need light and
quick implementations for the fuzzer to work effectively.
Doing some local testing a single iteration of the fuzzer was taking as
long as 90 seconds.
This change updates the `urllib3` timeouts to be far shorter and reduces
the number of requests the fuzzer tries to do in a single iteration.
This should bring us under the 25 second timeout and hopefully get this
fuzzer closer to working.
This PR adds an extra environment variable to specify target package
prefix of java classes for the jvm frontend. This could ignore unrelated
class in the frontend processing and decrease the time and resources
overhead.
Reference: https://github.com/ossf/fuzz-introspector/pull/938
Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
This PR instructs ASAN to not check for leaks at exit (i.e., after
fuzzing is done), and use only the detection in libfuzzer using lsan's
non-destructive checks.
Currently, the fuzzer reports leaks that only occur because it's
in-process, so they are not true positives. When XS expects to exit (no
`free` immediately before exit), it doesn't actually exit and continues
to the next case. A comprehensive fix would be expensive.
To reduce the amount of false-positives we suppress LSAN in abort paths,
since any allocation would be short lived. However, the at-exit leak
detection still reports non-reproducible leaks when fuzzer is exiting.
We are disabling while we explore other alternatives to fix
comprehensively (a possible one is #7347).
We'll be removing the `_LIBCPP_DEBUG` (which has been deprecated/removed
by LLVM), downstream in https://github.com/bitcoin/bitcoin/pull/27447.
So remove the comment about re-enabling DEBUG=1, as that will no-longer
do anything for the builds here.
We could follow up with getting a Debug Mode build of libc++ available
in the
oss-fuzz environment.
This PR adds a new gss-ntlmssp project.
[gss-ntlmssp](https://github.com/gssapi/gss-ntlmssp) is a mechglue
plugin for [krb5](https://github.com/krb5/krb5) that implements NTLM
authentication via GSSAPI.
The plugin is available in the Debian, Ubuntu and Suse package
repositories.
cc @simo5 as the gss-ntlmssp maintainer.
Fix for an incorrect call to `get_next` that was stopping the Croniter
`fuzz_iter` executing, see
[https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57139#c2](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57139#c2).
It was being called with a `datetime` object instead of a `datetime`
class as it's `ret_type` argument causing a type error. I've removed the
argument that's fixed it.
Also I've added the `undefined` sanitizer as it was missing from the
`project.yaml`. I've done a local run and it works fine with it enabled.
Automatic copying of the source files skipped softlinks which lead to
some include files not being found during coverage generation. With this
patch we now manually deep-copy softlinks in the source tree to their
export target locations.
Julien Voisin