51 lines
2.1 KiB
Markdown
51 lines
2.1 KiB
Markdown
 
|
# Coverage-guided fuzzing of parsers with libFuzzer + ASan/UBSan in CI
|
||
|
|
|
||
|
|
## Metadata
|
||
|
|
|
||
|
|
| Field | Value |
|
||
|
|
|---|---|
|
||
|
|
| Institute | Molodetz Institute — Research & Retrieval Division |
|
||
|
|
| Subject | safe-cpp-practices |
|
||
|
|
| Document type | Source Dossier |
|
||
|
|
| Tier | 1 |
|
||
|
|
| Source title | Coverage-guided fuzzing of parsers with libFuzzer + ASan/UBSan in CI |
|
||
|
|
| Source URL | https://appsec.guide/docs/fuzzing/c-cpp/libfuzzer/ |
|
||
|
|
| Source publisher / author | Trail of Bits (appsec.guide); debugg.ai |
|
||
|
|
| Source type | vendor docs |
|
||
|
|
| Source date (published) | Unknown — not stated |
|
||
|
|
| Date researched | 2026-10-27 |
|
||
|
|
| Researched by | tai (agent), model: Claude Opus 4.8, on behalf of retoor |
|
||
|
|
| Research method | web search synthesis |
|
||
|
|
| Confidence | High |
|
||
|
|
| Status | Active |
|
||
|
|
|
||
|
|
## Summary
|
||
|
|
|
||
|
|
The standard way to harden an untrusted binary parser: a fuzz harness per entry point, built with -fsanitize=fuzzer,address,undefined and -fno-sanitize-recover, run short on every push and long nightly, with a regression corpus of past crashes rerun on every build.
|
||
|
|
|
||
|
|
## Key findings
|
||
|
|
|
||
|
|
- Build with `-fsanitize=fuzzer,address,undefined` and `-fno-sanitize-recover` so a finding aborts rather than warns.
|
||
|
|
- One harness per untrusted-input entry point, with bounded input sizes.
|
||
|
|
- Keep a regression corpus of past crashing inputs and rerun it on every build.
|
||
|
|
- 'No crashes' only means something if the harness reaches the risky code, so track coverage.
|
||
|
|
- ASan adds ~2-4x runtime; it is a test tool, not a release one.
|
||
|
|
|
||
|
|
## Pros / strengths
|
||
|
|
|
||
|
|
Concrete, matches industry practice; the regression-corpus rule is exactly what turns an unreproducible bug into a permanent test.
|
||
|
|
|
||
|
|
## Cons / limitations / caveats
|
||
|
|
|
||
|
|
libFuzzer is now maintenance-only at LLVM (successor: Centipede); the CI pattern is unaffected but tool choice may shift.
|
||
|
|
|
||
|
|
## Relevance to tai
|
||
|
|
|
||
|
|
detz adopts the pattern at its scale: a deterministic hostile-input test plus a random-input fuzz in whatsapp_test, run under ASan+UBSan via tools/san-whatsapp.sh, and a captured-frame file as the regression corpus seed.
|
||
|
|
|
||
|
|
## Changelog
|
||
|
|
|
||
|
|
| Date | Change |
|
||
|
|
|---|---|
|
||
|
|
| 2026-10-27 | Initial dossier created (web search synthesis). |
|