From b98b9fdef00e2383f63f939e079fe2c9eba87ca1 Mon Sep 17 00:00:00 2001 From: Alexander Bulekov Date: Wed, 2 Dec 2020 11:42:14 -0500 Subject: [PATCH] fuzz: avoid double-fetches by default The generic fuzzer can find double-fetch bugs. However: * We currently have no good way of producing qemu-system reproducers for double-fetch bugs. Even if we can get developers to run the binary-blob reproducers with the qemu-fuzz builds, we currently don't have a minimizer for these reproducers, so they are usually not easy to follow. * Often times the fuzzer will provide a reproducer containing a double-fetch for a bug that can be reproduced without double-fetching. Until we find a way to build nice double-fetch reproducers that developers are willing to look at, lets tell OSS-Fuzz to avoid double-fetches. Signed-off-by: Alexander Bulekov Reviewed-by: Darren Kenny Message-Id: <20201202164214.93867-1-alxndr@bu.edu> Signed-off-by: Thomas Huth --- tests/qtest/fuzz/generic_fuzz.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuzz.c index 262a963d2e..07ad690683 100644 --- a/tests/qtest/fuzz/generic_fuzz.c +++ b/tests/qtest/fuzz/generic_fuzz.c @@ -916,6 +916,7 @@ static GString *generic_fuzz_predefined_config_cmdline(FuzzTarget *t) g_assert(t->opaque); config = t->opaque; + setenv("QEMU_AVOID_DOUBLE_FETCH", "1", 1); setenv("QEMU_FUZZ_ARGS", config->args, 1); setenv("QEMU_FUZZ_OBJECTS", config->objects, 1); return generic_fuzz_cmdline(t);