You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@brpc.apache.org by "li-lizhe (via GitHub)" <gi...@apache.org> on 2026/10/04 13:18:49 UTC
[PR] fix(fuzzing): return 0 (not 1) from the size guard in every harness (brpc)
li-lizhe opened a new pull request, #3579:
URL: https://github.com/apache/brpc/pull/3579
`LLVMFuzzerTestOneInput` may only return `0` (input consumed) or `-1` (input rejected). libFuzzer enforces this after every call — `assert(CBRes == 0 || CBRes == -1)` in `compiler-rt/lib/fuzzer/FuzzerLoop.cpp:622` — and its first input is the empty one, so every harness here aborts an assert-enabled libFuzzer at startup.
All 18 harnesses under `test/fuzzing/` open with
```c
if (size < kMinInputLength || size > kMaxInputLength){
return 1; // not a legal return value
}
```
Fixes #3578 — `return 1;` becomes `return 0;` in all 18 files.
`return -1` would also satisfy the contract if these inputs should be rejected outright; `return 0` is used here because it matches what the newer harnesses already do (`test/fuzzing/fuzz_rtmp.cpp` in #3516). Either way the body is still skipped, so behaviour for in-range inputs is unchanged.
### Verification
Standalone driver asserting the exact contract libFuzzer enforces (`assert(r == 0 || r == -1)`, clang 17.0.6, openEuler 24.03, aarch64):
| build | `LLVMFuzzerTestOneInput(empty, 0)` | result |
| --- | --- | --- |
| before (`return 1`) | `1` | `Assertion 'r == 0 || r == -1' failed` → `Aborted (core dumped)`, exit 134 |
| after (`return 0`) | `0` | `return-value contract satisfied: CBRes=0`, exit 0 |
The fixed harness also links and runs under a real libFuzzer (`clang++ -std=c++17 -fsanitize=fuzzer`, `./fuzz -runs=5` → `Done 5 runs in 0 second(s)`, exit 0).
Not tested: a full brpc build + OSS-Fuzz run — the harnesses link the brpc libraries, which were not built here. The change is a single return value per file and touches no harness logic.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@brpc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@brpc.apache.org
For additional commands, e-mail: dev-help@brpc.apache.org
Re: [PR] fix(fuzzing): return 0 (not 1) from the size guard in every harness (brpc)
Posted by "wasphin (via GitHub)" <gi...@apache.org>.
wasphin merged PR #3579:
URL: https://github.com/apache/brpc/pull/3579
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@brpc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@brpc.apache.org
For additional commands, e-mail: dev-help@brpc.apache.org
Re: [PR] fix(fuzzing): return 0 (not 1) from the size guard in every harness (brpc)
Posted by "wwbmmm (via GitHub)" <gi...@apache.org>.
wwbmmm commented on PR #3579:
URL: https://github.com/apache/brpc/pull/3579#issuecomment-5981399479
LGTM
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@brpc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@brpc.apache.org
For additional commands, e-mail: dev-help@brpc.apache.org