You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@thrift.apache.org by "kpumuk (via GitHub)" <gi...@apache.org> on 2026/03/11 23:48:42 UTC
[PR] THRIFT-5855: Implemented Ruby fuzzing [thrift]
kpumuk opened a new pull request, #3339:
URL: https://github.com/apache/thrift/pull/3339
<!-- Explain the changes in the pull request below: -->
This PR implements fuzzing for Ruby library using https://github.com/trailofbits/ruzzy, a coverage-guided fuzzer for pure Ruby code and Ruby C extensions based on libFuzzer. Implemented binary, compact, and JSON protocol fuzzers.
A separate PR will follow to address OOM and a crash caused by unchecked memory allocation in structs.
<!-- We recommend you review the checklist/tips before submitting a pull request. -->
- [x] Did you create an [Apache Jira](https://issues.apache.org/jira/projects/THRIFT/issues/) ticket? [THRIFT-5855](https://issues.apache.org/jira/browse/THRIFT-5855)
- [x] If a ticket exists: Does your pull request title follow the pattern "THRIFT-NNNN: describe my issue"?
- [x] Did you squash your changes to a single commit? (not required, but preferred)
- [x] Did you do your best to avoid breaking changes? If one was needed, did you label the Jira ticket with "Breaking-Change"?
- [ ] If your change does not involve any code, include `[skip ci]` anywhere in the commit message to free up build resources.
<!--
The Contributing Guide at:
https://github.com/apache/thrift/blob/master/CONTRIBUTING.md
has more details and tips for committing properly.
-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@thrift.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] THRIFT-5855: Implemented Ruby fuzzing [thrift]
Posted by "kpumuk (via GitHub)" <gi...@apache.org>.
kpumuk commented on code in PR #3339:
URL: https://github.com/apache/thrift/pull/3339#discussion_r2924025934
##########
lib/rb/test/fuzz/fuzz_common.rb:
##########
@@ -0,0 +1,95 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+$:.unshift File.expand_path('../../lib', __dir__)
+$:.unshift File.expand_path('../../ext', __dir__)
+require 'thrift'
+$:.unshift File.dirname(__FILE__) + "/gen-rb"
+require 'fuzz_test_constants'
+
+require 'coverage'
+Coverage.start(branches: true) unless Coverage.respond_to?(:running?) && Coverage.running?
+require 'ruzzy'
+# Ruzzy.enable_branch_coverage_hooks
+
+def ignorable_fuzz_exception?(error)
+ return true if error.is_a?(Thrift::ProtocolException) ||
+ error.is_a?(EOFError) ||
+ error.is_a?(Encoding::UndefinedConversionError)
+
+ [
Review Comment:
These errors are defence mechanism against corrupted data, and are expected during fuzzing. Other languages do a broader "allowance", for example Python says
```py
except Exception:
# We expect various exceptions during fuzzing
pass
```
I chose to be extremely specific in what we ignore, and listed the ones we raise from the Thrift library code.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@thrift.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] THRIFT-5855: Implemented Ruby fuzzing [thrift]
Posted by "mhlakhani (via GitHub)" <gi...@apache.org>.
mhlakhani commented on code in PR #3339:
URL: https://github.com/apache/thrift/pull/3339#discussion_r2922600143
##########
lib/rb/test/fuzz/README.md:
##########
@@ -0,0 +1,99 @@
+# Ruby Fuzzing README
+
+The Ruby Thrift implementation uses [Ruzzy](https://github.com/trailofbits/ruzzy) for fuzzing. Ruzzy is a coverage-guided fuzzer for pure Ruby code and Ruby C extensions.
+
+We currently have several fuzz targets that test different aspects of the Thrift implementation:
+
+- `fuzz_parse_binary_protocol.rb` -- fuzzes deserialization of the Binary protocol
+- `fuzz_parse_binary_protocol_accelerated.rb` -- fuzzes deserialization of the accelerated Binary protocol
+- `fuzz_parse_compact_protocol.rb` -- fuzzes deserialization of the Compact protocol
+- `fuzz_parse_json_protocol.rb` -- fuzzes deserialization of JSON protocol messages
+- `fuzz_roundtrip_binary_protocol.rb` -- fuzzes Binary roundtrips (deserialize, serialize, deserialize, compare)
+- `fuzz_roundtrip_binary_protocol_accelerated.rb` -- fuzzes accelerated Binary roundtrips
+- `fuzz_roundtrip_compact_protocol.rb` -- fuzzes Compact roundtrips
+- `fuzz_roundtrip_json_protocol.rb` -- fuzzes JSON message roundtrips
+
+The runnable files in this directory are tracer entrypoints. Ruzzy requires that pure Ruby fuzzing starts from a tracer script which then loads a separate harness, so do not invoke the matching `_harness.rb` files directly.
+
+The fuzzers use Ruzzy's mutation engine to generate test cases. Each target uses common testing code from `fuzz_common.rb`.
+
+For more information about Ruzzy and its options, see the [Ruzzy documentation](https://github.com/trailofbits/ruzzy).
+
+You can also use the corpus generator from the Rust implementation to generate initial Binary and Compact corpora that can be reused by the Ruby fuzzers, since those wire formats are identical between implementations.
+
+## Usage
+
+```bash
Review Comment:
should some of these commands be in a makefile or equivalent (similar to what we have for other fuzzers)?
##########
lib/rb/test/fuzz/fuzz_common.rb:
##########
@@ -0,0 +1,95 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+$:.unshift File.expand_path('../../lib', __dir__)
+$:.unshift File.expand_path('../../ext', __dir__)
+require 'thrift'
+$:.unshift File.dirname(__FILE__) + "/gen-rb"
+require 'fuzz_test_constants'
+
+require 'coverage'
+Coverage.start(branches: true) unless Coverage.respond_to?(:running?) && Coverage.running?
+require 'ruzzy'
+# Ruzzy.enable_branch_coverage_hooks
+
+def ignorable_fuzz_exception?(error)
+ return true if error.is_a?(Thrift::ProtocolException) ||
+ error.is_a?(EOFError) ||
+ error.is_a?(Encoding::UndefinedConversionError)
+
+ [
Review Comment:
I don't know the Ruby implementation too well so excuse me if this is dumb - what makes these ignorable?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@thrift.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] THRIFT-5855: Implemented Ruby fuzzing [thrift]
Posted by "kpumuk (via GitHub)" <gi...@apache.org>.
kpumuk commented on code in PR #3339:
URL: https://github.com/apache/thrift/pull/3339#discussion_r2924065762
##########
lib/rb/test/fuzz/README.md:
##########
@@ -0,0 +1,99 @@
+# Ruby Fuzzing README
+
+The Ruby Thrift implementation uses [Ruzzy](https://github.com/trailofbits/ruzzy) for fuzzing. Ruzzy is a coverage-guided fuzzer for pure Ruby code and Ruby C extensions.
+
+We currently have several fuzz targets that test different aspects of the Thrift implementation:
+
+- `fuzz_parse_binary_protocol.rb` -- fuzzes deserialization of the Binary protocol
+- `fuzz_parse_binary_protocol_accelerated.rb` -- fuzzes deserialization of the accelerated Binary protocol
+- `fuzz_parse_compact_protocol.rb` -- fuzzes deserialization of the Compact protocol
+- `fuzz_parse_json_protocol.rb` -- fuzzes deserialization of JSON protocol messages
+- `fuzz_roundtrip_binary_protocol.rb` -- fuzzes Binary roundtrips (deserialize, serialize, deserialize, compare)
+- `fuzz_roundtrip_binary_protocol_accelerated.rb` -- fuzzes accelerated Binary roundtrips
+- `fuzz_roundtrip_compact_protocol.rb` -- fuzzes Compact roundtrips
+- `fuzz_roundtrip_json_protocol.rb` -- fuzzes JSON message roundtrips
+
+The runnable files in this directory are tracer entrypoints. Ruzzy requires that pure Ruby fuzzing starts from a tracer script which then loads a separate harness, so do not invoke the matching `_harness.rb` files directly.
+
+The fuzzers use Ruzzy's mutation engine to generate test cases. Each target uses common testing code from `fuzz_common.rb`.
+
+For more information about Ruzzy and its options, see the [Ruzzy documentation](https://github.com/trailofbits/ruzzy).
+
+You can also use the corpus generator from the Rust implementation to generate initial Binary and Compact corpora that can be reused by the Ruby fuzzers, since those wire formats are identical between implementations.
+
+## Usage
+
+```bash
Review Comment:
This is a little bit OS specific, so I am not quite sure what is the best approach here. Could you point me to how other languages do it? I was checking [your PR](https://github.com/google/oss-fuzz/pull/13874/changes) against oss-fuzz, and see that most of the languages do different things to set everything up.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@thrift.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] THRIFT-5855: Implemented Ruby fuzzing [thrift]
Posted by "kpumuk (via GitHub)" <gi...@apache.org>.
kpumuk commented on PR #3339:
URL: https://github.com/apache/thrift/pull/3339#issuecomment-4042967182
@mhlakhani you have been doing an incredible work on fuzzers, would you mind taking a look at this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@thrift.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] THRIFT-5855: Implemented Ruby fuzzing [thrift]
Posted by "kpumuk (via GitHub)" <gi...@apache.org>.
kpumuk commented on PR #3339:
URL: https://github.com/apache/thrift/pull/3339#issuecomment-4071658977
@mhlakhani https://github.com/google/oss-fuzz/pull/15172
I used your name as the primary contact for consistency with other Thrift project. Please let me know if this is preferred, or if I should use my name. I don't really want to put more responsibility on you, and intend to provide support for the Thrift Ruby library.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@thrift.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] THRIFT-5855: Implemented Ruby fuzzing [thrift]
Posted by "kpumuk (via GitHub)" <gi...@apache.org>.
kpumuk commented on code in PR #3339:
URL: https://github.com/apache/thrift/pull/3339#discussion_r2931401639
##########
lib/rb/test/fuzz/README.md:
##########
@@ -0,0 +1,99 @@
+# Ruby Fuzzing README
+
+The Ruby Thrift implementation uses [Ruzzy](https://github.com/trailofbits/ruzzy) for fuzzing. Ruzzy is a coverage-guided fuzzer for pure Ruby code and Ruby C extensions.
+
+We currently have several fuzz targets that test different aspects of the Thrift implementation:
+
+- `fuzz_parse_binary_protocol.rb` -- fuzzes deserialization of the Binary protocol
+- `fuzz_parse_binary_protocol_accelerated.rb` -- fuzzes deserialization of the accelerated Binary protocol
+- `fuzz_parse_compact_protocol.rb` -- fuzzes deserialization of the Compact protocol
+- `fuzz_parse_json_protocol.rb` -- fuzzes deserialization of JSON protocol messages
+- `fuzz_roundtrip_binary_protocol.rb` -- fuzzes Binary roundtrips (deserialize, serialize, deserialize, compare)
+- `fuzz_roundtrip_binary_protocol_accelerated.rb` -- fuzzes accelerated Binary roundtrips
+- `fuzz_roundtrip_compact_protocol.rb` -- fuzzes Compact roundtrips
+- `fuzz_roundtrip_json_protocol.rb` -- fuzzes JSON message roundtrips
+
+The runnable files in this directory are tracer entrypoints. Ruzzy requires that pure Ruby fuzzing starts from a tracer script which then loads a separate harness, so do not invoke the matching `_harness.rb` files directly.
+
+The fuzzers use Ruzzy's mutation engine to generate test cases. Each target uses common testing code from `fuzz_common.rb`.
+
+For more information about Ruzzy and its options, see the [Ruzzy documentation](https://github.com/trailofbits/ruzzy).
+
+You can also use the corpus generator from the Rust implementation to generate initial Binary and Compact corpora that can be reused by the Ruby fuzzers, since those wire formats are identical between implementations.
+
+## Usage
+
+```bash
Review Comment:
Added a makefile and updated the docs to outline the usage.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@thrift.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] THRIFT-5855: Implemented Ruby fuzzing [thrift]
Posted by "kpumuk (via GitHub)" <gi...@apache.org>.
kpumuk commented on PR #3339:
URL: https://github.com/apache/thrift/pull/3339#issuecomment-4046109970
> can we leave a TODO to add to oss-fuzz after [google/oss-fuzz#11967](https://github.com/google/oss-fuzz/issues/11967) ?
Not a huge fan of TODOs, as they usually get forgotten. I will open a PR against oss-fuzz instead once this is merged
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@thrift.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] THRIFT-5855: Implemented Ruby fuzzing [thrift]
Posted by "kpumuk (via GitHub)" <gi...@apache.org>.
kpumuk commented on PR #3339:
URL: https://github.com/apache/thrift/pull/3339#issuecomment-5109694118
Quick update: https://github.com/google/oss-fuzz/pull/15172 got merged today
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@thrift.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] THRIFT-5855: Implemented Ruby fuzzing [thrift]
Posted by "mhlakhani (via GitHub)" <gi...@apache.org>.
mhlakhani commented on PR #3339:
URL: https://github.com/apache/thrift/pull/3339#issuecomment-4071937871
that should be good, thank you for doing it @kpumuk ! would recommend adding yourself to additional_cc's (you must use a gmail account) so you see the reports :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@thrift.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] THRIFT-5855: Implemented Ruby fuzzing [thrift]
Posted by "mhlakhani (via GitHub)" <gi...@apache.org>.
mhlakhani commented on code in PR #3339:
URL: https://github.com/apache/thrift/pull/3339#discussion_r2929037287
##########
lib/rb/test/fuzz/README.md:
##########
@@ -0,0 +1,99 @@
+# Ruby Fuzzing README
+
+The Ruby Thrift implementation uses [Ruzzy](https://github.com/trailofbits/ruzzy) for fuzzing. Ruzzy is a coverage-guided fuzzer for pure Ruby code and Ruby C extensions.
+
+We currently have several fuzz targets that test different aspects of the Thrift implementation:
+
+- `fuzz_parse_binary_protocol.rb` -- fuzzes deserialization of the Binary protocol
+- `fuzz_parse_binary_protocol_accelerated.rb` -- fuzzes deserialization of the accelerated Binary protocol
+- `fuzz_parse_compact_protocol.rb` -- fuzzes deserialization of the Compact protocol
+- `fuzz_parse_json_protocol.rb` -- fuzzes deserialization of JSON protocol messages
+- `fuzz_roundtrip_binary_protocol.rb` -- fuzzes Binary roundtrips (deserialize, serialize, deserialize, compare)
+- `fuzz_roundtrip_binary_protocol_accelerated.rb` -- fuzzes accelerated Binary roundtrips
+- `fuzz_roundtrip_compact_protocol.rb` -- fuzzes Compact roundtrips
+- `fuzz_roundtrip_json_protocol.rb` -- fuzzes JSON message roundtrips
+
+The runnable files in this directory are tracer entrypoints. Ruzzy requires that pure Ruby fuzzing starts from a tracer script which then loads a separate harness, so do not invoke the matching `_harness.rb` files directly.
+
+The fuzzers use Ruzzy's mutation engine to generate test cases. Each target uses common testing code from `fuzz_common.rb`.
+
+For more information about Ruzzy and its options, see the [Ruzzy documentation](https://github.com/trailofbits/ruzzy).
+
+You can also use the corpus generator from the Rust implementation to generate initial Binary and Compact corpora that can be reused by the Ruby fuzzers, since those wire formats are identical between implementations.
+
+## Usage
+
+```bash
Review Comment:
On the oss-fuzz side it's language specific and not easy. in the thrift side I focused on linux instructions and added makefile targets that worked on linux / tested in the dockerfile. I think that's ok, if we can make it so that non-linux use cases aren't broken
##########
lib/rb/test/fuzz/fuzz_common.rb:
##########
@@ -0,0 +1,95 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+$:.unshift File.expand_path('../../lib', __dir__)
+$:.unshift File.expand_path('../../ext', __dir__)
+require 'thrift'
+$:.unshift File.dirname(__FILE__) + "/gen-rb"
+require 'fuzz_test_constants'
+
+require 'coverage'
+Coverage.start(branches: true) unless Coverage.respond_to?(:running?) && Coverage.running?
+require 'ruzzy'
+# Ruzzy.enable_branch_coverage_hooks
+
+def ignorable_fuzz_exception?(error)
+ return true if error.is_a?(Thrift::ProtocolException) ||
+ error.is_a?(EOFError) ||
+ error.is_a?(Encoding::UndefinedConversionError)
+
+ [
Review Comment:
This makes a lot of sense, thank you!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@thrift.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] THRIFT-5855: Implemented Ruby fuzzing [thrift]
Posted by "mhlakhani (via GitHub)" <gi...@apache.org>.
mhlakhani merged PR #3339:
URL: https://github.com/apache/thrift/pull/3339
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@thrift.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org