native go fuzzing: Integrate engine

infra/base-images/base-builder/Dockerfile

@@ -142,6 +142,7 @@ RUN cd $SRC && \
 COPY precompile_afl /usr/local/bin/
 RUN precompile_afl
 
+RUN apt-get update -y
 COPY precompile_honggfuzz /usr/local/bin/
 RUN precompile_honggfuzz
 

infra/base-images/base-builder/compile_native_go_fuzzer

@@ -15,80 +15,21 @@
 #
 ################################################################################
 
-# Rewrites a copy of the fuzzer to allow for 
-# libFuzzer instrumentation.
-function rewrite_go_fuzz_harness() {
-	fuzzer_filename=$1
-	fuzz_function=$2
-
-	# Create a copy of the fuzzer to not modify the existing fuzzer.
-	cp $fuzzer_filename "${fuzzer_filename}"_fuzz_.go
-	mv $fuzzer_filename /tmp/
-	fuzzer_fn="${fuzzer_filename}"_fuzz_.go
-
-	# Replace *testing.F with *go118fuzzbuildutils.F.
-	echo "replacing *testing.F"
-	sed -i "s/func $fuzz_function(\([a-zA-Z0-9]*\) \*testing\.F)/func $fuzz_function(\1 \*go118fuzzbuildutils\.F)/g" "${fuzzer_fn}"
-
-	# Import https://github.com/AdamKorcz/go-118-fuzz-build.
-	# This changes the line numbers from the original fuzzer.
-	addimport -path "${fuzzer_fn}"
-}
-
-function build_native_go_fuzzer() {
-	fuzzer=$1
-	function=$2
-	path=$3
-	tags="-tags gofuzz"
-
-	if [[ $SANITIZER = *coverage* ]]; then
-		echo "here we perform coverage build"
-		fuzzed_package=`go list $tags -f '{{.Name}}' $path`
-		abspath=`go list $tags -f {{.Dir}} $path`
-		cd $abspath
-		cp $GOPATH/native_ossfuzz_coverage_runner.go ./"${function,,}"_test.go
-		sed -i -e 's/FuzzFunction/'$function'/' ./"${function,,}"_test.go
-		sed -i -e 's/mypackagebeingfuzzed/'$fuzzed_package'/' ./"${function,,}"_test.go
-		sed -i -e 's/TestFuzzCorpus/Test'$function'Corpus/' ./"${function,,}"_test.go
-
-		# The repo is the module path/name, which is already created above
-		# in case it doesn't exist, but not always the same as the module
-		# path. This is necessary to handle SIV properly.
-		fuzzed_repo=$(go list $tags -f {{.Module}} "$path")
-		abspath_repo=`go list -m $tags -f {{.Dir}} $fuzzed_repo || go list $tags -f {{.Dir}} $fuzzed_repo`
-		# give equivalence to absolute paths in another file, as go test -cover uses golangish pkg.Dir
-		echo "s=$fuzzed_repo"="$abspath_repo"= > $OUT/$fuzzer.gocovpath
-		gotip test -run Test${function}Corpus -v $tags -coverpkg $fuzzed_repo/... -c -o $OUT/$fuzzer $path
-
-		rm ./"${function,,}"_test.go
-	else
-		go-118-fuzz-build -o $fuzzer.a -func $function $abs_file_dir
-		$CXX $CXXFLAGS $LIB_FUZZING_ENGINE $fuzzer.a -o $OUT/$fuzzer
-	fi
-}
-
-
 path=$1
 function=$2
-fuzzer=$3
 tags="-tags gofuzz"
+if [[ $#  -eq 3 ]]; then
+  tags="-tags $3"
+fi
 
 # Get absolute path.
+echo abs_file_dir
 abs_file_dir=$(go list $tags -f {{.Dir}} $path)
 
-# TODO(adamkorcz): Get rid of "-r" flag here.
-fuzzer_filename=$(grep -r -l  -s "$function" "${abs_file_dir}")
-
-# Test if file contains a line with "func $function" and "testing.F".
-if [ $(grep -r "func $function" $fuzzer_filename | grep "testing.F" | wc -l) -eq 1 ]
-then
-
-	rewrite_go_fuzz_harness $fuzzer_filename $function
-	build_native_go_fuzzer $fuzzer $function $abs_file_dir
-
-	# Clean up.
-	rm "${fuzzer_filename}_fuzz_.go"
-	mv /tmp/$(basename $fuzzer_filename) $fuzzer_filename
-else
-	echo "Could not find the function: func ${function}(f *testing.F)"
-fi
+current_dir=$PWD
+cd $abs_file_dir
+echo running gotip test -c $tags
+gotip test -c -test.fuzz=$function $tags
+mv fuzz.test "${OUT}"/"${function}"
+cd $current_dir
+unset current_dir

infra/base-images/base-runner/coverage

@@ -138,12 +138,6 @@ function run_go_fuzz_target {
 
   $OUT/$target -test.coverprofile $DUMPS_DIR/$target.profdata &> $LOGS_DIR/$target.log
 
-  # The Go 1.18 fuzzers are renamed to "*_fuzz_.go" during "infra/helper.py build_fuzzers".
-  # They are are therefore refered to as "*_fuzz_.go" in the profdata files.
-  # Since the copies named "*_fuzz_.go" do not exist in the file tree during
-  # the coverage build, we change the references in the .profdata files
-  # to the original file names.
-  sed -i "s/_test.go_fuzz_.go/_test.go/g" $DUMPS_DIR/$target.profdata
   # translate from golangish paths to current absolute paths
   cat $OUT/$target.gocovpath | while read i; do sed -i $i $DUMPS_DIR/$target.profdata; done
   # cf PATH_EQUIVALENCE_ARGS

infra/base-images/base-runner/run_fuzzer

@@ -150,6 +150,8 @@ elif [[ "$FUZZING_ENGINE" = honggfuzz ]]; then
   # -n: number of fuzzing threads (and processes)
   CMD_LINE="$OUT/honggfuzz -n 1 --exit_upon_crash -R /tmp/${FUZZER}_honggfuzz.report -W $FUZZER_OUT -v -z -P -f \"$CORPUS_DIR\" $(get_dictionary) $* -- \"$OUT/$FUZZER\""
 
+elif [[ "$FUZZING_ENGINE" = nativego ]]; then
+  CMD_LINE="$OUT/$FUZZER -test.fuzz=$FUZZER -test.fuzzcachedir $CORPUS_DIR"
 else
 
   CMD_LINE="$OUT/$FUZZER $FUZZER_ARGS $*"

infra/constants.py

@@ -38,4 +38,4 @@
     'introspector'
 ]
 ARCHITECTURES = ['i386', 'x86_64']
-ENGINES = ['libfuzzer', 'afl', 'honggfuzz', 'dataflow', 'none']
+ENGINES = ['libfuzzer', 'afl', 'honggfuzz', 'dataflow', 'nativego', 'none']

projects/testing-native-go-fuzzing/Dockerfile → projects/test-native-go-fuzzing/Dockerfile

@@ -1,4 +1,4 @@
-# Copyright 2021 Google LLC
+# Copyright 2022 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -15,14 +15,6 @@
 ################################################################################
 
 FROM gcr.io/oss-fuzz-base/base-builder-go
-RUN git clone --depth 1 https://github.com/vitessio/vitess
-RUN go install golang.org/dl/gotip@latest \
-    && gotip download
-RUN go install github.com/AdamKorcz/go-118-fuzz-build@latest
-COPY build.sh \
-     native_ossfuzz_coverage_runnger.go \
-     fuzzers/tablet_manager_fuzzer_test.go \
-     fuzzers/parser_fuzzer_test.go \
-     fuzzers/ast_fuzzer_test.go \
-     $SRC/
-WORKDIR $SRC/vitess
+COPY build.sh fuzz.go $SRC/
+RUN mkdir $SRC/test-project
+WORKDIR $SRC/test-project

projects/test-native-go-fuzzing/build.sh

@@ -0,0 +1,22 @@
+#/bin/bash -eu
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+
+cd $SRC/test-project
+go mod init test-project
+mkdir fuzz
+cp $SRC/fuzz.go ./fuzz/fuzz_test.go
+compile_native_go_fuzzer ./fuzz Fuzz

projects/test-native-go-fuzzing/fuzz.go

@@ -0,0 +1,10 @@
+package fuzz
+
+import (
+	"testing"
+)
+func Fuzz(f *testing.F) {
+	f.Fuzz(func(t *testing.T, i int) {
+		return
+	})
+}

projects/test-native-go-fuzzing/project.yaml

@@ -0,0 +1,11 @@
+homepage: ""
+main_repo: ""
+primary_contact: ""
+auto_ccs :
+  - ""
+language: go
+fuzzing_engines:
+  - nativego
+sanitizers:
+  - address
+disabled: true