mdempsky / go114-fuzz-build

Intro

go114-fuzz-build is a mostly-drop-in replacement for go-fuzz-build's -libfuzzer build mode, but uses cmd/compile's native libfuzzer instrumentation (included experimentally since Go 1.14) instead of source-to-source transformation.

Example

1. Install go114-fuzz-build:

$ go get -u github.com/mdempsky/go114-fuzz-build

2. Build Kubernetes fuzz target with go114-fuzz-build and link against libFuzzer:

$ git clone --depth=1 git clone --depth 1 https://github.com/kubernetes/kubernetes.git
$ cd kubernetes
$ go114-fuzz-build -o yaml_FuzzSigYaml.a -func FuzzSigYaml ./test/fuzz/yaml
$ clang -o yaml_FuzzSigYaml yaml_FuzzSigYaml.a -fsanitize=fuzzer

go114-fuzz-build's Issues

Cannot find package error

Hi,

Not having much luck getting this to work on go1.14.4 unfortunately.

Repro Steps:

1. go get -u github.com/mdempsky/go114-fuzz-build
2. git clone --depth 1 https://github.com/kubernetes/kubernetes.git
3. cd kubernetes
4. go114-fuzz-build -o yaml_FuzzSigYaml.a -func FuzzSigYaml ./test/fuzz/yaml

Step 4 is failing with:

test/fuzz/yaml/yaml.go:26:2: cannot find package
test/fuzz/yaml/yaml.go:27:2: cannot find package
test/fuzz/yaml/yaml.go:28:2: cannot find package
2020/07/05 17:43:16 failed to build packages:exit status 1

I also attempted to build the json test too with:

go114-fuzz-build -o json_FuzzStrictDecode.a -func FuzzStrictDecode ./test/fuzz/json

and got a similar error:

test/fuzz/json/json.go:24:2: cannot find package
test/fuzz/json/json.go:25:2: cannot find package
test/fuzz/json/json.go:26:2: cannot find package
2020/07/05 18:31:24 failed to build packages:exit status 1

alex@server:ü/kubernetes$ go version
go version go1.14.4 linux/amd64

alex@server:ü/kubernetes$ go env
GO111MODULE="on"
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/alex/.cache/go-build"
GOENV="/home/alex/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/alex/gopath"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/alex/kubernetes/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build330694216=/tmp/go-build -gno-record-gcc-switches"

Fixes for OSS-Fuzz

• google/oss-fuzz#3639 (comment)
• Remove redundant copy ? https://github.com/mdempsky/go114-fuzz-build/blob/master/main.go#L126
• Package needs to be in $GOPATH/src. This was not a requirement for other go-fuzz-build, can we fix this so that relative paths are searched too?, e.g see https://github.com/google/oss-fuzz/pull/3638/files#diff-e59eb1d5f48ffbe1708632ce72d68d64 and https://github.com/google/oss-fuzz/pull/3638/files#diff-ee8fa0a12463344fd8847ca50df94d47

Add license

Hello,
Could you please add a license here?

I'm currently working on a project that could potentially use a modified version of this or code inspired by this.
I understand it has quite a similar interface to dvuykov's go-fuzz-build but would like to play it careful 😄