"terminate called recursively" when a test aborts using libfuzzer
neuromancer opened this issue · 0 comments
neuromancer commented
If you use a simple test like this one with libfuzzer support:
TEST(T, A) {
symbolic_int start;
std::vector<int> myvector(100);
myvector.at(start)=1;
ASSERT(true);
}
The default configuration fails to work, generating an endless list of:
terminate called recursively
terminate called recursively
terminate called recursively
terminate called recursively
terminate called recursively
terminate called recursively
To avoid missing an important crash, LIBFUZZER_EXIT_ON_FAIL=1
should be used:
terminate called after throwing an instance of 'std::out_of_range'
what(): vector::_M_range_check: __n (which is 167772160) >= this->size() (which is 100)
#0 0x55713e1e5b7b in __sanitizer_print_stack_trace (/home/g/Fuzz/deepstate/build/examples/OneOf_LF+0x95b7b)
#1 0x55713e1bff49 in fuzzer::PrintStackTrace() (/home/g/Fuzz/deepstate/build/examples/OneOf_LF+0x6ff49)
#2 0x55713e19ea79 in fuzzer::Fuzzer::ExitCallback() (.part.0) (/home/g/Fuzz/deepstate/build/examples/OneOf_LF+0x4ea79)
#3 0x55713e19eb48 in fuzzer::Fuzzer::StaticExitCallback() (/home/g/Fuzz/deepstate/build/examples/OneOf_LF+0x4eb48)
#4 0x7fcdf8e916a6 in __run_exit_handlers (/usr/lib/libc.so.6+0x3e6a6)
#5 0x7fcdf8e9185d in exit (/usr/lib/libc.so.6+0x3e85d)
#6 0x55713e1f579f in LLVMFuzzerTestOneInput (/home/g/Fuzz/deepstate/build/examples/OneOf_LF+0xa579f)
#7 0x55713e19f35e in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/g/Fuzz/deepstate/build/examples/OneOf_LF+0x4f35e)
#8 0x55713e1a1560 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) (/home/g/Fuzz/deepstate/build/examples/OneOf_LF+0x51560)
#9 0x55713e1a28c3 in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocator<fuzzer::SizedFile> >&) (/home/g/Fuzz/deepstate/build/examples/OneOf_LF+0x528c3)
#10 0x55713e1a40b3 in fuzzer::Fuzzer::Loop(std::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocator<fuzzer::SizedFile> >&) (/home/g/Fuzz/deepstate/build/examples/OneOf_LF+0x540b3)
#11 0x55713e18dd78 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/g/Fuzz/deepstate/build/examples/OneOf_LF+0x3dd78)
#12 0x55713e17b423 in main (/home/g/Fuzz/deepstate/build/examples/OneOf_LF+0x2b423)
#13 0x7fcdf8e7a152 in __libc_start_main (/usr/lib/libc.so.6+0x27152)
#14 0x55713e17b4ad in _start (/home/g/Fuzz/deepstate/build/examples/OneOf_LF+0x2b4ad)