Skip to content

Commit

Permalink
Always call CentipedeFinalizeProcessing to report FuzzTest input pr…
Browse files Browse the repository at this point in the history
…operly.

This is needed because otherwise Centipede would crash for exceeded memory/time limits after FuzzTest cleaning up the current input, leading to undesired "setup failure" reports.
But we don't want Centipede to prepare the coverage twice (which would result in garbage coverage). Thus using the input_start_time as a guard - they should be set to 0 after each iteration anyway.

PiperOrigin-RevId: 706865286
  • Loading branch information
xinhaoyuan authored and copybara-github committed Dec 17, 2024
1 parent c5e3551 commit a9c35b1
Show file tree
Hide file tree
Showing 3 changed files with 10 additions and 3 deletions.
8 changes: 6 additions & 2 deletions centipede/runner.cc
Original file line number Diff line number Diff line change
Expand Up @@ -614,7 +614,9 @@ static void RunOneInput(const uint8_t *data, size_t size,
int target_return_value = callbacks.Execute({data, size}) ? 0 : -1;
state.stats.exec_time_usec = UsecSinceLast();
CheckWatchdogLimits();
PostProcessCoverage(target_return_value);
if (centipede::state.input_start_time.exchange(0) != 0) {
PostProcessCoverage(target_return_value);
}
state.stats.post_time_usec = UsecSinceLast();
state.stats.peak_rss_mb = GetPeakRSSMb();
}
Expand Down Expand Up @@ -1235,7 +1237,9 @@ extern "C" void CentipedePrepareProcessing() {

extern "C" void CentipedeFinalizeProcessing() {
centipede::CheckWatchdogLimits();
centipede::PostProcessCoverage(/*target_return_value=*/0);
if (centipede::state.input_start_time.exchange(0) != 0) {
centipede::PostProcessCoverage(/*target_return_value=*/0);
}
}

extern "C" size_t CentipedeGetExecutionResult(uint8_t *data, size_t capacity) {
Expand Down
3 changes: 3 additions & 0 deletions centipede/runner_interface.h
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,9 @@ extern "C" void CentipedeEndExecutionBatch();
extern "C" void CentipedePrepareProcessing();

// Finalizes the processing of an input and stores the state internally.
//
// For tool integration, it can be called inside `RunnerCallbacks::Execute()` to
// finalize the execution early before extra cleanups.
extern "C" void CentipedeFinalizeProcessing();

// Retrieves the execution results (including coverage information) after
Expand Down
2 changes: 1 addition & 1 deletion fuzztest/internal/centipede_adaptor.cc
Original file line number Diff line number Diff line change
Expand Up @@ -479,7 +479,7 @@ class CentipedeFixtureDriver : public UntypedFixtureDriver {
if (runtime_.skipping_requested()) {
CentipedeSetExecutionResult(nullptr, 0);
}
if (!runner_mode) CentipedeFinalizeProcessing();
CentipedeFinalizeProcessing();
}

void TearDownFuzzTest() override { orig_fixture_driver_->TearDownFuzzTest(); }
Expand Down

0 comments on commit a9c35b1

Please sign in to comment.