fuzz: Introduce DO_NOT_OPTIMIZE

The compiler may decide computations like these are not doing anything
and decide to optimize them away. This would defeat the whole fuzzing
exercise. This macro will force the compiler to materialize the value
no matter what. It should be less prone to accidents compared to using
log functions, which would either slow things down or still optimize the
value away (or simply move it into the if branch the log macros create).

The benefit over assert_se would be that no requirement is made on the
value itself. If we are fine getting a string of any size (including
zero), an assert_se would either create a noisy compiler warning about
conditions that would alawys be met or yet again optimize the whole
thing away.
This commit is contained in:
Jan Janssen
2022-09-23 09:54:03 +02:00
parent e7508839af
commit 4b8eb86360
2 changed files with 5 additions and 6 deletions

View File

@@ -2,7 +2,6 @@
#include "alloc-util.h"
#include "bcd.h"
#include "fd-util.h"
#include "fuzz.h"
#include "utf8.h"
@@ -13,14 +12,11 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
if (outside_size_range(size, 0, 100*1024))
return 0;
if (!getenv("SYSTEMD_LOG_LEVEL"))
log_set_max_level(LOG_CRIT);
p = memdup(data, size);
assert_se(p);
char16_t *title = get_bcd_title(p, size);
if (title)
(void) char16_strlen(title);
/* If we get something, it must be NUL-terminated, but an empty string is still valid! */
DO_NOT_OPTIMIZE(title && char16_strlen(title));
return 0;
}

View File

@@ -27,3 +27,6 @@ static inline bool outside_size_range(size_t size, size_t lower, size_t upper) {
return FUZZ_USE_SIZE_LIMIT;
return false;
}
/* Force value to not be optimized away. */
#define DO_NOT_OPTIMIZE(value) ({ asm volatile("" : : "g"(value) : "memory"); })