Repository: google/fuzzbench

Issue:
afl++ build is broken on openssl_x509
CC @andreafioraldi 

Similar to #107 CI successfully built openssl_x509 with AFL++ but failed to do so on [2020-03-11](https://www.fuzzbench.com/reports/2020-03-11/index.html).

The build fails with this error:
```
/afl/afl-clang-fast  -Iinclude  -pthread -m64 -fno-omit-frame-pointer -g -Wa,--noexecstack -Qunused-arguments -pthread -Wl,--no-as-needed -Wl,-ldl -Wl,-lm -Wno-unused-command-line-argument -O2 -pthread -Wno-unus
ed-command-line-argument -O2 -fno-sanitize=alignment  -DPEDANTIC -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -MMD -MF test/buildtest_c_e_os2-bin-buildtest_e_os2.d.tmp -MT test/buildtest_c_e_os2-bin-buildtest_e_os
2.o -c -o test/buildtest_c_e_os2-bin-buildtest_e_os2.o test/buildtest_e_os2.c
test/p_test-dso-p_test.o: In function `OSSL_provider_init':
/src/openssl/test/p_test.c:(.text+0x2b): undefined reference to `__afl_area_ptr'
/src/openssl/test/p_test.c:(.text+0x44): undefined reference to `__afl_prev_loc'
/src/openssl/test/p_test.c:(.text+0x7c): undefined reference to `__afl_prev_loc'
test/p_test-dso-p_test.o: In function `p_get_params':
/src/openssl/test/p_test.c:(.text+0x189): undefined reference to `__afl_prev_loc'
/src/openssl/test/p_test.c:(.text+0x198): undefined reference to `__afl_area_ptr'
/src/openssl/test/p_test.c:57: undefined reference to `__afl_prev_loc'
/src/openssl/test/p_test.c:57: undefined reference to `__afl_area_ptr'
/src/openssl/test/p_test.c:93: undefined reference to `__afl_prev_loc'
/src/openssl/test/p_test.c:93: undefined reference to `__afl_area_ptr'
/src/openssl/test/p_test.c:(.text+0x3e8): undefined reference to `__afl_prev_loc'
/src/openssl/test/p_test.c:(.text+0x3f7): undefined reference to `__afl_area_ptr'
clang-10: error: linker command failed with exit code 1 (use -v to see invocation
```

I will try to investigate the fix for this as well as if there is a way to make CI more likely to catch failures that happen in production.



Discussion:
I think #115 is why this wasn't caught by CI
Super strange, seems that afl-llvm-rt is not linked in the test. 
This can be fixed by skipping the check of `maybe_linking` flag in `afl-clang-fast.c`.
Irrespective of the value of `maybe_linking`, the `afl-llvm-rt.o` (and its 32/64 variants) should be added to the `cc_params`.

Resolving patch:
diff --git a/fuzzers/aflplusplus/fuzzer.py b/fuzzers/aflplusplus/fuzzer.py
--- a/fuzzers/aflplusplus/fuzzer.py
+++ b/fuzzers/aflplusplus/fuzzer.py
@@ -15,6 +15,7 @@
 
 import os
 import shutil
+import glob
 
 from fuzzers.afl import fuzzer as afl_fuzzer
 from fuzzers import utils
@@ -41,6 +42,8 @@ def build(*args):  # pylint: disable=too-many-branches,too-many-statements
         os.environ['CXX'] = '/afl/afl-clang-lto++'
         os.environ['RANLIB'] = 'llvm-ranlib-11'
         os.environ['AR'] = 'llvm-ar-11'
+        for copy_file in glob.glob("/afl/libc*"):
+            shutil.copy(copy_file, os.environ['OUT'])
     elif 'qemu' in build_modes:
         os.environ['CC'] = 'clang'
         os.environ['CXX'] = 'clang++'
@@ -53,13 +56,16 @@ def build(*args):  # pylint: disable=too-many-branches,too-many-statements
         os.environ['AFL_LLVM_INSTRIM'] = 'CFG'
 
     # Instrumentation coverage options:
+    # Do not use a fixed map location (LTO only)
+    if 'dynamic' in build_modes:
+        os.environ['AFL_LLVM_MAP_DYNAMIC'] = '1'
     # Skip over single block functions
     if 'skipsingle' in build_modes:
         os.environ['AFL_LLVM_SKIPSINGLEBLOCK'] = '1'
-    # Enable context sentitivity for LLVM mode
+    # Enable context sentitivity for LLVM mode (non LTO only)
     if 'ctx' in build_modes:
         os.environ['AFL_LLVM_CTX'] = '1'
-    # Enable N-gram coverage for LLVM mode
+    # Enable N-gram coverage for LLVM mode (non LTO only)
     if 'ngram2' in build_modes:
         os.environ['AFL_LLVM_NGRAM_SIZE'] = '2'
     elif 'ngram3' in build_modes:
@@ -81,6 +87,8 @@ def build(*args):  # pylint: disable=too-many-branches,too-many-statements
     # Disable neverZero implementation
     if 'nozero' in build_modes:
         os.environ['AFL_LLVM_SKIP_NEVERZERO'] = '1'
+
+    # Only one of the following OR cmplog
     # enable laf-intel compare splitting
     if 'laf' in build_modes:
         os.environ['AFL_LLVM_LAF_SPLIT_SWITCHES'] = '1'
@@ -152,6 +160,9 @@ def fuzz(input_corpus, output_corpus, target_binary, flags=tuple()):
     if 'ADDITIONAL_ARGS' in os.environ:
         flags += os.environ['ADDITIONAL_ARGS'].split(' ')
 
+    # needed for LTO mode to run c++ targets
+    os.environ['LD_LIBRARY_PATH'] = '/out'
+
     afl_fuzzer.run_afl_fuzz(input_corpus,
                             output_corpus,
                             target_binary,
diff --git a/fuzzers/aflplusplus_ngram3_cmplog_mopt2/fuzzer.py b/fuzzers/aflplusplus_lto_instrim_mopt/fuzzer.py
similarity index 52%
rename from fuzzers/aflplusplus_ngram3_cmplog_mopt2/fuzzer.py
rename to fuzzers/aflplusplus_lto_instrim_mopt/fuzzer.py
--- a/fuzzers/aflplusplus_ngram3_cmplog_mopt2/fuzzer.py
+++ b/fuzzers/aflplusplus_lto_instrim_mopt/fuzzer.py
@@ -13,6 +13,8 @@
 # limitations under the License.
 """Integration code for AFLplusplus fuzzer."""
 
+import os
+
 from fuzzers.aflplusplus import fuzzer as aflplusplus_fuzzer
 
 # OUT environment variable is the location of build directory (default is /out).
@@ -20,7 +22,21 @@
 
 def build():
     """Build benchmark."""
-    aflplusplus_fuzzer.build("cmplog", "ngram3", "nozero")
+    benchmark_name = os.environ['BENCHMARK']
+    if benchmark_name == 'bloaty_fuzz_target':
+        aflplusplus_fuzzer.build("lto", "instrim", "nozero", "dynamic")
+    elif benchmark_name == 'curl_curl_fuzzer_http':
+        aflplusplus_fuzzer.build("lto", "instrim", "nozero", "dynamic")
+    elif benchmark_name == 'freetype2-2017':
+        aflplusplus_fuzzer.build("lto", "instrim", "nozero", "dynamic")
+    elif benchmark_name == 'jsoncpp_jsoncpp_fuzzer':
+        aflplusplus_fuzzer.build("lto", "instrim", "nozero", "dynamic")
+    elif benchmark_name == 'openssl_x509':
+        aflplusplus_fuzzer.build("lto", "instrim", "nozero", "dynamic")
+    elif benchmark_name == 'php_php-fuzz-parser':
+        aflplusplus_fuzzer.build("lto", "instrim", "nozero", "dynamic")
+    else:
+        aflplusplus_fuzzer.build("lto", "instrim", "nozero")
 
 
 def fuzz(input_corpus, output_corpus, target_binary):
@@ -28,4 +44,4 @@ def fuzz(input_corpus, output_corpus, target_binary):
     aflplusplus_fuzzer.fuzz(input_corpus,
                             output_corpus,
                             target_binary,
-                            flags=("-L", "-1"))
+                            flags=("-L", "0"))
diff --git a/fuzzers/aflplusplus_instrim_cmplog_mopt2/fuzzer.py b/fuzzers/aflplusplus_lto_mopt/fuzzer.py
similarity index 55%
rename from fuzzers/aflplusplus_instrim_cmplog_mopt2/fuzzer.py
rename to fuzzers/aflplusplus_lto_mopt/fuzzer.py
--- a/fuzzers/aflplusplus_instrim_cmplog_mopt2/fuzzer.py
+++ b/fuzzers/aflplusplus_lto_mopt/fuzzer.py
@@ -13,6 +13,8 @@
 # limitations under the License.
 """Integration code for AFLplusplus fuzzer."""
 
+import os
+
 from fuzzers.aflplusplus import fuzzer as aflplusplus_fuzzer
 
 # OUT environment variable is the location of build directory (default is /out).
@@ -20,7 +22,21 @@
 
 def build():
     """Build benchmark."""
-    aflplusplus_fuzzer.build("cmplog", "instrim", "nozero")
+    benchmark_name = os.environ['BENCHMARK']
+    if benchmark_name == 'bloaty_fuzz_target':
+        aflplusplus_fuzzer.build("lto", "nozero", "dynamic")
+    elif benchmark_name == 'curl_curl_fuzzer_http':
+        aflplusplus_fuzzer.build("lto", "nozero", "dynamic")
+    elif benchmark_name == 'freetype2-2017':
+        aflplusplus_fuzzer.build("lto", "nozero", "dynamic")
+    elif benchmark_name == 'jsoncpp_jsoncpp_fuzzer':
+        aflplusplus_fuzzer.build("lto", "nozero", "dynamic")
+    elif benchmark_name == 'openssl_x509':
+        aflplusplus_fuzzer.build("lto", "nozero", "dynamic")
+    elif benchmark_name == 'php_php-fuzz-parser':
+        aflplusplus_fuzzer.build("lto", "nozero", "dynamic")
+    else:
+        aflplusplus_fuzzer.build("lto", "nozero")
 
 
 def fuzz(input_corpus, output_corpus, target_binary):
@@ -28,4 +44,4 @@ def fuzz(input_corpus, output_corpus, target_binary):
     aflplusplus_fuzzer.fuzz(input_corpus,
                             output_corpus,
                             target_binary,
-                            flags=("-L", "-1"))
+                            flags=("-L", "0"))


Test patch: