Repository: google/fuzzbench

Issue:
afl++ build is broken on openssl_x509
CC @andreafioraldi 

Similar to #107 CI successfully built openssl_x509 with AFL++ but failed to do so on [2020-03-11](https://www.fuzzbench.com/reports/2020-03-11/index.html).

The build fails with this error:
```
/afl/afl-clang-fast  -Iinclude  -pthread -m64 -fno-omit-frame-pointer -g -Wa,--noexecstack -Qunused-arguments -pthread -Wl,--no-as-needed -Wl,-ldl -Wl,-lm -Wno-unused-command-line-argument -O2 -pthread -Wno-unus
ed-command-line-argument -O2 -fno-sanitize=alignment  -DPEDANTIC -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -MMD -MF test/buildtest_c_e_os2-bin-buildtest_e_os2.d.tmp -MT test/buildtest_c_e_os2-bin-buildtest_e_os
2.o -c -o test/buildtest_c_e_os2-bin-buildtest_e_os2.o test/buildtest_e_os2.c
test/p_test-dso-p_test.o: In function `OSSL_provider_init':
/src/openssl/test/p_test.c:(.text+0x2b): undefined reference to `__afl_area_ptr'
/src/openssl/test/p_test.c:(.text+0x44): undefined reference to `__afl_prev_loc'
/src/openssl/test/p_test.c:(.text+0x7c): undefined reference to `__afl_prev_loc'
test/p_test-dso-p_test.o: In function `p_get_params':
/src/openssl/test/p_test.c:(.text+0x189): undefined reference to `__afl_prev_loc'
/src/openssl/test/p_test.c:(.text+0x198): undefined reference to `__afl_area_ptr'
/src/openssl/test/p_test.c:57: undefined reference to `__afl_prev_loc'
/src/openssl/test/p_test.c:57: undefined reference to `__afl_area_ptr'
/src/openssl/test/p_test.c:93: undefined reference to `__afl_prev_loc'
/src/openssl/test/p_test.c:93: undefined reference to `__afl_area_ptr'
/src/openssl/test/p_test.c:(.text+0x3e8): undefined reference to `__afl_prev_loc'
/src/openssl/test/p_test.c:(.text+0x3f7): undefined reference to `__afl_area_ptr'
clang-10: error: linker command failed with exit code 1 (use -v to see invocation
```

I will try to investigate the fix for this as well as if there is a way to make CI more likely to catch failures that happen in production.



Discussion:
I think #115 is why this wasn't caught by CI
Super strange, seems that afl-llvm-rt is not linked in the test. 
This can be fixed by skipping the check of `maybe_linking` flag in `afl-clang-fast.c`.
Irrespective of the value of `maybe_linking`, the `afl-llvm-rt.o` (and its 32/64 variants) should be added to the `cc_params`.

Resolving patch:
diff --git a/fuzzers/aflplusplus/fuzzer.py b/fuzzers/aflplusplus/fuzzer.py
--- a/fuzzers/aflplusplus/fuzzer.py
+++ b/fuzzers/aflplusplus/fuzzer.py
@@ -15,7 +15,6 @@
 
 import os
 import shutil
-import glob
 
 from fuzzers.afl import fuzzer as afl_fuzzer
 from fuzzers import utils
@@ -36,6 +35,8 @@ def build(*args):  # pylint: disable=too-many-branches,too-many-statements
     if 'BUILD_MODES' in os.environ:
         build_modes = os.environ['BUILD_MODES'].split(',')
 
+    build_directory = os.environ['OUT']
+
     # If nothing was set this is the default:
     if not build_modes:
         build_modes = ['tracepc', 'nozero']
@@ -46,8 +47,6 @@ def build(*args):  # pylint: disable=too-many-branches,too-many-statements
         os.environ['CXX'] = '/afl/afl-clang-lto++'
         os.environ['RANLIB'] = 'llvm-ranlib-11'
         os.environ['AR'] = 'llvm-ar-11'
-        for copy_file in glob.glob("/afl/libc*"):
-            shutil.copy(copy_file, os.environ['OUT'])
     elif 'qemu' in build_modes:
         os.environ['CC'] = 'clang'
         os.environ['CXX'] = 'clang++'
@@ -101,6 +100,7 @@ def build(*args):  # pylint: disable=too-many-branches,too-many-statements
     if 'laf' in build_modes:
         os.environ['AFL_LLVM_LAF_SPLIT_SWITCHES'] = '1'
         os.environ['AFL_LLVM_LAF_SPLIT_COMPARES'] = '1'
+        os.environ['AFL_LLVM_LAF_SPLIT_FLOATS'] = '1'
         if 'autodict' not in build_modes:
             os.environ['AFL_LLVM_LAF_TRANSFORM_COMPARES'] = '1'
     # enable auto dictionary for LTO
@@ -132,7 +132,6 @@ def build(*args):  # pylint: disable=too-many-branches,too-many-statements
 
         # For CmpLog build, set the OUT and FUZZ_TARGET environment
         # variable to point to the new CmpLog build directory.
-        build_directory = os.environ['OUT']
         cmplog_build_directory = get_cmplog_build_directory(build_directory)
         os.mkdir(cmplog_build_directory)
         new_env['OUT'] = cmplog_build_directory
@@ -144,7 +143,7 @@ def build(*args):  # pylint: disable=too-many-branches,too-many-statements
         print('Re-building benchmark for CmpLog fuzzing target')
         utils.build_benchmark(env=new_env)
 
-    shutil.copy('/afl/afl-fuzz', os.environ['OUT'])
+    shutil.copy('/afl/afl-fuzz', build_directory)
 
 
 def fuzz(input_corpus, output_corpus, target_binary, flags=tuple()):
diff --git a/fuzzers/aflplusplus_optimal/fuzzer.py b/fuzzers/aflplusplus_optimal/fuzzer.py
new file mode 100755
--- /dev/null
+++ b/fuzzers/aflplusplus_optimal/fuzzer.py
@@ -0,0 +1,112 @@
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Integration code for AFLplusplus fuzzer."""
+
+# This optimized afl++ variant should always be run together with
+# "aflplusplus" to show the difference - a default configured afl++ vs.
+# a hand-crafted optimized one. afl++ is configured not to enable the good
+# stuff by default to be as close to vanilla afl as possible.
+# But this means that the good stuff is hidden away in this benchmark
+# otherwise.
+
+import os
+import shutil
+import glob
+
+from fuzzers.aflplusplus import fuzzer as aflplusplus_fuzzer
+
+# OUT environment variable is the location of build directory (default is /out).
+
+
+def build():  # pylint: disable=too-many-branches,too-many-statements
+    """Build benchmark."""
+    benchmark_name = os.environ['BENCHMARK']
+
+    if benchmark_name == 'bloaty_fuzz_target':
+        aflplusplus_fuzzer.build("lto", "laf", "nozero", "dynamic")
+    elif benchmark_name == 'curl_curl_fuzzer_http':
+        aflplusplus_fuzzer.build("tracepc", "nozero", "cmplog")
+    elif benchmark_name == 'freetype2-2017':
+        aflplusplus_fuzzer.build("lto", "cmplog", "nozero", "dynamic")
+    elif benchmark_name == 'jsoncpp_jsoncpp_fuzzer':
+        aflplusplus_fuzzer.build("lto", "dynamic", "nozero", "cmplog")
+    elif benchmark_name == 'lcms-2017-03-21':
+        aflplusplus_fuzzer.build("lto", "nozero", "cmplog")
+    elif benchmark_name == 'libjpeg-turbo-07-2017':
+        aflplusplus_fuzzer.build("tracepc", "nozero", "laf")
+    elif benchmark_name == 'libpcap_fuzz_both':
+        aflplusplus_fuzzer.build("lto", "nozero", "laf")
+    elif benchmark_name == 'libpng-1.2.56':
+        aflplusplus_fuzzer.build("lto", "nozero", "laf")
+    elif benchmark_name == 'libxml2-v2.9.2':
+        aflplusplus_fuzzer.build("lto", "nozero", "autodict")
+    elif benchmark_name == 'openssl_x509':
+        aflplusplus_fuzzer.build("lto", "nozero", "dynamic", "laf")
+    elif benchmark_name == 'openthread-2019-12-23':
+        aflplusplus_fuzzer.build("lto", "nozero", "cmplog")
+    elif benchmark_name == 'php_php-fuzz-parser':
+        aflplusplus_fuzzer.build("lto", "nozero", "dynamic")
+    elif benchmark_name == 'proj4-2017-08-14':
+        aflplusplus_fuzzer.build("lto", "nozero", "cmplog")
+    elif benchmark_name == 'systemd_fuzz-link-parser':
+        aflplusplus_fuzzer.build("tracepc", "nozero", "cmplog")
+    elif benchmark_name == 'vorbis-2017-12-11':
+        aflplusplus_fuzzer.build("tracepc", "nozero", "laf")
+    elif benchmark_name == 'woff2-2016-05-06':
+        aflplusplus_fuzzer.build("tracepc", "nozero", "laf")
+    elif benchmark_name == 'zlib_zlib_uncompress_fuzzer':
+        aflplusplus_fuzzer.build("tracepc", "nozero", "cmplog")
+    else:
+        aflplusplus_fuzzer.build("lto", "nozero")
+
+    for copy_file in glob.glob("/afl/libc*"):
+        shutil.copy(copy_file, os.environ['OUT'])
+
+
+def fuzz(input_corpus, output_corpus, target_binary):  # pylint: disable=too-many-branches,too-many-statements
+    """Run fuzzer."""
+    run_options = []
+    benchmark_name = os.environ['BENCHMARK']
+
+    if benchmark_name == 'bloaty_fuzz_target':
+        run_options = ["-L", "0"]
+    elif benchmark_name == 'curl_curl_fuzzer_http':
+        run_options = ["-L", "-0"]
+    elif benchmark_name == 'jsoncpp_jsoncpp_fuzzer':
+        run_options = ["-L", "0"]
+    elif benchmark_name == 'lcms-2017-03-21':
+        run_options = ["-L", "-1"]
+    elif benchmark_name == 'libjpeg-turbo-07-2017':
+        run_options = ["-L", "0"]
+    elif benchmark_name == 'libpcap_fuzz_both':
+        run_options = ["-L", "0"]
+    elif benchmark_name == 'libpng-1.2.56':
+        run_options = ["-L", "-1"]
+    elif benchmark_name == 'mbedtls_fuzz_dtlsclient':
+        run_options = ["-L", "0"]
+    elif benchmark_name == 'openthread-2019-12-23':
+        run_options = ["-L", "0"]
+    elif benchmark_name == 'proj4-2017-08-14':
+        run_options = ["-L", "-1"]
+    elif benchmark_name == 'sqlite3_ossfuzz':
+        run_options = ["-L", "-1"]
+    elif benchmark_name == 'woff2-2016-05-06':
+        run_options = ["-L", "0"]
+
+    os.environ['AFL_MAP_SIZE'] = '524288'
+
+    aflplusplus_fuzzer.fuzz(input_corpus,
+                            output_corpus,
+                            target_binary,
+                            flags=(run_options))


Test patch: