我在用
libFuzzer
模糊API。
并将它们转换为c++类实例化。
这是通过调用
std::vector::resize()
. 向量抛出一个
std::bad_alloc
following documentation
关于OOM问题)。
为了降低fuzzer运行时使用的内存量,我希望设置
ulimit -v
并调整进程的可用虚拟内存。但是这样做会导致
==27609==ERROR: AddressSanitizer failed to allocate 0xdfff0001000 (15392894357504) bytes at address 2008fff7000 (errno: 12)
==27609==ReserveShadowMemoryRange failed while trying to map 0xdfff0001000 bytes. Perhaps you're using ulimit -v
为什么地址消毒剂不能在ulmit-v下工作?
我希望它能,那么我也许能更有效地模糊。
我的生成标志是:
copts = [
"-fsanitize=address,fuzzer",
"-fsanitize-trap=undefined,integer",
"-fsanitize-coverage=trace-pc,trace-cmp,trace-pc-guard",
"-g",
"-O0",
"-fno-omit-frame-pointer",
"-fno-sanitize=vptr",
],
linkopts = [
"-fsanitize=address,fuzzer",
"-fsanitize-trap=undefined,integer",
"-fno-sanitize=vptr",
"-fsanitize-link-c++-runtime",
],
我试着把旗子关掉,这样我就可以
ulimit
运行fuzzer:
copts = [
"-fsanitize=fuzzer",
"-g",
"-O0",
"-fno-omit-frame-pointer",
],
linkopts = [
"-fsanitize=fuzzer",
],
但这会立即导致故障。