Follow-up ASan fixes

Cargo.toml

@@ -26,6 +26,8 @@ cli = [
     "cargo_metadata",
     "clap",
     "console",
+    "dep:serde",
+    "dep:serde_json",
     "glob",
     "indicatif",
     "libc",
@@ -60,6 +62,8 @@ indicatif = { version = "0.18.4", optional = true }
 libc = { version = "0.2.183", optional = true }
 rayon = { version = "1.11.0", optional = true }
 semver = { version = "1.0.27", optional = true }
+serde = { version = "1.0", features = ["derive"], optional = true }
+serde_json = { version = "1.0", optional = true }
 signal-hook = { version = "0.4.3", optional = true }
 strip-ansi-escapes = { version = "0.2.1", optional = true }
 target-triple = { version = "1.0.0", optional = true }

examples/asan/src/main.rs

@@ -4,7 +4,7 @@ fn main() {
             return;
         }
         if data[0] == b'f' && data[1] == b'u' && data[2] == b'z' && data[3] == b'z' {
-            let xs = [0, 1, 2, 3];
+            let xs = std::hint::black_box([0, 1, 2, 3]);
             let _y = std::hint::black_box(unsafe { *xs.as_ptr().add(4) });
         }
     });

src/bin/cargo-ziggy/build.rs

@@ -111,7 +111,14 @@ impl Build {
             let run = common
                 .cargo()
                 .args(["hfuzz", "build", "--bin", &cx.bin_target])
-                .env("CARGO_TARGET_DIR", cx.target_dir.join("honggfuzz"))
+                .env(
+                    "CARGO_TARGET_DIR",
+                    cx.target_dir.join(if self.asan {
+                        "honggfuzz-asan"
+                    } else {
+                        "honggfuzz"
+                    }),
+                )
                 .envs(honggfuzz_envs(self.asan))
                 .stdout(process::Stdio::piped())
                 .spawn()?

src/bin/cargo-ziggy/clean.rs

@@ -35,6 +35,7 @@ impl Clean {
         clean("afl", Some(target_triple::TARGET), false)?;
         // honggfuzz uses --target=host
         clean("honggfuzz", Some(target_triple::TARGET), true)?;
+        clean("honggfuzz-asan", Some(target_triple::TARGET), true)?;
         // coverage (from ziggy cover)
         clean("coverage", None, false)?;
         // runner (from ziggy run)

src/bin/cargo-ziggy/fuzz.rs

@@ -1,6 +1,6 @@
 use crate::{
     Build, Common, Cover, Fuzz, FuzzingEngines, Minimize,
-    util::{Context, ContextView},
+    util::{Context, ContextView, TimeoutArg},
 };
 use anyhow::{Context as _, Error, Result, anyhow, bail};
 use console::{Term, style};
@@ -100,6 +100,12 @@ impl Fuzz {
         };
         let cx_view = cx.view(common);
 
+        if self.asan && self.memory_limit.is_some() {
+            bail!(
+                "--memory-limit and --asan are incompatible, because ASan reserves a large shadow mapping"
+            );
+        }
+
         if self.binary.is_none() {
             let build = Build {
                 no_afl: !self.afl(),
@@ -518,11 +524,6 @@ impl Fuzz {
                     22 => "-l3at",
                     _ => "-c-", // disable Cmplog, needs AFL++ 4.08a
                 };
-                // AFL timeout is in ms so we convert the value
-                let timeout_option_afl = match self.timeout {
-                    Some(t) => format!("-t{}", t * 1000),
-                    None => String::new(),
-                };
                 let memory_option_afl = match &self.memory_limit {
                     Some(m) => format!("-m{m}"),
                     None => String::new(),
@@ -589,14 +590,14 @@ impl Fuzz {
                                 &format!("-o{}/afl", paths.output_target),
                                 &format!("-g{}", self.min_length),
                                 &format!("-G{}", self.max_length),
+                                &TimeoutArg::from(self.timeout).afl_arg(),
                                 &use_shared_corpus,
                                 &use_initial_corpus_dir,
                                 old_queue_cycling,
                                 cmplog_options,
                                 mopt_mutator,
                                 mutation_option,
                                 input_format_option,
-                                &timeout_option_afl,
                                 &memory_option_afl,
                                 &dictionary_option,
                             ]
@@ -641,8 +642,9 @@ impl Fuzz {
                 run_args.push_str(&format!(" -F{}", self.max_length));
                 run_args.push_str(&format!(" --dynamic_input={}/queue", paths.output_target));
                 run_args.push_str(" --tmout_sigvtalrm");
-                if let Some(t) = self.timeout {
-                    run_args.push_str(&format!(" -t{t}"));
+                {
+                    run_args.push(' ');
+                    run_args.push_str(&TimeoutArg::from(self.timeout).honggfuzz_arg());
                 }
                 if let Some(d) = &self.dictionary {
                     run_args.push_str(&format!(" -w{}", d.display()));
@@ -653,6 +655,11 @@ impl Fuzz {
 
                 run_args
             };
+            let hfuzz_target = if self.asan {
+                "honggfuzz-asan"
+            } else {
+                "honggfuzz"
+            };
 
             let log = File::create(format!("{}/logs/honggfuzz.log", paths.output_target))?;
 
@@ -670,7 +677,7 @@ impl Fuzz {
                         ),
                         "/dev/null",
                     ])
-                    .env("CARGO_TARGET_DIR", cx.target_dir().join("honggfuzz"))
+                    .env("CARGO_TARGET_DIR", cx.target_dir().join(hfuzz_target))
                     .envs(crate::build::honggfuzz_envs(self.asan))
                     .env(
                         "HFUZZ_WORKSPACE",
@@ -745,8 +752,9 @@ impl Fuzz {
             output_corpus: PathBuf::from(minimized_corpus),
             ziggy_output: self.ziggy_output.clone(),
             jobs: self.jobs,
-            timeout: self.timeout.unwrap_or(5000),
+            timeout: self.timeout,
             engine,
+            release: self.release,
         };
         match minimization_args.minimize(common) {
             Ok(()) => {
@@ -769,8 +777,8 @@ impl Fuzz {
                     new_corpus_size
                 ))?;
             }
-            Err(_) => {
-                bail!("Please check the logs, this might be an oom error");
+            Err(e) => {
+                return Err(e).context("Please check the logs, this might be an oom error");
             }
         }
         Ok(())