the documentation lies.

The build output shows

CFLAGS=-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=address -fsanitize-address-use-after-scope -fsanitize=fuzzer-no-link

So let's try that.

diff --git a/src/bin/fuzzer.c b/src/bin/fuzzer.c
index 314012831d5d159bef569f5d5a3255ff2ee41db0..e897104a1157a631425ec1db532a0d065eb9b1fc 100644 (file)
--- a/src/bin/fuzzer.c
+++ b/src/bin/fuzzer.c
@@ -72,7 +72,7 @@ int LLVMFuzzerInitialize(int *argc, char ***argv)
        char const              *dict_dir       = getenv("FR_DICTIONARY_DIR");
        char const              *debug_lvl_str  = getenv("FR_DEBUG_LVL");
        char const              *p;
-#ifdef LIB_FUZZING_ENGINE
+#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
        char                    *dict_dir_to_free = NULL;
        char                    *lib_dir_to_free = NULL;
 #endif
@@ -142,7 +142,7 @@ int LLVMFuzzerInitialize(int *argc, char ***argv)
                }
        }
 
-#ifdef LIB_FUZZING_ENGINE
+#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
        /*
         *      oss-fuzz puts the dictionaries, etc. into subdirectories named after the location of the
         *      binary.  So we find the directory of the binary, and append "/dict" or "/lib" to find
@@ -221,7 +221,7 @@ int LLVMFuzzerInitialize(int *argc, char ***argv)
 
        init = true;
 
-#ifdef LIB_FUZZING_ENGINE
+#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
        talloc_free(dict_dir_to_free);
        talloc_free(lib_dir_to_free);
 #endif

diff --git a/src/bin/fuzzer.mk b/src/bin/fuzzer.mk
index 1edc5329d139959dc838de6ffa2120eba6b4e524..5f927cbc7b72a27b4dbaac00e4216c310d7cd31f 100644 (file)
--- a/src/bin/fuzzer.mk
+++ b/src/bin/fuzzer.mk
@@ -28,10 +28,6 @@ TGT_LDLIBS           := $(LIBS)
 
 FUZZER_CORPUS_DIR      := src/tests/fuzzer-corpus
 
-ifdef LIB_FUZZING_ENGINE
-SRC_CFLAGS             += -DLIB_FUZZING_ENGINE
-endif
-
 #
 #  Ensure that the large data file is copied from git-lfs,
 #  and then the files are extracted.