Skip to content

Conversation

@rolbk
Copy link

@rolbk rolbk commented Jan 13, 2026

Summary

Fix binutils fuzz_strings fuzzer which was achieving 0% coverage due to missing initialization.

Main Change

Fix missing global variable initialization in fuzz_strings.c

The harness was not initializing important global variables, most importantly string_min (minimum string length to print) which defaults to 0. This causes strings to get stuck in an endless loop printing zero-length strings, likely explaining the 0% coverage.

Further Changes

  • Patch abort() in bfd/xsym.c - When --enable-targets=all is set, bfd_sym_read_header_v34() calls abort() for unimplemented v3.4/v3.5 xSYM format support, killing the fuzzer on malformed xSYM files. Replaced with return -1 to fall back to internal error handling.
  • Add seed corpus for strings fuzzer - Added binary-samples corpus similar to other binutils fuzzers.

Testing

python3 infra/helper.py build_image binutils --pull
python3 infra/helper.py build_fuzzers binutils --clean
python3 infra/helper.py run_fuzzer --corpus-dir ./corpus binutils fuzz_strings -- -fork=6 -ignore_crashes=1 -max_total_time=86400
python3 infra/helper.py build_fuzzers --sanitizer coverage binutils
python3 infra/helper.py coverage binutils --no-serve --corpus-dir ./corpus --fuzz-target fuzz_strings

24h test run coverage results:

Path Line Coverage Function Coverage Region Coverage
fuzz_strings.h 13.12% (111/846) 37.50% (6/16) 15.73% (123/782)

Related

@DavidKorczynski - Sorry for the ping: The old seed corpus for strings was removed in #6717. What was the reasoning behind that? Was this AFL-specific, or is this still relevant now? Thanks!

@google-cla
Copy link

google-cla bot commented Jan 13, 2026

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@github-actions
Copy link

rolbk is a new contributor to projects/binutils. The PR must be approved by known contributors before it can be merged. The past contributors are: hunsche, amodra, hghwng, DonggeLiu

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant