[lld] r308809 - Don't crash on an empty section with an ALIGN.

George Rimar via llvm-commits llvm-commits at lists.llvm.org
Tue Aug 1 06:33:16 PDT 2017


>>Please note that this is a completely different kind of work compared
>>to what we did last year.
>>In fact, while in the linker input case you can just "tolerate"
>>crashes, because the output of the compiler is the input to the linker
>>(garbage-in garbage-out), here you have human input (i.e. the linker
>>script tests).
>>We could try to never crash on invalid linker scripts and emit a sane
>>diagnostic instead, if possible.
>>
>>Thanks,
>>
>>--
>>Davide
>
>Yeah, thats exactly what I was thinking about :)
>Honestly at previous week I tried to do quick AFL run out of curiosity
>to check what happen with current LLD. I mutated testcase objects,
>just like the year ago. After 10h run it found few crashes, but after review
>of them I found it will probably be hard to justify and land fixes.
>
>And scripts are really different at this point.
>I agree that we should never crashs/hang for them.
>
>George.

Just want to share first fuzzing results. After about 20h of total fuzzing it
found 5 unique segfaults. They are: D36145, D36140, D36138, D35942, D35891.

I am using AFL with dictionary containing different linker script commands and
constructions (https://justpaste.it/19lh3).

Input data for fuzzing is a set of linkerscripts taken from LLD testcases. 
I am using -shared and single input object which is compiled from trivial hello
world look-like app (https://justpaste.it/19lhb).

I want to let it run few more days probably to see what else can it find.
This approach is probably too dumb, but showed some useful results.

George.


More information about the llvm-commits mailing list