Эх сурвалжийг харах

docs: Add more details about fuzzing (#201)

Add more documentation to fuzz/README.md, especially when it comes to
interpreting out-of-memory issues.

Co-authored-by: y <y>
Co-authored-by: parazyd <parazyd@users.noreply.github.com>
greptile 2 жил өмнө
parent
commit
7e76cf360c
1 өөрчлөгдсөн 37 нэмэгдсэн , 0 устгасан
  1. 37 0
      fuzz/README.md

+ 37 - 0
fuzz/README.md

@@ -37,3 +37,40 @@ encountered: `oom` (out-of-memory), `crash`, etc.
 * `mv artifacts/TARGET/CRASH-FILE artifacts/TARGET/NAME`
 
 Then add the new `artifacts/TARGET/NAME` file to git.
+
+## Out-of-memory issues in libfuzzer/AddressSanitizer
+
+Periodically you may encounter a crash with text like the following:
+```
+AddressSanitizer: requested allocation size 0xFOO (0xBAR after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000
+```
+
+This indicates that Rust is trying to allocate a large amount of memory in a way that crashes libFuzzer. 
+It likely indicates a memory-intensive part of the codebase but does not indicate a crash in DarkFi code,
+per se. Instead, libFuzzer itself is crashing. 
+
+In this case, **do not add the crash artifact to the corpora**. Try to
+simplify the fuzz harness instead to reduce its code coverage. If the
+harness is targeting a high-level function, try isolating the problem
+and fuzzing a lower-level function instead.
+
+It is possible to increase the amount of memory libFuzzer is allowed to use by passing an argument
+to it via libFuzzer like so:
+
+```sh
+cargo fuzz run --all-features zkas-decoder -- "-rss_limit_mb=4096"
+```
+
+However, this is unlikely to resolve the issue due to differences in
+the fuzzing architecure vs. DarkFi's intended build targets.
+
+## Architecure incompatibilities: wasm32-unknown-unknown
+
+DarkFi is developed to focus on the `wasm32-unknown-unknown` architecture.
+Unfortunately, this is not supported by most (any?) fuzzing tools in the Rust
+ecosystem; instead our fuzz targets will be built for 64-bit Linux systems. 
+This might introduce subtle issues in the fuzzing process especially since
+errors found during fuzzing are likely to be precisely the edge-cases that
+trigger incompatibilites between build architectures.
+
+Further research is needed here to find a reliable solution.