|
@@ -37,3 +37,40 @@ encountered: `oom` (out-of-memory), `crash`, etc.
|
|
|
* `mv artifacts/TARGET/CRASH-FILE artifacts/TARGET/NAME`
|
|
* `mv artifacts/TARGET/CRASH-FILE artifacts/TARGET/NAME`
|
|
|
|
|
|
|
|
Then add the new `artifacts/TARGET/NAME` file to git.
|
|
Then add the new `artifacts/TARGET/NAME` file to git.
|
|
|
|
|
+
|
|
|
|
|
+## Out-of-memory issues in libfuzzer/AddressSanitizer
|
|
|
|
|
+
|
|
|
|
|
+Periodically you may encounter a crash with text like the following:
|
|
|
|
|
+```
|
|
|
|
|
+AddressSanitizer: requested allocation size 0xFOO (0xBAR after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000
|
|
|
|
|
+```
|
|
|
|
|
+
|
|
|
|
|
+This indicates that Rust is trying to allocate a large amount of memory in a way that crashes libFuzzer.
|
|
|
|
|
+It likely indicates a memory-intensive part of the codebase but does not indicate a crash in DarkFi code,
|
|
|
|
|
+per se. Instead, libFuzzer itself is crashing.
|
|
|
|
|
+
|
|
|
|
|
+In this case, **do not add the crash artifact to the corpora**. Try to
|
|
|
|
|
+simplify the fuzz harness instead to reduce its code coverage. If the
|
|
|
|
|
+harness is targeting a high-level function, try isolating the problem
|
|
|
|
|
+and fuzzing a lower-level function instead.
|
|
|
|
|
+
|
|
|
|
|
+It is possible to increase the amount of memory libFuzzer is allowed to use by passing an argument
|
|
|
|
|
+to it via libFuzzer like so:
|
|
|
|
|
+
|
|
|
|
|
+```sh
|
|
|
|
|
+cargo fuzz run --all-features zkas-decoder -- "-rss_limit_mb=4096"
|
|
|
|
|
+```
|
|
|
|
|
+
|
|
|
|
|
+However, this is unlikely to resolve the issue due to differences in
|
|
|
|
|
+the fuzzing architecure vs. DarkFi's intended build targets.
|
|
|
|
|
+
|
|
|
|
|
+## Architecure incompatibilities: wasm32-unknown-unknown
|
|
|
|
|
+
|
|
|
|
|
+DarkFi is developed to focus on the `wasm32-unknown-unknown` architecture.
|
|
|
|
|
+Unfortunately, this is not supported by most (any?) fuzzing tools in the Rust
|
|
|
|
|
+ecosystem; instead our fuzz targets will be built for 64-bit Linux systems.
|
|
|
|
|
+This might introduce subtle issues in the fuzzing process especially since
|
|
|
|
|
+errors found during fuzzing are likely to be precisely the edge-cases that
|
|
|
|
|
+trigger incompatibilites between build architectures.
|
|
|
|
|
+
|
|
|
|
|
+Further research is needed here to find a reliable solution.
|