fitzgen requested alexcrichton for a review on PR #8742.
fitzgen opened PR #8742 from fitzgen:fuzz-bounds-checks
to bytecodealliance:main
.
fitzgen requested wasmtime-fuzz-reviewers for a review on PR #8742.
fitzgen updated PR #8742.
alexcrichton submitted PR review:
Nice! Any particular motivation for this or just curious to see how it fares?
alexcrichton submitted PR review:
Nice! Any particular motivation for this or just curious to see how it fares?
alexcrichton created PR review comment:
Do you think it's worth doing this in the text format instead of expanding out all the wasm-encoder bits?
alexcrichton created PR review comment:
Mind adding a memory64 knob to this as well? Also mind adding some docs for what each field member is? For example at a glance I'm not sure what
growth
is.
alexcrichton created PR review comment:
Also could this grow a fully general
WasmtimeConfig
? It would be good to test various compilation settings, Winch, the pooling allocator, etc.
alexcrichton created PR review comment:
Does this mean that memories are going to grow an arbitrary 32-bit amount of bytes? If so should that be capped here to stay within limits on oss-fuzz?
github-actions[bot] commented on PR #8742:
Subscribe to Label Action
cc @fitzgen
<details>
This issue or pull request has been labeled: "fuzzing"Thus the following users have been cc'd because of the following labels:
- fitzgen: fuzzing
To subscribe or unsubscribe from this label, edit the <code>.github/subscribe-to-label.json</code> configuration file.
Learn more.
</details>
fitzgen commented on PR #8742:
Any particular motivation for this or just curious to see how it fares?
I started writing this for my implementation of the custom-page-sizes proposal, but figured I'd split it out and land it first to keep PRs small.
fitzgen submitted PR review.
fitzgen created PR review comment:
Ha, I originally had that and rewrote it into the text format to get a little bit better throughput for the fuzzer. I can add a comment giving an overview of the generated module or something to make readability a bit better at a glance though.
fitzgen edited PR review comment.
fitzgen submitted PR review.
fitzgen created PR review comment:
Good idea, will do.
fitzgen created PR review comment:
An arbitrary 32-bit number of pages. I figured we could just allow and ignore growth failure, but will that run afoul of oss-fuzz?
fitzgen submitted PR review.
alexcrichton submitted PR review.
alexcrichton created PR review comment:
I think so yeah, but not always. Oss-fuzz/libfuzzer I think override malloc and mainly look at the heap size through that but IIRC it also occasionally looks through vm stats and looks for things like
mmap
, so we could allocate 1G here and blow the limits on oss-fuzz when it gets around to detecting that. Given that I think we'll only want growths which are guaranteed to either succeed for fail given our memory limits.
fitzgen requested cfallin for a review on PR #8742.
fitzgen updated PR #8742.
fitzgen requested wasmtime-compiler-reviewers for a review on PR #8742.
cfallin submitted PR review.
cfallin submitted PR review.
cfallin created PR review comment:
Should this be
1
rather than8
? Otherwise this iteration range is empty...
alexcrichton submitted PR review.
alexcrichton created PR review comment:
This can use
input.config.to_store()
which should also handle things like epochs/fuel configuration I believe.
fitzgen submitted PR review.
fitzgen created PR review comment:
Unfortunately, we can't use that since we are setting extra config settings based on the arbitrary heap image, but we don't have access to the config/engine if we use that method.
fitzgen updated PR #8742.
fitzgen has enabled auto merge for PR #8742.
fitzgen merged PR #8742.
Last updated: Dec 23 2024 at 12:05 UTC