libarchive: fix harness and improve build setup #12052
Conversation
This fixes an API misuse issue in the libarchive harness. Calling `archive_read_add_passphrase` is only allowed before `archive_read_open_memory` and thus made all of the following code exit early via `archive_check_magic` calls.
Note that `-DDONT_FAIL_ON_CRC_ERROR` requires upstream changes in order to work. (i.e. this failed with "CMake doesn't know about this option" previously)
|
Mrmaxmeier is a new contributor to projects/libarchive. The PR must be approved by known contributors before it can be merged. The past contributors are: DonggeLiu, jvoisin, devtty1er, Dor1s, mmatuska (unverified), inferno-chromium (unverified), ssbr (unverified) |
cc @DonggeLiu |
|
@DavidKorczynski could you please double-check this? |
|
Friendly bump :) |
|
📈 |
|
Libarchive used to be quite high -- and indeed it was in 2021: https://storage.googleapis.com/oss-fuzz-coverage/libarchive/reports/20210204/linux/report.html It looks like the regressions happened around October 2021 where there was a lot of activity on the project |
This fixes a major harness issue in the
libarchivefuzzer and resolves a fuzzing roadblock issue related to the build setup.All calls after
archive_read_add_passphrasecurrently exit early because the decoder state is marked as invalid due to incorrect API usage.When combined with libarchive/libarchive#2229, this should improve coverage from ~15% to >45%.
While the harness issue regressed at some point, it seems like the CRC build flag issue was always present in oss-fuzz's libarchive setup.
Thanks!