aboutsummaryrefslogtreecommitdiff
path: root/fuzzers
diff options
context:
space:
mode:
authorCalder Kitagawa <ckitagawa@chromium.org>2018-06-01 16:12:01 +0000
committerEdward Lesmes <ehmaldonado@google.com>2021-07-23 22:48:18 +0000
commitd29431970cf0221c9eb2e5d41f424d12c675ceda (patch)
treecd12e50af526f68bc5a2f1ca02a40451430e6329 /fuzzers
parent16f8ef6432c0b1f3c668921aa120be7a4b16a701 (diff)
downloadzucchini-d29431970cf0221c9eb2e5d41f424d12c675ceda.tar.gz
[Zucchini]: Disable CHECK for ZTF Gen Fuzzer patch size
The fuzzer is really smart; it discovered the worst case patch scenario of alternating 16 byte regions of ZTF and Raw regions. This resulted in a 310 B testcase (17 B source file) generating a 2.5 ~kB patch (uncompressed) (470 B compressed). This is the absolute worst case behavior which requires an intentionally badly designed archive/input. In reality this would never occur with valid binaries. It is good to know that this case exists but there isn't much that can be done to prevent it in Zucchini so we can just disable this check. Two solutions to this could be: 1. Make Zucchini smart enough to try multiple patches, compare the compressed size and choose the best option. 2. Ignore it and in infra compare: - Compressed ensemble patch - Compressed raw patch - Compressed image Then just ship the smallest. Option 1 adds a lot of complexity. Ideally, Zucchini should remain naive with regards to generating compressed patches so that the infra can choose the preferred compression and keep Zucchini fast. The case for making the infra smarter is compelling and probably the solution to pursue. However, because we have control over the input binaries and this case will realistically not occur it isn't a priority. Bug: 848503 Change-Id: Ic505db49fd89f12dbd1eb5b100a59832f6054b2e Reviewed-on: https://chromium-review.googlesource.com/1082008 Reviewed-by: Samuel Huang <huangs@chromium.org> Commit-Queue: Calder Kitagawa <ckitagawa@chromium.org> Cr-Commit-Position: refs/heads/master@{#563662} NOKEYCHECK=True GitOrigin-RevId: 54bf0d1da91c3db9a3682b840f7c76faa93c0072
Diffstat (limited to 'fuzzers')
-rw-r--r--fuzzers/ztf_gen_fuzzer.cc7
1 files changed, 1 insertions, 6 deletions
diff --git a/fuzzers/ztf_gen_fuzzer.cc b/fuzzers/ztf_gen_fuzzer.cc
index 76ae44f..785aed4 100644
--- a/fuzzers/ztf_gen_fuzzer.cc
+++ b/fuzzers/ztf_gen_fuzzer.cc
@@ -59,13 +59,8 @@ DEFINE_BINARY_PROTO_FUZZER(const zucchini::fuzzers::FilePair& file_pair) {
// Fuzz Target.
zucchini::GenerateEnsemble(old_image, new_image, &patch_writer);
- // Check that the patch size is sane. Crash the fuzzer if this isn't the case
- // as it is a failure in Zucchini's patch performance that is worth
- // investigating.
- size_t patch_size = patch_writer.SerializedSize();
- CHECK_LE(patch_size, kMaxImageSize * 2);
-
// Write to buffer to avoid IO.
+ size_t patch_size = patch_writer.SerializedSize();
std::unique_ptr<uint8_t[]> patch_data(new uint8_t[patch_size]);
zucchini::BufferSink patch(patch_data.get(), patch_size);
patch_writer.SerializeInto(patch);