Hi!
Today, I’ve decided to spend some time fuzzing a random C++ library on github. I hit an unfortunate roadblock: I can’t get the code to link properly.
I think I need the following:
- clang-based stdenv
- clang’s libcxx based stdenv
- llvm’s linker
Here’s what I have
13:32:51|~/tmp/f
λ bat -p shell.nix
with import <nixpkgs> {};
llvmPackages_11.libcxxStdenv.mkDerivation {
name = "clang-nix-shell";
buildInputs = [ /* add libraries here */ ];
}
13:32:56|~/tmp/f
λ bat -p main.cpp
#include "stdint.h"
#include "stddef.h"
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
return 0; // Non-zero return values are reserved for future use.
}
13:32:59|~/tmp/f
λ nix-shell
[nix-shell:~/tmp/f]$ clang++ -fuse-ld=lld -fsanitize=fuzzer,address main.cpp
ld.lld: error: undefined symbol: std::_Hash_bytes(void const*, unsigned long, unsigned long)
...
...
...
ld.lld: error: undefined symbol: std::istream& std::istream::_M_extract<unsigned long>(unsigned long&)
>>> referenced by FuzzerDataFlowTrace.cpp.o:(fuzzer::BlockCoverage::AppendCoverage(std::istream&)) in archive /nix/store/rm09lg48s2qxz7ydsm9b1ld1152j8fgx-clang-wrapper-11.1.0/resource-root/lib/linux/libclang_rt.fuzzer-x86_64.a
>>> referenced by FuzzerFork.cpp.o:(fuzzer::GlobalEnv::RunOneMergeJob(fuzzer::FuzzJob*)) in archive /nix/store/rm09lg48s2qxz7ydsm9b1ld1152j8fgx-clang-wrapper-11.1.0/resource-root/lib/linux/libclang_rt.fuzzer-x86_64.a
>>> referenced by FuzzerMerge.cpp.o:(fuzzer::Merger::Parse(std::istream&, bool)) in archive /nix/store/rm09lg48s2qxz7ydsm9b1ld1152j8fgx-clang-wrapper-11.1.0/resource-root/lib/linux/libclang_rt.fuzzer-x86_64.a
>>> referenced 5 more times
ld.lld: error: too many errors emitted, stopping now (use -error-limit=0 to see all errors)
clang-11: error: linker command failed with exit code 1 (use -v to see invocation)
Two questions here:
- How do I solve the immediate problem of getting this to compile?
- Meta question: how do I go debugging such issues? I am a bit frustrated that something conceptually simple as “follow llvm’s tutorial on fuzzing” quickly ended in errors, where I understand the general problem (linkers are hard), but have very little visibility into what’s going on exactly, and don’t know what is the next step in debugging (short of crying for help:) )