From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 920024AC03 for ; Mon, 15 Jul 2024 11:32:55 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 508CF68DA11; Mon, 15 Jul 2024 14:32:52 +0300 (EEST) Received: from mail-ed1-f45.google.com (mail-ed1-f45.google.com [209.85.208.45]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 68EB168D8E2 for ; Mon, 15 Jul 2024 14:32:45 +0300 (EEST) Received: by mail-ed1-f45.google.com with SMTP id 4fb4d7f45d1cf-585e774fd3dso5384444a12.0 for ; Mon, 15 Jul 2024 04:32:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1721043164; x=1721647964; darn=ffmpeg.org; h=to:subject:message-id:date:from:in-reply-to:references:mime-version :from:to:cc:subject:date:message-id:reply-to; bh=vSZoXMimLgmX13/MFQ0eFt04MBZZ7WpDEdZA+HxdmhI=; b=GyxeocPfEnaEayEIuaK/dkxVL8JpDxh1oxUoihyrAhbih0KJEJ9VU80XWUcHBuUBCp MZ3UKExXORE/3wga1mLgU32+Rit7F2kZi5iZoduH+4zyTiM7RwzETFHisiREi8Budqih JzxkZRrr/0QCtqdIDeFUi5e9DBL4eiB81g5Z03NPQc7h/dDPzXg9rZ7H2zLuEVZk76Jg VnA1qMRxONWx8UclIi8Nc90UiVq2olKG8acXdmmysE46dQXw8+LbXNKPBQRmeFd1Lyvf uJPqF7MopMb8wGlI2ziRhdhnBOJaxeRwmucecy7MXPfXYgRO2w3yJYCrIJTj3XMl6bDu hSUg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721043164; x=1721647964; h=to:subject:message-id:date:from:in-reply-to:references:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=vSZoXMimLgmX13/MFQ0eFt04MBZZ7WpDEdZA+HxdmhI=; b=NE1lKby28cFNgIbg5pzqB0lB5S6dzZn2IUjF/TF/KlrowQ3WvAcm7YN+kvjaNq6aAU mgWo4BrwMaRfrP5ptA2IvQ9DgDHCt97/okI4cPDsg1HTVQT8FXs97M9+sZmya6Sn2qm3 JOf8W/x+fwI1fJNqQGPlmObR6or8bEYHS6jOvf8PDYHrMQRbVR7qWb/BF/69/q6O+ffS T+YGNbtKgkSgXmBvs+JKDpfBkV4/pAf12/fmfa566dqzgVg49rD7xQa9NmDEsHBRq64Q JLw0QtD7V/5Zy3gSWz7P94ei9bEgADeIcCZdoctorJEN2k36QWVI51+PzPpmbmo1adFG cJDw== X-Gm-Message-State: AOJu0YzZwD0qbDPthATlcI/1EMmhZxl9kWYxdBAammQfOXn8kB1vS0cu 8RHq/LWWRMQ9ZFYrtFaeOluLkEGLgByB7AKsbktH5ulWu5zF05F3IdYCRosCSs+OfbjECdUSL0y SLgO5DMgSNHWuYI1PtSHKEUuhLt4aDA18whU= X-Google-Smtp-Source: AGHT+IHn+McOQYbMAKXR7jjgb+6/uDJhvpP78jhq9EdVG3KLezsd7kt9mcZEMQfRsnH2ilfeJkerVz2hdoFVcWBxV54= X-Received: by 2002:a05:6402:651:b0:585:4048:129a with SMTP id 4fb4d7f45d1cf-594bc7c81camr10189992a12.31.1721043164240; Mon, 15 Jul 2024 04:32:44 -0700 (PDT) MIME-Version: 1.0 References: <20240626224510.GS4991@pb2> <20240714195541.GE4991@pb2> In-Reply-To: <20240714195541.GE4991@pb2> From: Kacper Michajlow Date: Mon, 15 Jul 2024 13:32:20 +0200 Message-ID: To: FFmpeg development discussions and patches Subject: Re: [FFmpeg-devel] [OSS-Fuzz] Have you considered enabling memory sanitizer? X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: On Sun, 14 Jul 2024 at 21:55, Michael Niedermayer wrote: > > On Sat, Jul 13, 2024 at 11:12:40PM +0200, Kacper Michajlow wrote: > > On Thu, 27 Jun 2024 at 02:50, Kacper Michajlow wrote: > > > > > > On Thu, 27 Jun 2024 at 00:45, Michael Niedermayer > > > wrote: > > > > > > > > On Wed, Jun 26, 2024 at 09:07:42PM +0200, Kacper Michajlow wrote: > > > > > Hi, > > > > > > > > > > Like in the topic. I think it would be useful to enable MSAN on > > > > > OSS-Fuzz. We get some tiny issues and it would be probably good to > > > > > have them tracked upstream. All infra is here, so enabling it is as > > > > > simple as adding it to the project.yaml. Except libbz2.so and libz.so > > > > > would have to be built inline instead, looking at the build.sh, they > > > > > are prebuilt. The rest should just work (TM), but needs to be tested. > > > > > You can set an "experimental' flag to have it not create issues on > > > > > monorail, initially. > > > > > > > > I assumed ossfuzz would enable all sanitizers by default > > > > > > They do not do that by default, because MSAN requires all dependencies > > > to be instrumented too. See > > > https://google.github.io/oss-fuzz/getting-started/new-project-guide/#sanitizers > > > > > > Looking at build.sh for ffmpeg, it should be fine to enable it. > > > Obviously I have not tested everything, but I was running some tests > > > locally with MSAN and also tested it with mpv oss-fuzz builds where we > > > build ffmpeg too with MSAN. > > > > > > - Kacper > > > > I've sent a PR to enable MSAN and a few other build improvements. > > Please take a look https://github.com/google/oss-fuzz/pull/12211 > > > > > Also, would it be ok to add myself to auto_ccs for ffmpeg? Mostly to > > monitor what issues are reported upstream, as we get some reports in > > mpv fuzzing and I never know if I should report it upstream (ffmpeg) > > or it is already found by first-party fuzzing and I shouldn't make > > more noise. > > you are welcome to submit bug reports, you are welcome to submit bug fixes > if you find issues in FFmpeg. > > If someones work in FFmpeg or rather FFmpeg benefits from someone having > access to the reports, then (s)he should receive access. This seems not > to apply here I respect your decision. However, saying that anyone's (or my) contribution doesn't benefit FFmpeg is a strange thing to say for an open source project maintainer. It's all about time. I don't get paid to do any of this, so duplicating issues/reports manually from one system to another, if they are already reported, is a monkey's job which I'm not willing to do. This time could be devoted to actually fixing the issues. I'd like to help, but if it is not required, I will focus on other things. It also doesn't help that trac.ffmpeg is a black hole, where only Balling seems to be reading those tickets. Frankly, the review process is not better, as even trivial fixes take months to merge. > Also i expect the number of outstanding ossfuzz issues to decrease now > after the bulk of coverity issues has been dealt with For some class of issues sure, but Coverity bigfixes are most of the time workarounding the static analysis limitations. Fuzzing is more powerful and analyzes the code as a whole, not small snippets of it. - Kacper _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".