Skip to content

fix(fuzz): run cargo-fuzz without a sanitizer on macOS - #77

Merged
matthieugouel merged 1 commit into
mainfrom
fix/fuzz-macos-asan-hang
Nov 4, 2026
Merged

matthieugouel merged 1 commit into
mainfrom
fix/fuzz-macos-asan-hang

Conversation

@matthieugouel

Copy link
Copy Markdown
Member

Summary

On recent macOS, make fuzz-* hangs forever with no output. The nightly AddressSanitizer runtime deadlocks during process startup (__asan::InitializeShadowMemory → dyld → malloc re-entering ASan, seen with sample), before libFuzzer runs a single input. Since libFuzzer only checks -max_total_time between inputs, the 60s limit never triggers.

The fuzz targets now pass --sanitizer none on Darwin via a FUZZ_FLAGS Makefile variable. ASan matters little here, because the crate has no unsafe code. Other platforms keep ASan. tests/fuzz/README.md documents the flag for direct cargo fuzz use.

Same fix as in nxthdr/ipfix-parser.

Test plan

  • Before: the ASan fuzz_single binary hangs with no output (killed after 15s)
  • After: make fuzz-single runs 377K inputs in 60s; fuzz_multiple and fuzz_structured also run (147K and 393K inputs in 20s); no crashes

🤖 Generated with Claude Code

On recent macOS, the nightly AddressSanitizer runtime hangs at startup in
__asan::InitializeShadowMemory, before any input is run: libFuzzer prints
nothing and the process spins at 100% CPU, ignoring -max_total_time. The
fuzz Makefile targets now pass --sanitizer none on Darwin (the crate has no
unsafe code); other platforms keep ASan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@matthieugouel

matthieugouel commented Nov 4, 2026 •

Copy link
Copy Markdown
Member Author

Claude finished @matthieugouel's task in 12s —— View job


Review of PR #77

No important findings. The change looks correct and small.

  • ifeq ($(shell uname -s),Darwin) with FUZZ_FLAGS ?= works as intended. Linux gets an empty value, so it keeps ASan. Users can also override the flag from the environment or the command line.
  • $(FUZZ_FLAGS) sits before the target name and the -- separator in every cargo fuzz run invocation, so the flag reaches cargo-fuzz and not libFuzzer.
  • Dropping ASan is a reasonable trade-off, since the crate has no unsafe code. Panics and overflow checks are still caught.
  • I didn't run the fuzz targets, because this runner is Linux and the hang only happens on macOS. I'm relying on the test plan in the PR description. The CLAUDE.md steps for new sFlow extensions don't apply to this change.

One optional point, not blocking: the README's "reproduce a crash" command, cargo +nightly fuzz run ... fuzz_single artifacts/..., appears before the new macOS section. It will hang on macOS without --sanitizer none. You could add a short note there or point to the macOS section.
· Branch: fix/fuzz-macos-asan-hang

@codecov

codecov Bot commented Nov 4, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@matthieugouel
matthieugouel merged commit ae623d1 into main Nov 4, 2026
8 checks passed
@matthieugouel
matthieugouel deleted the fix/fuzz-macos-asan-hang branch November 4, 2026 13:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant