Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Fix Fuzzer Crash in ClusterFuzz Due to Missing Git Executable#1906

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Conversation

DaveLak
Copy link
Contributor

A Git executable is not globally available in the ClusterFuzz container
environment where OSS-Fuzz executes fuzz tests, causing an error in the fuzz
harnesses when GitPython attempts to initialize, crashing the tests before they
can run.

To avoid this issue, we bundle thegit binary that is available in the OSS-Fuzz
build container with the fuzz harness via Pyinstaller's--add-binary flag in
build.sh and use GitPython'sgit.refresh(<full-path-to-git-executable>)
method inside a Pyinstaller runtime check to initialize GitPython with the
bundled Git executable when running from the bundled application.

In all other execution environments, we assume agit executable is available
globally.

Fixes:

A Git executable is not globally available in the ClusterFuzz containerenvironment where OSS-Fuzz executes fuzz tests, causing an error in the fuzzharnesses when GitPython attempts to initialize, crashing the tests before theycan run.To avoid this issue, we bundle the `git` binary that is available in the OSS-Fuzzbuild container with the fuzz harness via Pyinstaller's `--add-binary` flag in`build.sh` and use GitPython's `git.refresh(<full-path-to-git-executable>)`method inside a Pyinstaller runtime check to initialize GitPython with thebundled Git executable when running from the bundled application.In all other execution environments, we assume a `git` executable is availableglobally.Fixes:-gitpython-developers#1905-google/oss-fuzz#10600
Copy link
Member

@ByronByron left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Thanks a lot for the fix!

I wonder how this could ever work on OSS-fuzz.

@ByronByron merged commit0552b83 intogitpython-developers:mainApr 23, 2024
26 checks passed
@DaveLak
Copy link
ContributorAuthor

I wonder how this could ever work on OSS-fuzz.

Different images everywhere 🫣

Byron reacted with laugh emoji

DaveLak added a commit to DaveLak/GitPython that referenced this pull requestApr 26, 2024
This is a second attempt atgitpython-developers#1906 and should resolve:-gitpython-developers#1905-google/oss-fuzz#10600PRgitpython-developers#1906 had the right idea but wrong implementation, and the differences betweenthe ClusterFuzz image that it was supposed to fix and the OSS-Fuzz image wherethe fix was tested led to the issue not being fully resolved.The root cause of the issue is the same: A Git executable is not globallyavailable in the ClusterFuzz container environment where OSS-Fuzz executesfuzz tests.gitpython-developers#1906 attempted to fix the issue by bundling the Git binary and usingGitPython's `git.refresh(<full-path-to-git-executable>)` method to set itinside the `TestOneInput` function of the test harness.However, GitPython attempts to set the binary at import time via its `__init__`hook, and crashes the test if no executable is found during the import.This issue is fixed here by setting the environment variable that GitPythonlooks in before importing it, so it's available for the import. This was testedby setting the `$PATH` to an empty string inside the test files, whichreproduced the crash, then adding the changes introduced here with `$PATH` stillempty, which avoided the crash indicating that the bundled Git executable isworking as expected.
@DaveLakDaveLak deleted the fuzzing-fix-missing-git-in-clusterfuzz branchApril 29, 2024 00:35
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers

@ByronByronByron approved these changes

Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

2 participants
@DaveLak@Byron

[8]ページ先頭

©2009-2025 Movatter.jp