cmd/go: simple off-by-one example takes longer than expected to complete #47090
Description
What version of Go are you using (go version)?
$ gotip version
go version devel go1.17-542e8c74e7 Fri Jun 4 15:59:32 2021 +0000 linux/amd64
What did you do?
I ported a simple example I've used to test go-fuzz in the past:
// +build gofuzz
package fuzz
func Example(data []byte) bool {
if len(data) == 9 {
if data[0] == 'G' && data[1] == 'O' && data[2] == 'P' && data[3] == 'H' && data[4] == 'E' && data[5] == 'R' && data[6] == 'S' && data[7] == '!' && data[8] == '!' && data[9] == '!' {
return true
}
}
return false
}
func Fuzz(data []byte) int {
Example(data)
return 0
}⬇️
// +build gofuzzbeta
package fuzz
import (
"testing"
)
// Example is a common fuzzing example that demonstrates an off-by-one/out-of-bounds
// error which causes the program to crash.
//
// Instead of checking that len(data) == 9 the correct code should be len(data) == 10.
func Example(data []byte) bool {
if len(data) == 9 {
if data[0] == 'G' && data[1] == 'O' && data[2] == 'P' && data[3] == 'H' && data[4] == 'E' && data[5] == 'R' && data[6] == 'S' && data[7] == '!' && data[8] == '!' && data[9] == '!' {
return true
}
}
return false
}
func FuzzOffByOne(f *testing.F) {
f.Fuzz(func(t *testing.T, input []byte) {
Example(input)
})
}$ gotip test -fuzz=FuzzOffByOneWhat did you expect to see?
I've run the example several times before, and would generally expect a fuzzer to find a crash fairly fast, even without a corpus -- somewhere between a few seconds to a few minutes.
Using the same CPU and RAM configuration as the native fuzzer test, I was able to find it within seconds using go-fuzz:
What did you see instead?
With the new native fuzzer, it took ~24 hours to find a crash using 2GB of RAM and 1 CPU (from an n1-standard-2 instance):
