The bc-gh project in OSS-Fuzz (projects/bc-gh) is currently disabled. It was disabled in the original integration commit a7c16d818 because of LeakSanitizer leak reports, which the commit message noted were not reproducible under Valgrind (see quoted message below).
I set disabled to true because LeakSanitizer claims the fuzzers have leaks. However, this is not true because bc and dc run without leaks under Valgrind. After some debugging, I can cause them to free the memory by putting an assert(false); after all of the frees, and it trips. But if I remove it, LeakSanitizer sees leaks. Whether it's PEBKAC (probably) or miscompilation (unlikely), I don't know, but I figured I'd commit the necessary stuff for the project. I'll try to figure out the problem later.
Separately, the OSS-Fuzz build itself had been broken: the build script called ./configure -Z, which version 7.2.0's configure.sh no longer supports (OSS-Fuzz mode is now controlled by the BC_ENABLE_OSSFUZZ macro). Removing the invalid flag also exposed a configure.sh bug — the multi-line test_target variable breaks the sed-based substring_replace() (sed: unterminated 's' command).
A PR in OSS-Fuzz now fixes the build/compile path: build_fuzzers succeeds and check_build passes. However, this only addresses compilation — it does not verify the LeakSanitizer leak reports that originally caused the project to be disabled.
Question
Would you like to restart the fuzzing of this project? If yes, I will remove disabled: true from projects/bc-gh/project.yaml in the OSS-Fuzz PR.
Additional context
- There is also an upstream bug in configure.sh worth fixing independently: the test_target variable contains a literal newline that breaks the sed-based replacement in scripts/functions.sh. If fixed upstream, the temporary workaround in the OSS-Fuzz build script can be removed.
The bc-gh project in OSS-Fuzz (projects/bc-gh) is currently disabled. It was disabled in the original integration commit a7c16d818 because of LeakSanitizer leak reports, which the commit message noted were not reproducible under Valgrind (see quoted message below).
Separately, the OSS-Fuzz build itself had been broken: the build script called ./configure -Z, which version 7.2.0's configure.sh no longer supports (OSS-Fuzz mode is now controlled by the BC_ENABLE_OSSFUZZ macro). Removing the invalid flag also exposed a configure.sh bug — the multi-line test_target variable breaks the sed-based substring_replace() (sed: unterminated 's' command).
A PR in OSS-Fuzz now fixes the build/compile path: build_fuzzers succeeds and check_build passes. However, this only addresses compilation — it does not verify the LeakSanitizer leak reports that originally caused the project to be disabled.
Question
Would you like to restart the fuzzing of this project? If yes, I will remove disabled: true from projects/bc-gh/project.yaml in the OSS-Fuzz PR.
Additional context