Wireshark-dev: Re: [Wireshark-dev] Fuzz testing with valgrind

From: Balint Reczey <balint.reczey@xxxxxxxxxxxx>
Date: Mon, 30 Jul 2012 20:57:30 +0200
Hi Evan,

On 07/26/2012 04:44 AM, Evan Huus wrote:
On Wed, Jul 25, 2012 at 7:03 PM, Martin Mathieson
<martin.r.mathieson@xxxxxxxxxxxxxx>  wrote:


On Wed, Jul 25, 2012 at 6:12 PM, Evan Huus<eapache@xxxxxxxxx>  wrote:

I've been playing around in my head for a while now with the idea of
running fuzz tests under valgrind. I notice the fuzz-test script
already sets a bunch of environment variables for memory checking, so
I'm not sure if valgrind would really add anything.

How extensive are the memory checks turned on by the fuzz-test script?
Would valgrind be a useful addition, or would it be mostly redundant?

Thanks,
Evan


I'm not sure either, but out of the 3 problems reported by valgrind that I
just fixed:
- 1 was writing outside of allocated data (which the canary checks may have
picked up on)
- 2 were reading/displaying/branching-based-upon uninitialized data (which I
don't expect other types of checks would spot)

Martin

Basic support added in revision 44024, so it's there if people want to
use it. I don't know if it would be worth turning on for the
build-bot, as it does slow down the check considerably, but it will
probably catch a few more errors.
I think it is a good idea. Maybe we could have a fuzz-test run with Valgrind once a week.
The memory corruption I fixed recently has been identified using Valgrind as well.

Cheers,
Balint


Evan