fuzztest: workaround slowness with clang libsanitizer.
Currently nanopb dynamic allocation implementation grows the arrays with realloc()
as each new field arrives. This is the simplest and smallest code approach, but
results in a lot of realloc() calls. Normally this is a bit slow, but not hugely
so as typical realloc() implementation can grow the arrays in place.
However, libsanitizer realloc() implementation always copies the whole array.
This unnecessarily slows down fuzz testing.
This commit adds a rounding of the allocated block size in fuzztest to reduce
the number of realloc() calls. This does reduce the accuracy of libsanitizer tests
for large memory reallocations, but the custom checks in malloc_wrappers.c should
cover for the difference.
diff --git a/tests/common/malloc_wrappers.c b/tests/common/malloc_wrappers.c
index 3f2cc38..526a0fc 100644
--- a/tests/common/malloc_wrappers.c
+++ b/tests/common/malloc_wrappers.c
@@ -71,6 +71,20 @@
}
}
+#ifdef LLVMFUZZER
+static size_t round_blocksize(size_t size)
+{
+ if (size < 256)
+ {
+ return size;
+ }
+ else
+ {
+ return (size + 1023) / 1024 * 1024;
+ }
+}
+#endif
+
/* Reallocate block and check / write guard values */
void* realloc_with_check(void *ptr, size_t size)
{
@@ -91,7 +105,22 @@
if (size <= g_max_alloc_bytes - (g_alloc_bytes - oldsize))
{
+#ifdef LLVMFUZZER
+ /* LLVM libsanitizer has a realloc() implementation that always copies
+ * the whole memory block, even if there would be space to expand it in
+ * place. This gets pretty slow when fuzzing, so this wrapper limits the
+ * realloc() calls by . Real world
+ * realloc() implementations are hopefully smarter. */
+ size_t new_rounded = round_blocksize(size + GUARD_SIZE);
+ size_t old_rounded = round_blocksize(oldsize + GUARD_SIZE);
+
+ if (new_rounded != old_rounded)
+ {
+ buf = realloc(buf, new_rounded);
+ }
+#else
buf = realloc(buf, size + GUARD_SIZE);
+#endif
}
else
{
