From 3c5d9f19aa10049bdc486351ec2e895d278f2504 Mon Sep 17 00:00:00 2001 From: DavidKorczynski Date: Tue, 1 Sep 2026 17:26:41 +0100 Subject: [PATCH 1/2] infra: avoid excessive objdump calls and adjust all.sh (#16083) We're currently doing excessive objdump calls in the bad build check. We only need it once to calculate the sanitizer keywords. Also adjust all.sh so it's no longer needed to set up specific Python packages to build the base images. This also makes it very easy to quickly adjust which base images to build by modifying the file. This is how it was earlier which IMO works better when adjusting the base images. --------- Signed-off-by: David Korczynski --- infra/base-images/all.sh | 23 ++++++++++++------- infra/base-images/base-runner/bad_build_check | 17 ++++++++++---- infra/indexer/frontend/ast_visitor.cc | 10 ++++++++ 3 files changed, 38 insertions(+), 12 deletions(-) diff --git a/infra/base-images/all.sh b/infra/base-images/all.sh index 2d5ba50754b2..c75726217d52 100755 --- a/infra/base-images/all.sh +++ b/infra/base-images/all.sh @@ -33,19 +33,26 @@ # The first argument is the version tag, e.g., 'latest', 'ubuntu-20-04'. VERSION_TAG=${1:-latest} -# Get the directory where this script is located to find the helper script. -SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)" - -# Fetch the official list of images from the Python source of truth. -# This avoids duplicating the image list and ensures this script is always -# up-to-date. -IMAGE_LIST=$(python3 "${SCRIPT_DIR}/list_images.py") +IMAGE_LIST=( + "base-clang" + "base-builder" + "base-builder-go" + "base-builder-javascript" + "base-builder-jvm" + "base-builder-python" + "base-builder-ruby" + "base-builder-rust" + "base-builder-swift" + "base-runner" + "base-runner-debug" + "indexer" +) echo "Building version: ${VERSION_TAG}" echo "Images to build: ${IMAGE_LIST}" # Loop through the official list of images and build each one. -for image_name in ${IMAGE_LIST}; do +for image_name in ${IMAGE_LIST[@]}; do image_dir="infra/base-images/${image_name}" if [ "${VERSION_TAG}" == "latest" ]; then diff --git a/infra/base-images/base-runner/bad_build_check b/infra/base-images/base-runner/bad_build_check index 87f0f58f2390..91b569aa94ad 100755 --- a/infra/base-images/base-runner/bad_build_check +++ b/infra/base-images/base-runner/bad_build_check @@ -354,10 +354,19 @@ function check_mixed_sanitizers { echo "UNSUPPORTED ARCHITECTURE" exit 1 fi - local ASAN_CALLS=$(objdump -dC $FUZZER | egrep "${CALL_INSN}__asan" -c) - local DFSAN_CALLS=$(objdump -dC $FUZZER | egrep "${CALL_INSN}__dfsan" -c) - local MSAN_CALLS=$(objdump -dC $FUZZER | egrep "${CALL_INSN}__msan" -c) - local UBSAN_CALLS=$(objdump -dC $FUZZER | egrep "${CALL_INSN}__ubsan" -c) + # Disassemble once and count all four sanitizers in the same pass. Running + # `objdump -dC` four times over the same binary is wasteful: fuzz targets are + # frequently hundreds of MB, and the disassembly dominates the cost of this + # check. + local ASAN_CALLS DFSAN_CALLS MSAN_CALLS UBSAN_CALLS + read ASAN_CALLS DFSAN_CALLS MSAN_CALLS UBSAN_CALLS < <( + objdump -dC $FUZZER | \ + grep -Eo "${CALL_INSN}__(asan|dfsan|msan|ubsan)" | \ + awk '/__asan$/ { a++ } + /__dfsan$/ { d++ } + /__msan$/ { m++ } + /__ubsan$/ { u++ } + END { print a+0, d+0, m+0, u+0 }') if [[ "$SANITIZER" = address ]]; then diff --git a/infra/indexer/frontend/ast_visitor.cc b/infra/indexer/frontend/ast_visitor.cc index e413944d88a1..5293159be67b 100644 --- a/infra/indexer/frontend/ast_visitor.cc +++ b/infra/indexer/frontend/ast_visitor.cc @@ -36,7 +36,17 @@ #include "clang/AST/PrettyPrinter.h" #include "clang/AST/TemplateBase.h" #include "clang/AST/Type.h" +// Upstream renamed clang/Basic/TypeTraits.h to clang/Basic/BuiltinTraits.h +// during LLVM 24 development. The indexer is integrated against a newer LLVM +// than the revision base-clang pins (see OUR_LLVM_REVISION in +// infra/base-images/base-clang/checkout_build_install_llvm.sh), so accept +// either spelling instead of requiring the two to move in lockstep. +// Ref: https://github.com/google/oss-fuzz/commit/0f4d4d3004beb4946db46905163b1638777395a9#commitcomment-198554014 +#if __has_include("clang/Basic/BuiltinTraits.h") #include "clang/Basic/BuiltinTraits.h" +#else +#include "clang/Basic/TypeTraits.h" +#endif #include "clang/Basic/FileEntry.h" #include "clang/Basic/OperatorKinds.h" #include "clang/Basic/SourceLocation.h" From af17f6f9d93f9f747c1664bf195a30b4df064952 Mon Sep 17 00:00:00 2001 From: Arthur Chan Date: Tue, 1 Sep 2026 18:51:14 +0100 Subject: [PATCH 2/2] fwupd: Fix build to include rust modules (#16088) This PR fixes the base docker image for project fwupd. Since 27th August, the upstream fwupd repository includes the rust cargo build process as part of the fuzzer build. But the base building image has no cargo installed and cause building error from 27th August. this PR fixes the problem but switching the base building to the rust alternative to accommodate the new rust cargo build process enabled from the upstream repository. Signed-off-by: Arthur Chan --- projects/fwupd/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/fwupd/Dockerfile b/projects/fwupd/Dockerfile index 45daa800fed5..6e1deaf55601 100644 --- a/projects/fwupd/Dockerfile +++ b/projects/fwupd/Dockerfile @@ -14,7 +14,7 @@ # ################################################################################ -FROM gcr.io/oss-fuzz-base/base-builder +FROM gcr.io/oss-fuzz-base/base-builder-rust RUN apt-get update && apt-get install -y pkg-config zlib1g-dev libffi-dev liblzma-dev libcbor-dev RUN python3 -m pip install -U jinja2 packaging meson ninja RUN git clone --depth 1 https://github.com/fwupd/fwupd.git fwupd