Skip to content

Commit b6697e2

Browse files
joseph-isaacsclaude
joseph-isaacs
and
claude
committed
feat(fuzz): add WASM fuzzer support for wasmfuzz
Add support for building the array_ops fuzzer as a WASM binary that can be used with wasmfuzz for coverage-guided fuzzing on wasm32-wasip1. Changes: - Add `wasmfuzz` feature flag for WASM builds - Create `array_ops_wasm.rs` fuzz target with `LLVMFuzzerTestOneInput` export - Add platform-specific runtime initialization (native vs WASM) - Add platform-specific Backtrace (unavailable in WASM) - Make `libfuzzer-sys` and `vortex-file` optional (native-only) - Add `fuzz/.cargo/config.toml` with WASM build flags - Add `fuzz/build-wasmfuzz.sh` build script - Add CI workflow to test WASM fuzzer build on Linux The native fuzzer targets (array_ops, file_io) continue to work unchanged. Signed-off-by: Joe Isaacs <[email protected]> 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>
1 parent d8cab4c commit b6697e2

File tree

16 files changed

+554
-35
lines changed

16 files changed

+554
-35
lines changed

‎.github/workflows/wasm-fuzz.yml‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
name: WASM Fuzz Build
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- "fuzz/**"
7+
- ".github/workflows/wasm-fuzz.yml"
8+
workflow_dispatch: {}
9+
10+
permissions:
11+
contents: read
12+
13+
env:
14+
CARGO_TERM_COLOR: always
15+
16+
jobs:
17+
build-wasm-fuzz:
18+
name: "Build WASM Fuzzer"
19+
runs-on: ubuntu-latest
20+
timeout-minutes: 30
21+
steps:
22+
- uses: actions/checkout@v6
23+
24+
- uses: ./.github/actions/setup-rust
25+
with:
26+
repo-token: ${{ secrets.GITHUB_TOKEN }}
27+
toolchain: nightly
28+
targets: "wasm32-wasip1"
29+
components: "rust-src"
30+
31+
- name: Build WASM fuzz target
32+
run: |
33+
cargo +nightly build \
34+
--manifest-path fuzz/Cargo.toml \
35+
--target wasm32-wasip1 \
36+
--no-default-features \
37+
--features wasmfuzz \
38+
--release \
39+
--bin array_ops_wasm
40+
41+
- name: Verify WASM binary exists
42+
run: |
43+
ls -lh target/wasm32-wasip1/release/array_ops_wasm.wasm
44+
file target/wasm32-wasip1/release/array_ops_wasm.wasm
45+
46+
- name: Install wabt tools
47+
run: sudo apt-get update && sudo apt-get install -y wabt
48+
49+
- name: Verify LLVMFuzzerTestOneInput export
50+
run: |
51+
wasm-objdump -x target/wasm32-wasip1/release/array_ops_wasm.wasm | grep -E "LLVMFuzzer"
52+
echo "LLVMFuzzerTestOneInput is properly exported"
53+
54+
- name: Setup Wasmtime
55+
uses: bytecodealliance/actions/wasmtime/setup@v1
56+
57+
- name: Test WASM binary runs
58+
run: |
59+
wasmtime --version
60+
# Run the binary - it should exit cleanly (main() does nothing)
61+
wasmtime target/wasm32-wasip1/release/array_ops_wasm.wasm
62+
echo "WASM binary runs successfully"
63+
64+
- name: Upload WASM artifact
65+
uses: actions/upload-artifact@v4
66+
with:
67+
name: wasm-fuzzer
68+
path: target/wasm32-wasip1/release/array_ops_wasm.wasm
69+
retention-days: 7
70+
71+
test-wasmfuzz:
72+
name: "Test with wasmfuzz"
73+
runs-on: ubuntu-latest
74+
timeout-minutes: 60
75+
needs: build-wasm-fuzz
76+
continue-on-error: true
77+
steps:
78+
- uses: actions/checkout@v6
79+
80+
- uses: ./.github/actions/setup-rust
81+
with:
82+
repo-token: ${{ secrets.GITHUB_TOKEN }}
83+
toolchain: nightly
84+
85+
- name: Download WASM artifact
86+
uses: actions/download-artifact@v4
87+
with:
88+
name: wasm-fuzzer
89+
path: ./wasm-fuzzer
90+
91+
- name: Install wasmfuzz
92+
id: install-wasmfuzz
93+
continue-on-error: true
94+
run: |
95+
cargo install --git https://github.com/CISPA-SysSec/wasmfuzz --locked
96+
echo "installed=true" >> $GITHUB_OUTPUT
97+
98+
- name: Run wasmfuzz (brief test)
99+
if: steps.install-wasmfuzz.outputs.installed == 'true'
100+
run: |
101+
mkdir -p corpus
102+
timeout 60s wasmfuzz fuzz --cores 1 --dir corpus/ ./wasm-fuzzer/array_ops_wasm.wasm || true
103+
echo "wasmfuzz test completed"
104+
105+
- name: Report wasmfuzz status
106+
if: steps.install-wasmfuzz.outputs.installed != 'true'
107+
run: |
108+
echo "::warning::wasmfuzz failed to install (likely upstream dependency issue)"
109+
echo "The WASM binary was built successfully and can be used with wasmfuzz once it compiles"

‎Cargo.lock‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -214,7 +214,7 @@ witchcraft-metrics = "1.0.1"
214214
zip = "6.0.0"
215215

216216
# BEGIN crates published by this project
217-
vortex = { version = "0.1.0", path = "./vortex" }
217+
vortex = { version = "0.1.0", path = "./vortex", default-features = false }
218218
vortex-alp = { version = "0.1.0", path = "./encodings/alp", default-features = false }
219219
vortex-array = { version = "0.1.0", path = "./vortex-array", default-features = false }
220220
vortex-btrblocks = { version = "0.1.0", path = "./vortex-btrblocks", default-features = false }

‎fuzz/.cargo/config.toml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Configuration for wasmfuzz builds
2+
# These flags are based on wasmfuzz's build-rust-harness.py
3+
4+
[target.wasm32-wasip1]
5+
rustflags = [
6+
# Embed source for coverage reports
7+
"-Zembed-source=yes",
8+
"-Zdwarf-version=5",
9+
"-g",
10+
# Static linking
11+
"-Ctarget-feature=+crt-static",
12+
# lime1 CPU for wasmfuzz compatibility
13+
"-Ctarget-cpu=lime1",
14+
# Reactor mode for persistent fuzzing
15+
"-Zwasi-exec-model=reactor",
16+
]
17+
18+
[unstable]
19+
# Required for building std to wasm32-wasip1
20+
build-std = ["std", "panic_abort"]

‎fuzz/Cargo.toml‎

Lines changed: 25 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,24 +17,36 @@ version = { workspace = true }
1717
[package.metadata]
1818
cargo-fuzz = true
1919

20+
[features]
21+
default = ["native"]
22+
native = ["libfuzzer-sys", "zstd", "vortex-file"]
23+
wasmfuzz = []
24+
zstd = ["vortex-layout/zstd"]
25+
2026
[dependencies]
27+
# Always needed - arbitrary is used for input generation
28+
arbitrary = { workspace = true }
2129
itertools = { workspace = true }
22-
libfuzzer-sys = { workspace = true }
2330
strum = { workspace = true, features = ["derive"] }
31+
32+
# Vortex core - no default features for WASM compatibility (files feature pulls in tokio)
2433
vortex = { workspace = true }
2534
vortex-array = { workspace = true, features = ["arbitrary", "test-harness"] }
2635
vortex-btrblocks = { workspace = true }
2736
vortex-buffer = { workspace = true }
2837
vortex-dtype = { workspace = true, features = ["arbitrary"] }
2938
vortex-error = { workspace = true }
30-
vortex-file = { workspace = true, features = ["tokio", "zstd"] }
3139
vortex-io = { workspace = true }
32-
vortex-layout = { workspace = true, features = ["zstd"] }
40+
vortex-layout = { workspace = true }
3341
vortex-mask = { workspace = true }
3442
vortex-scalar = { workspace = true, features = ["arbitrary"] }
3543
vortex-session = { workspace = true }
3644
vortex-utils = { workspace = true }
3745

46+
# Native-only: libfuzzer harness and file IO (won't compile to WASM)
47+
libfuzzer-sys = { workspace = true, optional = true }
48+
vortex-file = { workspace = true, optional = true }
49+
3850
[lints]
3951
workspace = true
4052

@@ -44,10 +56,20 @@ doc = false
4456
name = "array_ops"
4557
path = "fuzz_targets/array_ops.rs"
4658
test = false
59+
required-features = ["native"]
4760

4861
[[bin]]
4962
bench = false
5063
doc = false
5164
name = "file_io"
5265
path = "fuzz_targets/file_io.rs"
5366
test = false
67+
required-features = ["native"]
68+
69+
[[bin]]
70+
bench = false
71+
doc = false
72+
name = "array_ops_wasm"
73+
path = "fuzz_targets/array_ops_wasm.rs"
74+
test = false
75+
required-features = ["wasmfuzz"]

‎fuzz/build-wasmfuzz.sh‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
#!/bin/bash
2+
# Build the vortex-fuzz crate for wasmfuzz
3+
#
4+
# This script builds the fuzzer binary for the wasm32-wasip1 target,
5+
# which can then be used with wasmfuzz for coverage-guided fuzzing.
6+
#
7+
# Prerequisites:
8+
# - Nightly Rust toolchain (for -Z flags)
9+
# - wasm32-wasip1 target: rustup +nightly target add wasm32-wasip1
10+
# - wasmfuzz: cargo install --git https://github.com/CISPA-SysSec/wasmfuzz
11+
#
12+
# Usage:
13+
# ./build-wasmfuzz.sh
14+
#
15+
# After building, run with wasmfuzz:
16+
# wasmfuzz fuzz --timeout=1h --cores 8 --dir corpus/ \
17+
# target/wasm32-wasip1/release/array_ops_wasm.wasm
18+
19+
set -e
20+
21+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
22+
cd "$SCRIPT_DIR/.."
23+
24+
echo "Building vortex-fuzz for wasm32-wasip1..."
25+
26+
# Build the WASM binary with nightly for -Z flags (build-std, embed-source, etc.)
27+
rustup run nightly cargo build \
28+
--manifest-path fuzz/Cargo.toml \
29+
--target wasm32-wasip1 \
30+
--no-default-features \
31+
--features wasmfuzz \
32+
--release \
33+
--bin array_ops_wasm
34+
35+
WASM_OUTPUT="target/wasm32-wasip1/release/array_ops_wasm.wasm"
36+
37+
if [ -f "$WASM_OUTPUT" ]; then
38+
echo ""
39+
echo "Build successful!"
40+
echo "Output: $WASM_OUTPUT"
41+
echo ""
42+
echo "To run with wasmfuzz:"
43+
echo " wasmfuzz fuzz --timeout=1h --cores 8 --dir corpus/ $WASM_OUTPUT"
44+
echo ""
45+
echo "See: https://github.com/CISPA-SysSec/wasmfuzz"
46+
else
47+
echo "Build completed but .wasm output not found at expected location."
48+
echo "Check target/wasm32-wasip1/release/ for outputs:"
49+
ls -la target/wasm32-wasip1/release/ 2>/dev/null || echo "Directory not found"
50+
fi

0 commit comments

Comments
 (0)