Fuzzing Arrow C++#

To make the handling of invalid input more robust, we have enabled fuzz testing on several parts of the Arrow C++ feature set, currently:

• the IPC stream reader

• the IPC file reader

• the Parquet file reader

• the Parquet encoders and decoders

• the CSV file reader

We welcome any contribution to expand the scope of fuzz testing and cover areas ingesting potentially invalid or malicious data.

Fuzz Targets and Utilities#

By passing the -DARROW_FUZZING=ON CMake option (or equivalently, using the fuzzing preset), you will build the fuzz targets corresponding to the aforementioned Arrow features, as well as additional related utilities.

Generating the seed corpus#

Fuzzing essentially explores the domain space by randomly mutating previously tested inputs, without having any high-level understanding of the area being fuzz-tested. However, the domain space is so huge that this strategy alone may fail to actually produce any interesting inputs.

To guide the process, it is therefore important to provide a seed corpus of valid (or invalid, but remarkable) inputs from which the fuzzing infrastructure can derive new inputs for testing. A script is provided to automate that task. Assuming the fuzzing executables can be found in build/debug, the seed corpus can be generated thusly:

$ ./build-support/fuzzing/generate_corpuses.sh build/debug

Continuous fuzzing infrastructure#

The process of fuzz testing is computationally intensive and therefore benefits from dedicated computing facilities. Arrow C++ is exercised by the OSS-Fuzz continuous fuzzing infrastructure operated by Google.

Issues found by OSS-Fuzz are notified and available to a limited set of core developers. If you are a Arrow core developer and want to be added to that list, you can ask on the mailing-list.

Reproducing locally#

When a crash is found by fuzzing, it is often useful to download the data used to produce the crash, and use it to reproduce the crash so as to debug and investigate.

Assuming you are in a subdirectory inside cpp, the following command would allow you to build the fuzz targets with debug information and the various sanitizer checks enabled.

$ cmake .. --preset=fuzzing

Then, assuming you have downloaded the crashing data file (lets call it testcase-arrow-ipc-file-fuzz-123465), you can reproduce the crash by running the affected fuzz target on that file:

$ build/debug/arrow-ipc-file-fuzz testcase-arrow-ipc-file-fuzz-123465

(you may want to run that command under a debugger so as to inspect the program state more closely)

Using conda#

The fuzzing executables must be compiled with clang and linked to libraries which provide a fuzzing runtime. If you are using conda to provide your dependencies, you may need to install these before building the fuzz targets:

$ conda install clang clangxx compiler-rt
$ cmake .. --preset=fuzzing

Regression files#

When a fuzzer-detected bug is found and fixed, the corresponding reproducer must be stored in the arrow-testing repository to ensure that the code doesnt regress.

The locations for these files are as follows:

• IPC streams: in the data/arrow-ipc-stream directory

• IPC files: in the data/arrow-ipc-file directory

• Parquet files: in the data/parquet/fuzzing directory

• CSV files: in the data/csv/fuzzing directory

Most of those files are invalid files for their respective formats and stress proper error detection and reporting in the implementation code.