Re: [PATCH] scripts/oss-fuzz: build PCRE2 from source with sanitizer instrumentation

On Wed, Aug 5, 2026 at 9:29 AM Stephen Smalley
<[email protected]> wrote:
>
> On Wed, Aug 5, 2026 at 6:18 AM Petr Matyas <[email protected]> wrote:
> >
> > The selabel_file fuzzers link against the system libpcre2, which is not
> > instrumented when building with -fsanitize=memory.  MSan requires all
> > libraries to be instrumented; uninstrumented libraries can produce false
> > positives because their writes do not update the sanitizer's shadow memory.
> >
> > In practice this causes a spurious use-of-uninitialized-value report:
> > pcre2_compile() writes literal character bytes via direct assignment (not
> > through memset/memcpy), so MSan's shadow memory does not reflect those
> > writes.  pcre2_jit_compile() then calls memcmp() in detect_repeat() over
> > compiled bytecode containing those character bytes, and MSan flags the
> > comparison as reading uninitialized memory.
> >
> > The PCRE2 maintainers confirmed this is a false positive per MSan
> > documentation and declined to change the library [1].
> >
> > Fix by building PCRE2 from source with the same -fsanitize= flags as the
> > rest of the fuzzer build.  With instrumentation, all pcre2_compile()
> > writes are tracked, detect_repeat()'s memcmp() sees properly initialized
> > bytes, and the false positive disappears.  Both selabel_file fuzzers are
> > now linked against the resulting static libpcre2-8.a from DESTDIR instead
> > of the system shared library.
> >
> > [1] https://github.com/KwisatzHaderach/pcre2/pull/1
> >
> > Signed-off-by: Petr Matyas <[email protected]>
>
> Acked-by: Stephen Smalley <[email protected]>

Merged.