Re: [PATCH] scripts/oss-fuzz: build PCRE2 from source with sanitizer instrumentation

On Wed, Aug 5, 2026 at 12:17 PM Stephen Smalley
<[email protected]> wrote:
>
> On Wed, Aug 5, 2026 at 9:29 AM Stephen Smalley
> <[email protected]> wrote:
> >
> > On Wed, Aug 5, 2026 at 6:18 AM Petr Matyas <[email protected]> wrote:
> > >
> > > The selabel_file fuzzers link against the system libpcre2, which is not
> > > instrumented when building with -fsanitize=memory.  MSan requires all
> > > libraries to be instrumented; uninstrumented libraries can produce false
> > > positives because their writes do not update the sanitizer's shadow memory.
> > >
> > > In practice this causes a spurious use-of-uninitialized-value report:
> > > pcre2_compile() writes literal character bytes via direct assignment (not
> > > through memset/memcpy), so MSan's shadow memory does not reflect those
> > > writes.  pcre2_jit_compile() then calls memcmp() in detect_repeat() over
> > > compiled bytecode containing those character bytes, and MSan flags the
> > > comparison as reading uninitialized memory.
> > >
> > > The PCRE2 maintainers confirmed this is a false positive per MSan
> > > documentation and declined to change the library [1].
> > >
> > > Fix by building PCRE2 from source with the same -fsanitize= flags as the
> > > rest of the fuzzer build.  With instrumentation, all pcre2_compile()
> > > writes are tracked, detect_repeat()'s memcmp() sees properly initialized
> > > bytes, and the false positive disappears.  Both selabel_file fuzzers are
> > > now linked against the resulting static libpcre2-8.a from DESTDIR instead
> > > of the system shared library.
> > >
> > > [1] https://github.com/KwisatzHaderach/pcre2/pull/1
> > >
> > > Signed-off-by: Petr Matyas <[email protected]>
> >
> > Acked-by: Stephen Smalley <[email protected]>
>
> Merged.

This resolved the issue with oss-fuzz. Thank you for investigating and
fixing it!