[Bug 3984] New: SNTRUP761 fuzz harnesses no longer build

[bugzilla-daemon at mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=3984

            Bug ID: 3984
           Summary: SNTRUP761 fuzz harnesses no longer build
           Product: Portable OpenSSH
           Version: -current
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: P5
         Component: Regression tests
          Assignee: unassigned-bugs at mindrot.org
          Reporter: artemis at perpetualsai.com

Created attachment 3973
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3973&action=edit
Patch restoring SNTRUP761 fuzz harness builds

The two standalone SNTRUP761 libFuzzer harnesses in
regress/misc/fuzz-harness no longer compile on current master.

Both harnesses include sntrup761.c directly but are compiled as C++.
Current sntrup761.c contains valid C constructs, including implicit
conversions from void *, that Clang rejects in C++. The harnesses also
include hash.c, which was removed by commit
94a78254a1c953c2a55eb54f65a5d99873b54bdf when crypto_hash_sha512()
moved into crypto_api.h.

As a result, the encapsulation and decapsulation fuzz targets are not
being built. The current OSS-Fuzz integration explicitly filters both
targets out.

Reproduction

After configuring and building OpenSSH, compiling either harness fails.
The first error on current master is:

sntrup761_dec_fuzz.cc:14:10: fatal error: 'hash.c' file not found

After removing that stale include, Clang++ also rejects the C
implementation:

sntrup761.c:1622:10: error: cannot initialize a variable of type
'int32_t *' with an lvalue of type 'void *'

The encapsulation target has the same problems.

Proposed fix

The patch attached to this report:
1. Compiles the two standalone harnesses as C, matching the
implementation they include.
2. Removes the obsolete hash.c includes.
3. Uses deterministic xorshift test randomness so failures and
generated seed corpora reproduce byte-for-byte.
4. Changes the RNG shim to accept void *, matching current
implementation buffers.
5. Allows integrations to override the default corpus count while
preserving the existing default of 1,000 seeds.

Patch commit: f13ae0d (fuzz: repair SNTRUP761 harnesses)

Verification

- All three repaired C translation units compile with Clang using -Wall
-Wextra -Werror.
- A full OSS-Fuzz UBSan build completes with both targets enabled.
- The patch applies and builds cleanly in a fresh OSS-Fuzz image using
newly cloned current OpenSSH master.
- OSS-Fuzz check_build passes for sntrup761_dec_fuzz and
sntrup761_enc_fuzz.
- With compact 64-input deterministic seed corpora, 2,000-run UBSan
checks completed without findings.
- Longer 10,000-run seeded checks also completed without sanitizer
findings.
- Independent corpus-generation runs produced byte-identical public-key
and ciphertext corpora.

This is a fuzzing coverage/build regression, not a production security
vulnerability.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.