docs: Add Technical Spikes: 006.oss-fuzz-arvo-dataset.md

[xjtuwxg]

Technical Spikes: 006.oss-fuzz-arvo-dataset.md

Description

ARVO Dataset (Reproducible OSS-Fuzz) Technical Spike

Code Quality Checklist

• My code follows the project's coding standards.
• I have performed a self-review of my own code.
• I have commented my code, especially in hard-to-understand areas.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing tests pass locally with my changes.
• I have checked for any linting or style issues.

Related Issues

Github Issue #42, Github Issue #128.

Screenshots

$ docker run --rm -it n132/arvo:42528804-vul bash
root@4e9ea0b27c87:/src/libxml2# ls /usr/bin/arvo 
/usr/bin/arvo
root@4e9ea0b27c87:/src/libxml2# vi parser.c +8849
# add l.name = NULL;

Next, we can re-compile libxml2 inside the container and re-execute the test case (/tmp/poc):

root@4e9ea0b27c87:/src/libxml2# arvo compile
root@4e9ea0b27c87:/src/libxml2# arvo run
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 2040443665
INFO: Loaded 1 modules   (39373 inline 8-bit counters): 39373 [0xb22417, 0xb2bde4), 
INFO: Loaded 1 PC tables (39373 PCs): 39373 [0xa263c8,0xac0098), 
/out/xslt: Running 1 inputs 1 time(s) each.
Running: /tmp/poc
Executed /tmp/poc in 1 ms
***
*** NOTE: fuzzing was not performed, you have only
***       executed the target code on a fixed set of inputs.
***

This indicates the bug is gone under the same test case.

Testing

Additional Notes

Xiaoguang also wrote a few scripts to help better understand the ARVO bugs and their corresponding fixes. Follow the README to analyze how many bugs in libxml2 are fixed with 1 line of code changes, < 5 lines of code changes, < 10 lines of code changes, and so on.

[Rhernandez513]

This is interesting. I would be interested to see a demo of the linked scripts to explore how this dataset iteration can be used