From 738cfebb60fc6814d22368842e1300a7ddaf85b6 Mon Sep 17 00:00:00 2001 From: Martin Vogel Date: Mon, 12 Oct 2026 06:31:53 +0200 Subject: [PATCH] fix(fuzz): link UBSan's C++ runtime into the fuzz binary The cbm-fuzz rule links through $(CC), the C driver. On Linux, clang's C driver links UBSan's C runtime but leaves out its C++ part (ubsan_standalone_cxx), while the C++ objects (preprocessor.cpp and the vendored simplecpp) carry -fsanitize=vptr checks. The link failed with undefined references to __ubsan_vptr_type_cache and __ubsan_handle_dynamic_type_cache_miss, so the fuzz job has never built in CI since it was added (dry runs 37212102899 and 38186491924). -fsanitize-link-c++-runtime on the link line pulls that runtime in. Checked in an ubuntu:24.04 arm64 container with CI's packages (clang 18, llvm, libclang-rt-dev): - a minimal reproduction (a C++ virtual call under -fsanitize=undefined, linked through clang) fails with exactly those two symbols without the flag, and links and runs with it; - `make fuzz` links cbm-fuzz (lsp_all.o was compiled with -g0 added: the 12.5 GB container ran out of memory on it with full debug info, which CI's runner does not); - macOS Homebrew clang accepts the flag under -Werror. Signed-off-by: Martin Vogel --- Makefile.cbm | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/Makefile.cbm b/Makefile.cbm index 3f804b72f..0e505cf20 100644 --- a/Makefile.cbm +++ b/Makefile.cbm @@ -1601,8 +1601,12 @@ fuzz: $(MAKE) -f Makefile.cbm build/fuzz/cbm-fuzz BUILD_DIR=build/fuzz \ CC=$(FUZZ_CC) CXX=$(FUZZ_CXX) SANITIZE="$(FUZZ_SANITIZE)" +# -fsanitize-link-c++-runtime: the link runs through the C driver, which on +# Linux leaves out UBSan's C++ runtime, but the C++ objects (preprocessor, +# simplecpp) carry -fsanitize=vptr checks that need it +# (__ubsan_vptr_type_cache, __ubsan_handle_dynamic_type_cache_miss). $(BUILD_DIR)/cbm-fuzz: $(FUZZ_SRC) $(PROD_SRCS) $(EXTRACTION_SRCS) $(AC_LZ4_SRCS) $(ZSTD_SRCS) $(SQLITE_WRITER_SRC) $(OBJS_VENDORED_TEST) $(PROJECT_HDRS) | $(BUILD_DIR) - $(CC) $(CFLAGS_TEST) -fsanitize=fuzzer -o $@ \ + $(CC) $(CFLAGS_TEST) -fsanitize=fuzzer -fsanitize-link-c++-runtime -o $@ \ $(FUZZ_SRC) $(PROD_SRCS) \ $(EXTRACTION_SRCS) $(AC_LZ4_SRCS) $(ZSTD_SRCS) $(SQLITE_WRITER_SRC) \ $(OBJS_VENDORED_TEST) \