google · oliverchang · Apr 29, 2024 · Aug 1, 2022 · Aug 1, 2022 · Aug 2, 2022
diff --git a/infra/base-images/base-builder/compile b/infra/base-images/base-builder/compile
@@ -21,11 +21,6 @@ sysctl -w vm.mmap_rnd_bits=28
 
 OSS_FUZZ_ON_DEMAND="${OSS_FUZZ_ON_DEMAND:-0}"
 
-# This is a temporary fix: fall back to LLVM14's old pass manager
-if [ -n "${OLD_LLVMPASS-}" ]; then
-  export SANITIZER_FLAGS_introspector=$(echo $SANITIZER_FLAGS_introspector | sed -r 's/-O0/-flegacy-pass-manager/')
-fi
-
 if [ "$FUZZING_LANGUAGE" = "jvm" ]; then
   if [ "$FUZZING_ENGINE" != "libfuzzer" ] && [ "$FUZZING_ENGINE" != "wycheproof" ]; then
     echo "ERROR: JVM projects can be fuzzed with libFuzzer or tested with wycheproof engines only."
@@ -79,6 +74,7 @@ fi
 if [[ $ARCHITECTURE == "i386" ]]; then
     export CFLAGS="-m32 $CFLAGS"
     cp -R /usr/i386/lib/* /usr/local/lib
+    cp -R /usr/i386/include/* /usr/local/include
 fi
 
 # Don't use a fuzzing engine with Jazzer which has libFuzzer built-in or with
@@ -133,6 +129,15 @@ export CUSTOM_LIBFUZZER_STD_CXX=c++
 export CFLAGS="$CFLAGS $SANITIZER_FLAGS $COVERAGE_FLAGS"
 export CXXFLAGS="$CFLAGS $CXXFLAGS_EXTRA"
 
+if [ "$SANITIZER" = "undefined" ]; then
+  # Disable "function" sanitizer for C code for now, because many projects,
+  # possibly via legacy C code are affected.
+  # The projects should be fixed and this workaround be removed in the future.
+  # TODO(#11778):
+  # https://github.com/google/oss-fuzz/issues/11778
+  export CFLAGS="$CFLAGS -fno-sanitize=function"
+fi
+
 if [ "$FUZZING_LANGUAGE" = "go" ]; then
   # required by Go 1.20
   export CXX="${CXX} -lresolv"

diff --git a/infra/base-images/base-builder/compile_libfuzzer b/infra/base-images/base-builder/compile_libfuzzer
@@ -21,6 +21,5 @@ if [ "$FUZZING_LANGUAGE" = "go" ]; then
     export LIB_FUZZING_ENGINE="$LIB_FUZZING_ENGINE $GOPATH/gosigfuzz/gosigfuzz.o"
 fi
 
-cp /usr/local/lib/clang/*/lib/linux/libclang_rt.fuzzer-$ARCHITECTURE.a \
-  $LIB_FUZZING_ENGINE_DEPRECATED
+cp /usr/local/lib/clang/*/lib/$ARCHITECTURE-unknown-linux-gnu/libclang_rt.fuzzer.a $LIB_FUZZING_ENGINE_DEPRECATED
 echo " done."
diff --git a/infra/base-images/base-builder/install_python.sh b/infra/base-images/base-builder/install_python.sh
@@ -19,5 +19,5 @@ echo "ATHERIS INSTALL"
 unset CFLAGS CXXFLAGS
 # PYI_STATIC_ZLIB=1 is needed for installing pyinstaller 5.0
 export PYI_STATIC_ZLIB=1
-pip3 install -v --no-cache-dir "atheris>=2.1.1" "pyinstaller==5.0.1" "coverage==6.3.2"
+LIBFUZZER_LIB=$( echo /usr/local/lib/clang/*/lib/x86_64-unknown-linux-gnu/libclang_rt.fuzzer_no_main.a ) pip3 install -v --no-cache-dir "atheris>=2.1.1" "pyinstaller==5.0.1" "coverage==6.3.2"
 rm -rf /tmp/*
diff --git a/infra/base-images/base-builder/install_rust.sh b/infra/base-images/base-builder/install_rust.sh
@@ -19,3 +19,4 @@ curl https://sh.rustup.rs | sh -s -- -y --default-toolchain=nightly-2023-12-28 -
 cargo install cargo-fuzz && rm -rf /rust/registry
 # Needed to recompile rust std library for MSAN
 rustup component add rust-src --toolchain nightly-2023-12-28
+cp -r /usr/local/lib/x86_64-unknown-linux-gnu/* /usr/local/lib/
diff --git a/infra/base-images/base-clang/Dockerfile b/infra/base-images/base-clang/Dockerfile
@@ -22,7 +22,6 @@ ARG arch=x86_64
 
 ENV FUZZINTRO_OUTDIR=$SRC
 
-
 # Install newer cmake.
 ENV CMAKE_VERSION 3.24.2
 RUN apt-get update && apt-get install -y wget sudo && \
@@ -56,6 +55,12 @@ ENV CCC "clang++"
 # FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION is described at
 # https://llvm.org/docs/LibFuzzer.html#fuzzer-friendly-build-mode
 
-ENV CFLAGS "-O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION"
+# The implicit-function-declaration and implicit-int errors are downgraded to a
+# warning, to allow compiling legacy code.
+# See https://releases.llvm.org/16.0.0/tools/clang/docs/ReleaseNotes.html#potentially-breaking-changes
+# Same for deprecated-declarations, int-conversion,
+# incompatible-function-pointer-types, enum-constexpr-conversion
+
+ENV CFLAGS "-O1 -fno-omit-frame-pointer -gline-tables-only -Wno-error=enum-constexpr-conversion -Wno-error=incompatible-function-pointer-types -Wno-error=int-conversion -Wno-error=deprecated-declarations -Wno-error=implicit-function-declaration -Wno-error=implicit-int -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION"
 ENV CXXFLAGS_EXTRA "-stdlib=libc++"
 ENV CXXFLAGS "$CFLAGS $CXXFLAGS_EXTRA"
diff --git a/infra/base-images/base-clang/checkout_build_install_llvm.sh b/infra/base-images/base-clang/checkout_build_install_llvm.sh
@@ -50,14 +50,14 @@ LLVM_DEP_PACKAGES="build-essential make ninja-build git python3 python3-distutil
 apt-get update && apt-get install -y $LLVM_DEP_PACKAGES --no-install-recommends
 
 # For manual bumping.
-OUR_LLVM_REVISION=llvmorg-15-init-1464-gbf7f8d6f
+OUR_LLVM_REVISION=llvmorg-18-init-4631-gd50b56d1
 
 mkdir $SRC/chromium_tools
 cd $SRC/chromium_tools
 git clone https://chromium.googlesource.com/chromium/src/tools/clang
 cd clang
-# Pin clang due to https://github.com/google/oss-fuzz/issues/7617
-git checkout 946a41a51f44207941b3729a0733dfc1e236644e
+# Pin clang script due to https://github.com/google/oss-fuzz/issues/7617
+git checkout 9eb79319239629c1b23cf7a59e5ebb2bab319a34
 
 # To allow for manual downgrades. Set to 0 to use Chrome's clang version (i.e.
 # *not* force a manual downgrade). Set to 1 to force a manual downgrade.
@@ -91,14 +91,15 @@ function clone_with_retries {
 }
 clone_with_retries https://github.com/llvm/llvm-project.git $LLVM_SRC
 
-PROJECTS_TO_BUILD="libcxx;libcxxabi;compiler-rt;clang;lld"
+PROJECTS_TO_BUILD="clang;lld"
 function cmake_llvm {
   extra_args="$@"
   cmake -G "Ninja" \
       -DLIBCXX_ENABLE_SHARED=OFF \
       -DLIBCXX_ENABLE_STATIC_ABI_LIBRARY=ON \
       -DLIBCXXABI_ENABLE_SHARED=OFF \
       -DCMAKE_BUILD_TYPE=Release \
+      -DLLVM_ENABLE_RUNTIMES="compiler-rt;libcxx;libcxxabi" \
       -DLLVM_TARGETS_TO_BUILD="$TARGET_TO_BUILD" \
       -DLLVM_ENABLE_PROJECTS="$PROJECTS_TO_BUILD" \
       -DLLVM_BINUTILS_INCDIR="/usr/include/" \
@@ -145,7 +146,8 @@ rm -rf $WORK/llvm-stage1 $WORK/llvm-stage2
 cp -r $LLVM_SRC/compiler-rt/lib/fuzzer $SRC/libfuzzer
 
 # Use the clang we just built from now on.
-CMAKE_EXTRA_ARGS="-DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++"
+export CC=clang
+export CXX=clang++
 
 function free_disk_space {
     rm -rf $LLVM_SRC $SRC/chromium_tools
@@ -222,16 +224,16 @@ function cmake_libcxx {
       -DLIBCXXABI_ENABLE_SHARED=OFF \
       -DCMAKE_BUILD_TYPE=Release \
       -DLLVM_TARGETS_TO_BUILD="$TARGET_TO_BUILD" \
-      -DLLVM_ENABLE_PROJECTS="libcxx;libcxxabi" \
+      -DLLVM_ENABLE_RUNTIMES="libcxx;libcxxabi" \
       -DLLVM_BINUTILS_INCDIR="/usr/include/" \
       $extra_args \
-      $LLVM_SRC/llvm
+      -S $LLVM_SRC/runtimes
 }
 
 # 32-bit libraries.
 mkdir -p $WORK/i386
 cd $WORK/i386
-cmake_libcxx $CMAKE_EXTRA_ARGS \
+cmake_libcxx \
     -DCMAKE_INSTALL_PREFIX=/usr/i386/ \
     -DCMAKE_C_FLAGS="-m32" \
     -DCMAKE_CXX_FLAGS="-m32"
@@ -249,7 +251,7 @@ cat <<EOF > $WORK/msan/blocklist.txt
 fun:__gxx_personality_*
 EOF
 
-cmake_libcxx $CMAKE_EXTRA_ARGS \
+cmake_libcxx \
     -DLLVM_USE_SANITIZER=Memory \
     -DCMAKE_INSTALL_PREFIX=/usr/msan/ \
     -DCMAKE_CXX_FLAGS="-fsanitize-blacklist=$WORK/msan/blocklist.txt"

diff --git a/infra/base-images/base-runner/bad_build_check b/infra/base-images/base-runner/bad_build_check
@@ -44,8 +44,8 @@ MSAN_CALLS_THRESHOLD_FOR_NON_MSAN_BUILD=3
 # Usually, a non UBSan build (e.g. ASan) has 165 calls to UBSan runtime. The
 # majority of targets built with UBSan have 200+ UBSan calls, but there are
 # some very small targets that may have < 200 UBSan calls even in a UBSan build.
-# Use the threshold value of 169 (slightly > 165) for UBSan build.
-UBSAN_CALLS_THRESHOLD_FOR_UBSAN_BUILD=169
+# Use the threshold value of 168 (slightly > 165) for UBSan build.
+UBSAN_CALLS_THRESHOLD_FOR_UBSAN_BUILD=168
 
 # It would be risky to use the threshold value close to 165 for non UBSan build,
 # as UBSan runtime may change any time and thus we could have different number

diff --git a/projects/ampproject/Dockerfile b/projects/ampproject/Dockerfile
@@ -14,7 +14,8 @@
 #
 ################################################################################
 
-FROM gcr.io/oss-fuzz-base/base-builder
+FROM gcr.io/oss-fuzz-base/base-builder@sha256:19782f7fe8092843368894dbc471ce9b30dd6a2813946071a36e8b05f5b1e27e
+# ! This project was pinned after a clang bump. Please remove the pin, Try to fix any build warnings and errors, as well as runtime errors
 RUN apt-get update && apt-get install -y make autoconf automake libtool libomp-dev libgomp1 nodejs
 COPY build.sh *.diff $SRC/
 

diff --git a/projects/arrow/Dockerfile b/projects/arrow/Dockerfile
@@ -14,7 +14,8 @@
 #
 ################################################################################
 
-FROM gcr.io/oss-fuzz-base/base-builder
+FROM gcr.io/oss-fuzz-base/base-builder@sha256:19782f7fe8092843368894dbc471ce9b30dd6a2813946071a36e8b05f5b1e27e
+# ! This project was pinned after a clang bump. Please remove the pin, Try to fix any build warnings and errors, as well as runtime errors
 
 ENV DEBIAN_FRONTEND noninteractive
 RUN apt-get update -y -q && \

diff --git a/projects/bearssl/project.yaml b/projects/bearssl/project.yaml
@@ -7,7 +7,7 @@ auto_ccs:
 sanitizers:
  - address
  - undefined
- - memory
+ # - memory ## msan disabled after a clang bump. Please re-enable it, Try to fix any build warnings and build errors, as well as msan runtime warnings and errors. msan failure log: https://oss-fuzz-gcb-logs.storage.googleapis.com/log-86a9ca7b-98e8-4e7e-a138-16d4acacc17f.txt
 architectures:
  - x86_64
  - i386
diff --git a/projects/bignum-fuzzer/Dockerfile b/projects/bignum-fuzzer/Dockerfile
@@ -14,7 +14,8 @@
 #
 ################################################################################
 
-FROM gcr.io/oss-fuzz-base/base-builder
+FROM gcr.io/oss-fuzz-base/base-builder@sha256:19782f7fe8092843368894dbc471ce9b30dd6a2813946071a36e8b05f5b1e27e
+# ! Project pinned after a clang update and an afl link error. Log: https://oss-fuzz-gcb-logs.storage.googleapis.com/log-6083635a-3f72-444d-80ef-3a0a26670cf7.txt
 RUN apt-get update && apt-get install -y software-properties-common curl sudo mercurial autoconf bison texinfo libboost-all-dev cmake wget lzip
 RUN wget https://go.dev/dl/go1.17.5.linux-amd64.tar.gz && rm -rf /usr/local/go && tar -C /usr/local -xzf go1.17.5.linux-amd64.tar.gz && ldconfig
 ENV PATH=$PATH:/usr/local/go/bin

diff --git a/projects/bitcoin-core/Dockerfile b/projects/bitcoin-core/Dockerfile
@@ -14,7 +14,8 @@
 #
 ################################################################################
 
-FROM gcr.io/oss-fuzz-base/base-builder-rust
+FROM gcr.io/oss-fuzz-base/base-builder@sha256:19782f7fe8092843368894dbc471ce9b30dd6a2813946071a36e8b05f5b1e27e
+# ! This project was pinned after a clang bump. Please remove the pin, Try to fix any build warnings and errors, as well as runtime errors
 
 # Packages taken from:
 # * https://github.com/bitcoin/bitcoin/blob/master/doc/build-unix.md#dependency-build-instructions

diff --git a/projects/bls-signatures/project.yaml b/projects/bls-signatures/project.yaml
@@ -5,7 +5,7 @@ main_repo: "https://github.com/supranational/blst.git"
 sanitizers:
  - address
  - undefined
- - memory
+ # - memory ## msan disabled after a clang bump. Please re-enable it, Try to fix any build warnings and build errors, as well as msan runtime warnings and errors. msan failure log: https://oss-fuzz-gcb-logs.storage.googleapis.com/log-3cd81ff0-7552-4e87-973e-ff5da4520ad5.txt
 architectures:
  - x86_64
  - i386

diff --git a/projects/boost-json/Dockerfile b/projects/boost-json/Dockerfile
@@ -14,7 +14,8 @@
 #
 ################################################################################
 
-FROM gcr.io/oss-fuzz-base/base-builder
+FROM gcr.io/oss-fuzz-base/base-builder@sha256:19782f7fe8092843368894dbc471ce9b30dd6a2813946071a36e8b05f5b1e27e
+# ! This project was pinned after a clang bump. Please remove the pin, Try to fix any build warnings and errors, as well as runtime errors
 #RUN apt-get update && apt-get install -y g++
 
 RUN git clone --depth 1 --single-branch --branch master https://github.com/boostorg/boost.git

diff --git a/projects/boost/Dockerfile b/projects/boost/Dockerfile
@@ -14,7 +14,8 @@
 #
 ################################################################################
 
-FROM gcr.io/oss-fuzz-base/base-builder
+FROM gcr.io/oss-fuzz-base/base-builder@sha256:19782f7fe8092843368894dbc471ce9b30dd6a2813946071a36e8b05f5b1e27e
+# ! This project was pinned after a clang bump. Please remove the pin, Try to fix any build warnings and errors, as well as runtime errors
 RUN apt-get update && apt-get install -y g++ python
 
 RUN git clone --recursive https://github.com/boostorg/boost.git

diff --git a/projects/brunsli/project.yaml b/projects/brunsli/project.yaml
@@ -6,7 +6,7 @@ vendor_ccs:
   - "[email protected]"
 sanitizers:
   - address
-  - memory
+  # - memory ## msan disabled after a clang bump. Please re-enable it, Try to fix any build warnings and build errors, as well as msan runtime warnings and errors. msan failure log: https://oss-fuzz-gcb-logs.storage.googleapis.com/log-f5583c45-faa2-44d4-8b2f-b27e83c25588.txt
   - undefined
 architectures:
   - x86_64

diff --git a/projects/croaring/project.yaml b/projects/croaring/project.yaml
@@ -7,8 +7,8 @@ auto_ccs:
 sanitizers:
   - address
   - undefined
-  - memory:
-      experimental: True
+  # - memory ## msan disabled after a clang bump. Please re-enable it, Try to fix any build warnings and build errors, as well as msan runtime warnings and errors. msan failure log: https://oss-fuzz-gcb-logs.storage.googleapis.com/log-12b78d7a-4346-47d6-8109-5ede78fbad38.txt:
+  #    experimental: True
 main_repo: "https://github.com/RoaringBitmap/CRoaring"
 fuzzing_engines:
   - libfuzzer

diff --git a/projects/cryptofuzz/Dockerfile b/projects/cryptofuzz/Dockerfile
@@ -14,7 +14,8 @@
 #
 ################################################################################
 
-FROM gcr.io/oss-fuzz-base/base-builder-rust
+FROM gcr.io/oss-fuzz-base/base-builder-rust@sha256:c5216a9896a598dced7ce6708bb3226e443473f567045b4f282595776cc641f1
+# ! Project pinned after a clang update and an afl link error. Log: https://oss-fuzz-gcb-logs.storage.googleapis.com/log-8bc8a5ea-9bfb-421d-bfe9-911828e88741.txt
 
 RUN apt-get update && \
     apt-get install -y software-properties-common wget make autoconf automake libtool build-essential cmake mercurial gyp ninja-build zlib1g-dev libsqlite3-dev bison flex texinfo lzip bsdmainutils

diff --git a/projects/cryptsetup/project.yaml b/projects/cryptsetup/project.yaml
@@ -8,7 +8,7 @@ auto_ccs:
   - [email protected]
 sanitizers:
   - address
-  - memory
+  # - memory ## msan disabled after a clang bump. Please re-enable it, Try to fix any build warnings and build errors, as well as msan runtime warnings and errors. msan failure log: https://oss-fuzz-gcb-logs.storage.googleapis.com/log-bf77a9dc-080e-4e3b-ba89-cbaf65a54e61.txt
   - undefined
 architectures:
   - x86_64

diff --git a/projects/envoy/Dockerfile b/projects/envoy/Dockerfile
@@ -15,7 +15,8 @@
 ################################################################################
 
 
-FROM gcr.io/oss-fuzz-base/base-builder
+FROM gcr.io/oss-fuzz-base/base-builder@sha256:19782f7fe8092843368894dbc471ce9b30dd6a2813946071a36e8b05f5b1e27e
+# ! This project was pinned after a clang bump. Please remove the pin, Try to fix any build warnings and errors, as well as runtime errors
 
 RUN apt-get update && apt-get -y install  \
 	build-essential \

diff --git a/projects/exprtk/project.yaml b/projects/exprtk/project.yaml
@@ -10,5 +10,5 @@ fuzzing_engines:
 sanitizers:
     - address
     - undefined
-    - memory
+    # - memory ## msan disabled after a clang bump. Please re-enable it, Try to fix any build warnings and build errors, as well as msan runtime warnings and errors. msan failure log: https://oss-fuzz-gcb-logs.storage.googleapis.com/log-fbecbadc-e426-46cb-b2fc-be9012b5f1be.txt
 main_repo: 'https://github.com/ArashPartow/exprtk.git'
diff --git a/projects/ffmpeg/Dockerfile b/projects/ffmpeg/Dockerfile
@@ -14,7 +14,8 @@
 #
 ################################################################################
 
-FROM gcr.io/oss-fuzz-base/base-builder
+FROM gcr.io/oss-fuzz-base/base-builder@sha256:19782f7fe8092843368894dbc471ce9b30dd6a2813946071a36e8b05f5b1e27e
+# ! This project was pinned after a clang bump. Please remove the pin, Try to fix any build warnings and errors, as well as runtime errors
 RUN apt-get update && apt-get install -y make autoconf libtool build-essential \
 	libass-dev:i386 libfreetype6-dev:i386 \
 	libvdpau-dev:i386 libxcb1-dev:i386 libxcb-shm0-dev:i386 libdrm-dev:i386 \

diff --git a/projects/flatbuffers/project.yaml b/projects/flatbuffers/project.yaml
@@ -6,7 +6,7 @@ auto_ccs:
   - "[email protected]"
 sanitizers:
   - address
-  - memory
+  # - memory ## msan disabled after a clang bump. Please re-enable it, Try to fix any build warnings and build errors, as well as msan runtime warnings and errors. msan failure log: https://oss-fuzz-gcb-logs.storage.googleapis.com/log-95e0163b-a2c5-4cfe-8e1f-dcf521c125e0.txt
   - undefined
 main_repo: 'https://github.com/google/flatbuffers'
 file_github_issue: True

diff --git a/projects/fluent-bit/Dockerfile b/projects/fluent-bit/Dockerfile
@@ -13,7 +13,8 @@
 # limitations under the License.
 #
 ################################################################################
-FROM gcr.io/oss-fuzz-base/base-builder
+FROM gcr.io/oss-fuzz-base/base-builder@sha256:19782f7fe8092843368894dbc471ce9b30dd6a2813946071a36e8b05f5b1e27e
+# ! This project was pinned after a clang bump. Please remove the pin, Try to fix any build warnings and errors, as well as runtime errors
 RUN apt-get update && apt-get install -y make cmake flex bison libssl-dev libyaml-dev
 RUN git clone --depth 1 https://github.com/fluent/fluent-bit/ fluent-bit
 

diff --git a/projects/freeimage/Dockerfile b/projects/freeimage/Dockerfile
@@ -14,7 +14,8 @@
 #
 ################################################################################
 
-FROM gcr.io/oss-fuzz-base/base-builder
+FROM gcr.io/oss-fuzz-base/base-builder@sha256:19782f7fe8092843368894dbc471ce9b30dd6a2813946071a36e8b05f5b1e27e
+# ! This project was pinned after a clang bump. Please remove the pin, Try to fix any build warnings and errors, as well as runtime errors
 RUN apt-get update && apt-get install -y make autoconf automake libtool wget
 RUN svn checkout https://svn.code.sf.net/p/freeimage/svn/ freeimage-svn
 WORKDIR $SRC/freeimage-svn/FreeImage/trunk/

diff --git a/projects/gdal/Dockerfile b/projects/gdal/Dockerfile
@@ -14,7 +14,8 @@
 #
 ################################################################################
 
-FROM gcr.io/oss-fuzz-base/base-builder
+FROM gcr.io/oss-fuzz-base/base-builder@sha256:19782f7fe8092843368894dbc471ce9b30dd6a2813946071a36e8b05f5b1e27e
+# ! This project was pinned after a clang bump. Please remove the pin, Try to fix any build warnings and errors, as well as runtime errors
 RUN apt-get update && \
     apt-get install -y make autoconf automake libtool g++ curl cmake sqlite3 pkg-config
 

diff --git a/projects/gnutls/Dockerfile b/projects/gnutls/Dockerfile
@@ -14,7 +14,8 @@
 #
 ################################################################################
 
-FROM gcr.io/oss-fuzz-base/base-builder
+FROM gcr.io/oss-fuzz-base/base-builder@sha256:19782f7fe8092843368894dbc471ce9b30dd6a2813946071a36e8b05f5b1e27e
+# ! This project was pinned after a clang bump. Please remove the pin, Try to fix any build warnings and errors, as well as runtime errors
 RUN apt-get update && apt-get install -y \
  make \
  pkg-config \

diff --git a/projects/graphicsmagick/project.yaml b/projects/graphicsmagick/project.yaml
@@ -8,9 +8,9 @@ auto_ccs:
     - [email protected]
 sanitizers:
     - address
-    - memory
+    # - memory ## msan disabled after a clang bump. Please re-enable it, Try to fix any build warnings and build errors, as well as msan runtime warnings and errors. msan failure log: https://oss-fuzz-gcb-logs.storage.googleapis.com/log-17b7b4f4-53de-4bd7-878c-d1240f276016.txt
 # Disabled MSAN because of https://github.com/google/oss-fuzz/issues/6294
-# - memory
+# # - memory ## msan disabled after a clang bump. Please re-enable it, Try to fix any build warnings and build errors, as well as msan runtime warnings and errors. msan failure log: https://oss-fuzz-gcb-logs.storage.googleapis.com/log-17b7b4f4-53de-4bd7-878c-d1240f276016.txt
 architectures:
     - x86_64
     - i386

diff --git a/projects/grpc-httpjson-transcoding/Dockerfile b/projects/grpc-httpjson-transcoding/Dockerfile
@@ -14,7 +14,8 @@
 #
 ################################################################################
 
-FROM gcr.io/oss-fuzz-base/base-builder
+FROM gcr.io/oss-fuzz-base/base-builder@sha256:19782f7fe8092843368894dbc471ce9b30dd6a2813946071a36e8b05f5b1e27e
+# ! This project was pinned after a clang bump. Please remove the pin, Try to fix any build warnings and errors, as well as runtime errors
 MAINTAINER [email protected]
 
 RUN apt-get update && apt-get install python -y

diff --git a/projects/hdf5/Dockerfile b/projects/hdf5/Dockerfile
@@ -14,7 +14,8 @@
 #
 ################################################################################
 
-FROM gcr.io/oss-fuzz-base/base-builder
+FROM gcr.io/oss-fuzz-base/base-builder@sha256:19782f7fe8092843368894dbc471ce9b30dd6a2813946071a36e8b05f5b1e27e
+# ! This project was pinned after a clang bump. Please remove the pin, Try to fix any build warnings and errors, as well as runtime errors
 RUN apt-get update && apt-get install -y make autoconf automake libtool \
   pkg-config cmake zlib1g-dev
 RUN git clone --depth 1 https://github.com/HDFGroup/hdf5

diff --git a/projects/hunspell/project.yaml b/projects/hunspell/project.yaml
@@ -5,7 +5,7 @@ vendor_ccs:
   - "[email protected]"
 sanitizers:
   - address
-  - memory
+  # - memory ## msan disabled after a clang bump. Please re-enable it, Try to fix any build warnings and build errors, as well as msan runtime warnings and errors. msan failure log: https://oss-fuzz-gcb-logs.storage.googleapis.com/log-46e640a5-de1c-4dcf-9812-d4f69c75dbbb.txt
   - undefined
 architectures:
   - i386