jazzer
jazzer copied to clipboard
WIP: Length control
Requires this libFuzzer patch:
diff --git a/compiler-rt/lib/fuzzer/FuzzerLoop.cpp b/compiler-rt/lib/fuzzer/FuzzerLoop.cpp
index d5fd0cb463ff..445bc8c80401 100644
--- a/compiler-rt/lib/fuzzer/FuzzerLoop.cpp
+++ b/compiler-rt/lib/fuzzer/FuzzerLoop.cpp
@@ -35,6 +35,9 @@
#endif
#endif
+size_t gTotalNumberOfRuns = 0;
+size_t gLastCorpusUpdateRun = 0;
+
namespace fuzzer {
static const size_t kMaxUnitSizeToPrint = 256;
@@ -583,7 +586,7 @@ void Fuzzer::CrashOnOverwrittenData() {
ATTRIBUTE_NOINLINE bool Fuzzer::ExecuteCallback(const uint8_t *Data,
size_t Size) {
TPC.RecordInitialStack();
- TotalNumberOfRuns++;
+ gTotalNumberOfRuns = TotalNumberOfRuns++;
assert(InFuzzingThread());
if (CurrentUnitData && CurrentUnitData != Data)
memcpy(CurrentUnitData, Data, Size);
@@ -651,6 +654,7 @@ void Fuzzer::ReportNewCoverage(InputInfo *II, const Unit &U) {
NumberOfNewUnitsAdded++;
CheckExitOnSrcPosOrItem(); // Check only after the unit is saved to corpus.
LastCorpusUpdateRun = TotalNumberOfRuns;
+ gLastCorpusUpdateRun = LastCorpusUpdateRun;
}
// Tries detecting a memory leak on the particular input that we have just
- TotalNumberOfRuns++; + gTotalNumberOfRuns = TotalNumberOfRuns++; + gLastCorpusUpdateRun = LastCorpusUpdateRun;
Don't you actually want gTotalNumberOfRuns = ++TotalNumberOfRuns;
instead of gTotalNumberOfRuns = TotalNumberOfRuns++;
, here, since you are later potentially using the updated number of runs for gLastCorpusUpdateRun
?