jazzer icon indicating copy to clipboard operation
jazzer copied to clipboard

WIP: Length control

Open fmeum opened this issue 1 year ago • 2 comments

fmeum avatar Oct 19 '23 11:10 fmeum

Requires this libFuzzer patch:

diff --git a/compiler-rt/lib/fuzzer/FuzzerLoop.cpp b/compiler-rt/lib/fuzzer/FuzzerLoop.cpp
index d5fd0cb463ff..445bc8c80401 100644
--- a/compiler-rt/lib/fuzzer/FuzzerLoop.cpp
+++ b/compiler-rt/lib/fuzzer/FuzzerLoop.cpp
@@ -35,6 +35,9 @@
 #endif
 #endif
 
+size_t gTotalNumberOfRuns = 0;
+size_t gLastCorpusUpdateRun = 0;
+
 namespace fuzzer {
 static const size_t kMaxUnitSizeToPrint = 256;
 
@@ -583,7 +586,7 @@ void Fuzzer::CrashOnOverwrittenData() {
 ATTRIBUTE_NOINLINE bool Fuzzer::ExecuteCallback(const uint8_t *Data,
                                                 size_t Size) {
   TPC.RecordInitialStack();
-  TotalNumberOfRuns++;
+  gTotalNumberOfRuns = TotalNumberOfRuns++;
   assert(InFuzzingThread());
   if (CurrentUnitData && CurrentUnitData != Data)
     memcpy(CurrentUnitData, Data, Size);
@@ -651,6 +654,7 @@ void Fuzzer::ReportNewCoverage(InputInfo *II, const Unit &U) {
   NumberOfNewUnitsAdded++;
   CheckExitOnSrcPosOrItem(); // Check only after the unit is saved to corpus.
   LastCorpusUpdateRun = TotalNumberOfRuns;
+  gLastCorpusUpdateRun = LastCorpusUpdateRun;
 }
 
 // Tries detecting a memory leak on the particular input that we have just

fmeum-ci avatar Oct 19 '23 11:10 fmeum-ci

-  TotalNumberOfRuns++;
+  gTotalNumberOfRuns = TotalNumberOfRuns++;

+  gLastCorpusUpdateRun = LastCorpusUpdateRun;

Don't you actually want gTotalNumberOfRuns = ++TotalNumberOfRuns; instead of gTotalNumberOfRuns = TotalNumberOfRuns++;, here, since you are later potentially using the updated number of runs for gLastCorpusUpdateRun?

zgtm avatar Oct 19 '23 12:10 zgtm