FuzzManager
FuzzManager copied to clipboard
[FTB] Generated signatures for assertions should use exact match on crashAddress=0x0
Currently we generate signatures matching crashAddress < 0x100 for null deref crashes. Assertions always crash on 0x0, so it would be cheaper to check for an exact match if we also see an assertion message. We should change our signature generation algorithm to do this.
From discussion with @choller:
- This should only be done when the detected crashAddress is already 0x0, and not assume all assertions are crashing at 0x0, because we have seen otherwise.
- We don't currently have a way of knowing whether
getAssertionhas found a fatal assertion, or a crash message (like ASAN's crash synopsis) - This is a small optimization, but would save us from considering output symptoms for segv crashes near null, which are relatively expensive.