[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH v2 09/15] fuzz: add a crossover function to generic-fuzzer
From: |
Darren Kenny |
Subject: |
Re: [PATCH v2 09/15] fuzz: add a crossover function to generic-fuzzer |
Date: |
Thu, 03 Sep 2020 10:04:13 +0100 |
On Wednesday, 2020-08-19 at 02:11:04 -04, Alexander Bulekov wrote:
> Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
> ---
> tests/qtest/fuzz/general_fuzz.c | 81 ++++++++++++++++++++++++++++++++-
> 1 file changed, 80 insertions(+), 1 deletion(-)
>
> diff --git a/tests/qtest/fuzz/general_fuzz.c b/tests/qtest/fuzz/general_fuzz.c
> index 26fcd69e45..2c3716f8cc 100644
> --- a/tests/qtest/fuzz/general_fuzz.c
> +++ b/tests/qtest/fuzz/general_fuzz.c
> @@ -739,6 +739,83 @@ static void general_pre_fuzz(QTestState *s)
>
> counter_shm_init();
> }
> +
> +/*
> + * When libfuzzer gives us two inputs to combine, return a new input with the
> + * following structure:
> + *
> + * Input 1 (data1)
> + * SEPARATOR
> + * Clear out the DMA Patterns
> + * SEPARATOR
> + * Disable the pci_read/write instructions
> + * SEPARATOR
> + * Input 2 (data2)
> + *
> + * The idea is to collate the core behaviors of the two inputs.
> + * For example:
> + * Input 1: maps a device's BARs, sets up three DMA patterns, and triggers
> + * device functionality A
> + * Input 2: maps a device's BARs, sets up one DMA pattern, and triggers
> device
> + * functionality B
> + *
> + * This function attempts to produce an input that:
> + * Ouptut: maps a device's BARs, set up three DMA patterns, triggers
> + * functionality A device, replaces the DMA patterns with a single
> + * patten, and triggers device functionality B.
> + */
> +static size_t general_fuzz_crossover(const uint8_t *data1, size_t size1,
> const
> + uint8_t *data2, size_t size2, uint8_t
> *out,
> + size_t max_out_size, unsigned int seed)
> +{
I don't see this function as well documented, but it might be a good
idea to check up front whether out is not NULL and that the max_out_size
is capable of holding what you're likely to consume, i.e. approx:
size1 + size2 + (SEPARATOR * 3) + 2 /* Ops */
If nothing else means you can be sure you won't have to call MIN() all
the time, but also that you won't end up only partially filling it too.
> + size_t copy = 0, size = 0;
NIT: Maybe copy should be copy_len or something rather than a verb?
> +
> + // Copy in the first input
> + copy = MIN(size1, max_out_size);
> + memcpy(out+size, data1, copy);
> + size+= copy;
> + max_out_size-= copy;
> +
> + // Append a separator
> + copy = MIN(strlen(SEPARATOR), max_out_size);
> + memcpy(out+size, SEPARATOR, copy);
> + size+= copy;
> + max_out_size-= copy;
> +
> + // Clear out the
> + copy = MIN(1, max_out_size);
> + if (copy) {
> + out[size] = OP_CLEAR_DMA_PATTERNS;
> + }
> + size+= copy;
> + max_out_size-= copy;
> +
> + copy = MIN(strlen(SEPARATOR), max_out_size);
> + memcpy(out+size, SEPARATOR, copy);
> + size+= copy;
> + max_out_size-= copy;
> +
> + copy = MIN(1, max_out_size);
> + if (copy) {
> + out[size] = OP_DISABLE_PCI;
> + }
> + size+= copy;
> + max_out_size-= copy;
> +
> + copy = MIN(strlen(SEPARATOR), max_out_size);
> + memcpy(out+size, SEPARATOR, copy);
> + size+= copy;
> + max_out_size-= copy;
> +
> + copy = MIN(size2, max_out_size);
> + memcpy(out+size, data2, copy);
> + size+= copy;
> + max_out_size-= copy;
> +
> + return size;
> +}
> +
> +
> static GString *general_fuzz_cmdline(FuzzTarget *t)
> {
> GString *cmd_line = g_string_new(TARGET_NAME);
> @@ -758,7 +835,9 @@ static void register_general_fuzz_targets(void)
> .description = "Fuzz based on any qemu command-line args. ",
> .get_init_cmdline = general_fuzz_cmdline,
> .pre_fuzz = general_pre_fuzz,
> - .fuzz = general_fuzz});
> + .fuzz = general_fuzz,
> + .crossover = general_fuzz_crossover
> + });
> }
>
> fuzz_target_init(register_general_fuzz_targets);
Thanks,
Darren.
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- Re: [PATCH v2 09/15] fuzz: add a crossover function to generic-fuzzer,
Darren Kenny <=