Пример #1
0
static bool fuzz_prepareFileDynamically(honggfuzz_t * hfuzz, fuzzer_t * fuzzer, int rnd_index)
{
    while (pthread_mutex_lock(&hfuzz->dynamicFile_mutex)) ;

    if (hfuzz->inputFile && hfuzz->branchBestCnt[0] == 0 && hfuzz->branchBestCnt[1] == 0
        && hfuzz->branchBestCnt[2] == 0 && hfuzz->branchBestCnt[3] == 0) {
        size_t fileSz = files_readFileToBufMax(hfuzz->files[rnd_index], hfuzz->dynamicFileBest,
                                               hfuzz->maxFileSz);
        if (fileSz == 0) {
            while (pthread_mutex_unlock(&hfuzz->dynamicFile_mutex)) ;
            LOGMSG(l_ERROR, "Couldn't read '%s'", hfuzz->files[rnd_index]);
            return false;
        }
        hfuzz->dynamicFileBestSz = fileSz;
    }

    if (hfuzz->dynamicFileBestSz > hfuzz->maxFileSz) {
        LOGMSG(l_FATAL, "Current BEST file Sz > maxFileSz (%zu > %zu)", hfuzz->dynamicFileBestSz,
               hfuzz->maxFileSz);
    }

    fuzzer->dynamicFileSz = hfuzz->dynamicFileBestSz;
    memcpy(fuzzer->dynamicFile, hfuzz->dynamicFileBest, hfuzz->dynamicFileBestSz);

    while (pthread_mutex_unlock(&hfuzz->dynamicFile_mutex)) ;

    /* The first pass should be on an empty/initial file */
    if (hfuzz->branchBestCnt[0] > 0 || hfuzz->branchBestCnt[1] > 0 || hfuzz->branchBestCnt[2] > 0
        || hfuzz->branchBestCnt[3] > 0) {
        mangle_Resize(hfuzz, fuzzer->dynamicFile, &fuzzer->dynamicFileSz);
        mangle_mangleContent(hfuzz, fuzzer->dynamicFile, fuzzer->dynamicFileSz);
    }

    if (files_writeBufToFile
        (fuzzer->fileName, fuzzer->dynamicFile, fuzzer->dynamicFileSz,
         O_WRONLY | O_CREAT | O_EXCL | O_TRUNC) == false) {
        LOGMSG(l_ERROR, "Couldn't write buffer to file '%s'", fuzzer->fileName);
        return false;
    }

    return true;
}
Пример #2
0
static bool fuzz_prepareFile(honggfuzz_t * hfuzz, fuzzer_t * fuzzer, int rnd_index)
{
    size_t fileSz =
        files_readFileToBufMax(hfuzz->files[rnd_index], fuzzer->dynamicFile, hfuzz->maxFileSz);
    if (fileSz == 0UL) {
        LOGMSG(l_ERROR, "Couldn't read contents of '%s'", hfuzz->files[rnd_index]);
        return false;
    }

    mangle_Resize(hfuzz, fuzzer->dynamicFile, &fileSz);
    mangle_mangleContent(hfuzz, fuzzer->dynamicFile, fileSz);

    if (files_writeBufToFile
        (fuzzer->fileName, fuzzer->dynamicFile, fileSz, O_WRONLY | O_CREAT | O_EXCL) == false) {
        LOGMSG(l_ERROR, "Couldn't write buffer to file '%s'", fuzzer->fileName);
        return false;
    }

    return true;
}
Пример #3
0
static bool fuzz_prepareFile(honggfuzz_t * hfuzz, fuzzer_t * fuzzer, int rnd_index)
{
    size_t fileSz =
        files_readFileToBufMax(hfuzz->files[rnd_index], fuzzer->dynamicFile, hfuzz->maxFileSz);
    if (fileSz == 0UL) {
        LOG_E("Couldn't read contents of '%s'", hfuzz->files[rnd_index]);
        return false;
    }

    /* If flip rate is 0.0, early abort file mangling */
    if (hfuzz->flipRate != 0.0L) {
        mangle_Resize(hfuzz, fuzzer->dynamicFile, &fileSz);
        mangle_mangleContent(hfuzz, fuzzer->dynamicFile, fileSz);
    }

    if (files_writeBufToFile
        (fuzzer->fileName, fuzzer->dynamicFile, fileSz, O_WRONLY | O_CREAT | O_EXCL) == false) {
        LOG_E("Couldn't write buffer to file '%s'", fuzzer->fileName);
        return false;
    }

    return true;
}
Пример #4
0
static bool fuzz_prepareFileDynamically(honggfuzz_t * hfuzz, fuzzer_t * fuzzer, int rnd_index)
{
    MX_LOCK(&hfuzz->dynamicFile_mutex);

    /* If max dynamicFile iterations counter, pick new seed file when working with input file corpus */
    if (hfuzz->inputFile &&
        __sync_fetch_and_add(&hfuzz->dynFileIterExpire, 0UL) >= _HF_MAX_DYNFILE_ITER) {
        size_t fileSz = files_readFileToBufMax(hfuzz->files[rnd_index], hfuzz->dynamicFileBest,
                                               hfuzz->maxFileSz);
        if (fileSz == 0) {
            MX_UNLOCK(&hfuzz->dynamicFile_mutex);
            LOG_E("Couldn't read '%s'", hfuzz->files[rnd_index]);
            return false;
        }
        hfuzz->dynamicFileBestSz = fileSz;

        /* Reset counter since new seed pick */
        __sync_fetch_and_and(&hfuzz->dynFileIterExpire, 0UL);
        fuzz_resetFeedbackCnts(hfuzz);

        /*
         * In order to have accurate comparison base for coverage, first iteration
         * of a new seed is executed without mangling. Also workersBlock_mutex mutex
         * is maintain until execution is finished to ensure that other threads will
         * work against the same coverage data vs. original seed.
         */
        hfuzz->isDynFileLocked = true;
    } else if (hfuzz->inputFile == NULL && (fuzz_isPerfCntsSet(hfuzz) == false)) {
        /*
         * When working with an empty input file corpus (allowed if perf feedback enabled for Linux archs),
         * first iteration is executed without mangling. First iteration need to be executed by one thread
         * blocking other workers from continuing until finished.
         */
        hfuzz->isDynFileLocked = true;
    }

    if (hfuzz->dynamicFileBestSz > hfuzz->maxFileSz) {
        LOG_F("Current BEST file Sz > maxFileSz (%zu > %zu)", hfuzz->dynamicFileBestSz,
              hfuzz->maxFileSz);
    }

    fuzzer->dynamicFileSz = hfuzz->dynamicFileBestSz;
    memcpy(fuzzer->dynamicFile, hfuzz->dynamicFileBest, hfuzz->dynamicFileBestSz);

    MX_UNLOCK(&hfuzz->dynamicFile_mutex);

    /*
     * true isDynFileLocked indicates first run for a new seed, so skip mangling
     * without unlocking threads block mutex.
     */
    MX_LOCK(&hfuzz->workersBlock_mutex);
    if (hfuzz->isDynFileLocked) {
        goto skipMangling;
    }
    MX_UNLOCK(&hfuzz->workersBlock_mutex);

    /*
     * if flip rate is 0.0, early abort file mangling. This will leave perf counters
     * with values equal to dry runs against input corpus.
     */
    if (hfuzz->flipRate == 0.0L) {
        goto skipMangling;
    }

    mangle_Resize(hfuzz, fuzzer->dynamicFile, &fuzzer->dynamicFileSz);
    mangle_mangleContent(hfuzz, fuzzer->dynamicFile, fuzzer->dynamicFileSz);

 skipMangling:
    if (files_writeBufToFile
        (fuzzer->fileName, fuzzer->dynamicFile, fuzzer->dynamicFileSz,
         O_WRONLY | O_CREAT | O_EXCL | O_TRUNC) == false) {
        LOG_E("Couldn't write buffer to file '%s'", fuzzer->fileName);
        return false;
    }

    return true;
}