CodeIntelligenceTesting / jazzer

Coverage-guided, in-process fuzzing for the JVM
https://code-intelligence.com
Other
1.01k stars 135 forks source link

WIP: Length control #876

Closed fmeum closed 6 months ago

fmeum-ci commented 11 months ago

Requires this libFuzzer patch:

diff --git a/compiler-rt/lib/fuzzer/FuzzerLoop.cpp b/compiler-rt/lib/fuzzer/FuzzerLoop.cpp
index d5fd0cb463ff..445bc8c80401 100644
--- a/compiler-rt/lib/fuzzer/FuzzerLoop.cpp
+++ b/compiler-rt/lib/fuzzer/FuzzerLoop.cpp
@@ -35,6 +35,9 @@
 #endif
 #endif

+size_t gTotalNumberOfRuns = 0;
+size_t gLastCorpusUpdateRun = 0;
+
 namespace fuzzer {
 static const size_t kMaxUnitSizeToPrint = 256;

@@ -583,7 +586,7 @@ void Fuzzer::CrashOnOverwrittenData() {
 ATTRIBUTE_NOINLINE bool Fuzzer::ExecuteCallback(const uint8_t *Data,
                                                 size_t Size) {
   TPC.RecordInitialStack();
-  TotalNumberOfRuns++;
+  gTotalNumberOfRuns = TotalNumberOfRuns++;
   assert(InFuzzingThread());
   if (CurrentUnitData && CurrentUnitData != Data)
     memcpy(CurrentUnitData, Data, Size);
@@ -651,6 +654,7 @@ void Fuzzer::ReportNewCoverage(InputInfo *II, const Unit &U) {
   NumberOfNewUnitsAdded++;
   CheckExitOnSrcPosOrItem(); // Check only after the unit is saved to corpus.
   LastCorpusUpdateRun = TotalNumberOfRuns;
+  gLastCorpusUpdateRun = LastCorpusUpdateRun;
 }

 // Tries detecting a memory leak on the particular input that we have just
zgtm commented 11 months ago
-  TotalNumberOfRuns++;
+  gTotalNumberOfRuns = TotalNumberOfRuns++;

+  gLastCorpusUpdateRun = LastCorpusUpdateRun;

Don't you actually want gTotalNumberOfRuns = ++TotalNumberOfRuns; instead of gTotalNumberOfRuns = TotalNumberOfRuns++;, here, since you are later potentially using the updated number of runs for gLastCorpusUpdateRun?