search

google / atheris

Apache License 2.0
1.35k stars 112 forks source link

Fix FuzzedDataProvider::ConsumeSmallIntInRange #35

Closed babenek closed 2 years ago

babenek commented 2 years ago

FuzzedDataProvider: ConsumeIntInRange invokes ConsumeSmallIntInRange which generated int64 from tail of remained bytes and did not shift the buffer. Byte order is keep the same. It consumes the same value from saved seeds when the bytes are in end of data. Some stored seeds might provide different values.

google-cla[bot] commented 2 years ago

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

TheShiftedBit commented 2 years ago

Hi babanek,

This code was based off this function from the equivalent FuzzedDataProvider in LLVM: https://github.com/llvm-mirror/compiler-rt/blob/master/include/fuzzer/FuzzedDataProvider.h#L93

Essentially, it pops off the end rather than the beginning, but it should still remove bytes from the data. (The --remaining_bytes_; being the relevant line).

Although, I never did actually test it to see if LLVM's pop-off-the-end strategy produces better results; I just assumed their comment was correct.

Is there a bug in the Atheris implementation? Does your more standard implementation produce better results?

babenek commented 2 years ago

Thank you for point to code reference. Current approach is quickly and works very well. I cannot find any profit of my code except common sequence in bytes. It could help a bit to generate seeds manually.