landaire / lain

A structured fuzzing framework built in Rust
MIT License
23 stars 5 forks source link

mutator does not ignore `ignore`-fields #2

Open theguy147 opened 2 years ago

theguy147 commented 2 years ago

Here in the wiki it says:

ignore will use the default field initializer (Default::default()) and will not perform mutation on the field. It will however be serialized.

Nevertheless the fields are not ignored by the mutator (they are only ignored during field initialization).

Here is a little program (adapted from the README) that shows this behavior:

use lain::{prelude::*, rand};

#[derive(Debug, Mutatable, NewFuzzed, BinarySerialize)]
struct MyStruct {
    field_1: u8,

    #[lain(ignore)]
    field_2: u8,
}

fn main() {
    let mut mutator = Mutator::new(rand::thread_rng());

    let mut instance = MyStruct::new_fuzzed(&mut mutator, None);

    let mut serialized_data = Vec::with_capacity(instance.serialized_size());
    instance.binary_serialize::<_, BigEndian>(&mut serialized_data);

    println!("{:#?}", instance);
    for i in 0..6 {
        instance.mutate(&mut mutator, None);
        println!("{:#?}", instance);
    }
}

And this is a sample output:

MyStruct {
    field_1: 128,
    field_2: 0,
}
MyStruct {
    field_1: 135,
    field_2: 1,
}
MyStruct {
    field_1: 125,
    field_2: 129,
}
MyStruct {
    field_1: 130,
    field_2: 126,
}
MyStruct {
    field_1: 125,
    field_2: 115,
}
MyStruct {
    field_1: 122,
    field_2: 129,
}
MyStruct {
    field_1: 107,
    field_2: 127,
}

As you can see the field_2 should be ignored by the mutator (according to the wiki), but it is still mutated...

EDIT: I tested this behavior with lain versions 0.5 and 0.5.5

theguy147 commented 2 years ago

After applying the patch from the PR I created in #3 the output is now as I would expect it to be:

MyStruct {
    field_1: 2,
    field_2: 0,
}
MyStruct {
    field_1: 253,
    field_2: 0,
}
MyStruct {
    field_1: 125,
    field_2: 0,
}
MyStruct {
    field_1: 253,
    field_2: 0,
}
MyStruct {
    field_1: 2,
    field_2: 0,
}
MyStruct {
    field_1: 253,
    field_2: 0,
}
MyStruct {
    field_1: 255,
    field_2: 0,
}