Skip to content

Commit 95f7c15

Browse files
tokatokatokatoka
authored
Make fuzzer hold testcase bytes converter (#3127)
* add * fixing * done * fix * a * no std * mm * aaa * fix * mm * please stop * please stop * please stop * Just * aaaaa * aaa * plz stop * aaa * mmm * aaa * AAAAAAAAAAAAAA * a bit faster CI? * win * wtf are these garbages..? * no cache? * ??? * always * ?/ * aa * aa * glib * glib * pixman * AAA * AA * unicorn * unicron * nyx
1 parent 50e1239 commit 95f7c15

File tree

36 files changed

+308
-336
lines changed

36 files changed

+308
-336
lines changed

‎.github/workflows/build_and_test.yml

+4-2
Original file line numberDiff line numberDiff line change
@@ -270,7 +270,7 @@ jobs:
270270
- ./fuzzers/binary_only/fuzzbench_qemu
271271
- ./fuzzers/binary_only/intel_pt_baby_fuzzer
272272
- ./fuzzers/binary_only/intel_pt_command_executor
273-
- ./fuzzers/binary_only/tinyinst_simple
273+
# - ./fuzzers/binary_only/tinyinst_simple
274274

275275
# Forkserver
276276
- ./fuzzers/forkserver/forkserver_simple
@@ -326,6 +326,8 @@ jobs:
326326
steps:
327327
- uses: actions/checkout@v4
328328
- uses: ./.github/workflows/fuzzer-tester-prepare
329+
with:
330+
fuzzer-name: ${{ matrix.fuzzer }}
329331
- name: Build and run example fuzzers (Linux)
330332
if: runner.os == 'Linux'
331333
shell: bash
@@ -366,7 +368,7 @@ jobs:
366368
- name: "Install dependencies"
367369
if: runner.os == 'Linux'
368370
shell: bash
369-
run: sudo apt-get update && sudo apt-get install gcc gcc-arm-linux-gnueabihf gcc-aarch64-linux-gnu
371+
run: sudo apt-get update && sudo apt-get install gcc gcc-arm-linux-gnueabihf gcc-aarch64-linux-gnu gcc-riscv64-linux-gnu
370372
- name: Build and run example fuzzers (Linux)
371373
if: runner.os == 'Linux'
372374
shell: bash

‎.github/workflows/fuzzer-tester-prepare/action.yml

+16-12
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
name: Setup Rust Environment
22
description: Sets up the Rust environment for the CI workflow
3+
inputs:
4+
fuzzer-name:
5+
description: 'The fuzzer name to run'
6+
required: true
37
runs:
48
using: composite
59
steps:
@@ -8,33 +12,33 @@ runs:
812
submodules: true
913
fetch-depth: 0
1014
- uses: ./.github/workflows/ubuntu-prepare
11-
- uses: Swatinem/rust-cache@v2
12-
with: { shared-key: "${{ runner.os }}-shared-fuzzer-cache" }
13-
- name: Install fuzzers deps
14-
shell: bash
15-
run: sudo apt-get update && sudo apt-get install -y nasm nlohmann-json3-dev gcc-aarch64-linux-gnu g++-aarch64-linux-gnu gcc-mipsel-linux-gnu g++-mipsel-linux-gnu gcc-riscv64-linux-gnu gcc-powerpc-linux-gnu g++-powerpc-linux-gnu libc6-dev-i386-cross libc6-dev libc6-dev-i386 lib32gcc-11-dev lib32stdc++-11-dev libgtk-3-dev pax-utils python3-msgpack python3-jinja2
1615
- name: enable mult-thread for `make`
1716
shell: bash
1817
run: export MAKEFLAGS="-j$(expr $(nproc) \+ 1)"
1918
- name: Add no_std toolchain
19+
if: ${{ inputs.fuzzer-name == './fuzzers/fuzz_anything/baby_no_std' }}
2020
shell: bash
2121
run: rustup toolchain install nightly-x86_64-unknown-linux-gnu ; rustup component add rust-src --toolchain nightly-x86_64-unknown-linux-gnu
22-
- name: Add wasm target
22+
- name: Add nyx deps
23+
if: ${{ inputs.fuzzer-name == './fuzzers/full_system/nyx_launcher' || inputs.fuzzer-name == './fuzzers/full_system/nyx_libxml2_standalone' || inputs.fuzzer-name == './fuzzers/full_system/nyx_libxml2_parallel' }}
2324
shell: bash
24-
run: rustup target add wasm32-unknown-unknown
25+
run: sudo apt update && sudo apt install -y libgtk-3-dev pax-utils python3-msgpack python3-jinja2 libcapstone-dev
2526
- name: install just
2627
uses: extractions/setup-just@v2
2728
with:
28-
just-version: 1.39.0
29+
just-version: '1.40.0'
30+
31+
- name: Add wasm target
32+
if: ${{ inputs.fuzzer-name == './fuzzers/fuzz_anything/baby_fuzzer_wasm' }}
33+
shell: bash
34+
run: rustup target add wasm32-unknown-unknown
2935
- name: install wasm-pack
36+
if: ${{ inputs.fuzzer-name == './fuzzers/fuzz_anything/baby_fuzzer_wasm' }}
3037
uses: baptiste0928/cargo-install@v3
3138
with:
3239
crate: wasm-pack
33-
- name: install cxxbridge-cmd
34-
uses: baptiste0928/cargo-install@v3
35-
with:
36-
crate: cxxbridge-cmd
3740
- name: install chrome
41+
if: ${{ inputs.fuzzer-name == './fuzzers/fuzz_anything/baby_fuzzer_wasm' }}
3842
uses: browser-actions/setup-chrome@v1
3943
with:
4044
chrome-version: stable

‎.github/workflows/librasan-prepare/action.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ runs:
4747
- name: install just
4848
uses: extractions/setup-just@v2
4949
with:
50-
just-version: 1.39.0
50+
just-version: '1.40.0'
5151
- name: Install cargo-binstall
5252
shell: bash
5353
run: |

‎.github/workflows/qemu-fuzzer-tester-prepare/action.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ runs:
1616
- name: install just
1717
uses: extractions/setup-just@v2
1818
with:
19-
just-version: 1.39.0
19+
just-version: '1.40.0'
2020
- uses: actions/checkout@v4
2121
with:
2222
submodules: true

‎.github/workflows/ubuntu-prepare/action.yml

+2-3
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,12 @@ runs:
77
shell: bash
88
run: |
99
sudo apt-get update
10-
sudo apt-get install -y curl lsb-release wget software-properties-common gnupg shellcheck pax-utils \
11-
nasm libsqlite3-dev libc6-dev libgtk-3-dev gcc g++ libslirp-dev libz3-dev build-essential \
10+
sudo apt-get install -y curl lsb-release wget software-properties-common gnupg shellcheck pax-utils libsqlite3-dev libpixman-1-dev libc6-dev gcc g++ build-essential libglib2.0-dev
1211
- uses: dtolnay/rust-toolchain@stable
1312
- name: install just
1413
uses: extractions/setup-just@v2
1514
with:
16-
just-version: 1.39.0
15+
just-version: '1.40.0'
1716
- name: Add stable clippy
1817
shell: bash
1918
run: rustup toolchain install stable --component clippy --allow-downgrade

‎.github/workflows/windows-tester-prepare/action.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,4 +18,4 @@ runs:
1818
- name: install just
1919
uses: extractions/setup-just@v2
2020
with:
21-
just-version: 1.39.0
21+
just-version: '1.40.0'

‎.gitignore

-3
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,6 @@ vendor
55

66
# cargo lockfiles except from binaries
77
**/Cargo.lock
8-
# !fuzzers/**/Cargo.lock
9-
# !utils/**/Cargo.lock
10-
118

129
.DS_Store
1310
.env

‎fuzzers/baby/baby_fuzzer_custom_executor/src/main.rs

+9-4
Original file line numberDiff line numberDiff line change
@@ -14,15 +14,15 @@ use libafl::{
1414
feedbacks::{CrashFeedback, MaxMapFeedback},
1515
fuzzer::{Fuzzer, StdFuzzer},
1616
generators::RandPrintablesGenerator,
17-
inputs::HasTargetBytes,
17+
inputs::{HasTargetBytes, NopBytesConverter},
1818
mutators::{havoc_mutations::havoc_mutations, scheduled::HavocScheduledMutator},
1919
observers::StdMapObserver,
2020
schedulers::QueueScheduler,
2121
stages::{mutational::StdMutationalStage, AflStatsStage, CalibrationStage},
2222
state::{HasCorpus, HasExecutions, StdState},
23+
BloomInputFilter, StdFuzzerBuilder,
2324
};
2425
use libafl_bolts::{current_nanos, nonzero, rands::StdRand, tuples::tuple_list, AsSlice};
25-
2626
/// Coverage map with explicit assignments due to the lack of instrumentation
2727
static mut SIGNALS: [u8; 16] = [0; 16];
2828
static mut SIGNALS_PTR: *mut u8 = &raw mut SIGNALS as _;
@@ -138,8 +138,13 @@ pub fn main() {
138138
#[cfg(not(feature = "bloom_input_filter"))]
139139
let mut fuzzer = StdFuzzer::new(scheduler, feedback, objective);
140140
#[cfg(feature = "bloom_input_filter")]
141-
let mut fuzzer =
142-
StdFuzzer::with_bloom_input_filter(scheduler, feedback, objective, 10_000_000, 0.001);
141+
let filter = BloomInputFilter::new(10_000_000, 0.001);
142+
#[cfg(feature = "bloom_input_filter")]
143+
let mut fuzzer = StdFuzzerBuilder::new()
144+
.input_filter(filter)
145+
.bytes_converter(NopBytesConverter::default())
146+
.build(scheduler, feedback, objective)
147+
.unwrap();
143148

144149
// Create the executor for an in-process function with just one observer
145150
let executor = CustomExecutor::new(&state);

‎fuzzers/forkserver/libafl-fuzz/src/fuzzer.rs

+2-2
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ use libafl::{
2222
CaptureTimeoutFeedback, ConstFeedback, CrashFeedback, MaxMapFeedback, TimeFeedback,
2323
},
2424
fuzzer::StdFuzzer,
25-
inputs::{BytesInput, NopTargetBytesConverter},
25+
inputs::BytesInput,
2626
mutators::{havoc_mutations, tokens_mutations, AFLppRedQueen, HavocScheduledMutator, Tokens},
2727
observers::{CanTrack, HitcountsMapObserver, StdMapObserver, TimeObserver},
2828
schedulers::{
@@ -567,7 +567,7 @@ fn base_forkserver_builder<'a>(
567567
opt: &'a Opt,
568568
shmem_provider: &'a mut UnixShMemProvider,
569569
fuzzer_dir: &Path,
570-
) -> ForkserverExecutorBuilder<'a, NopTargetBytesConverter<BytesInput>, UnixShMemProvider> {
570+
) -> ForkserverExecutorBuilder<'a, UnixShMemProvider> {
571571
let mut executor = ForkserverExecutor::builder()
572572
.program(opt.executable.clone())
573573
.coverage_map_size(opt.map_size.unwrap_or(AFL_DEFAULT_MAP_SIZE))

‎fuzzers/structure_aware/forkserver_simple_nautilus/src/main.rs

+9-5
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@ use libafl::{
1010
feedbacks::{
1111
CrashFeedback, MaxMapFeedback, NautilusChunksMetadata, NautilusFeedback, TimeFeedback,
1212
},
13-
fuzzer::{Fuzzer, StdFuzzer},
13+
fuzzer::Fuzzer,
1414
generators::{NautilusContext, NautilusGenerator},
15-
inputs::{NautilusInput, NautilusTargetBytesConverter},
15+
inputs::{NautilusBytesConverter, NautilusInput},
1616
monitors::SimpleMonitor,
1717
mutators::{
1818
HavocScheduledMutator, NautilusRandomMutator, NautilusRecursionMutator,
@@ -22,7 +22,7 @@ use libafl::{
2222
schedulers::{IndexesLenTimeMinimizerScheduler, QueueScheduler},
2323
stages::mutational::StdMutationalStage,
2424
state::StdState,
25-
HasMetadata,
25+
BloomInputFilter, HasMetadata, StdFuzzerBuilder,
2626
};
2727
use libafl_bolts::{
2828
current_nanos,
@@ -166,7 +166,12 @@ pub fn main() {
166166
let scheduler = IndexesLenTimeMinimizerScheduler::new(&edges_observer, QueueScheduler::new());
167167

168168
// A fuzzer with feedbacks and a corpus scheduler
169-
let mut fuzzer = StdFuzzer::new(scheduler, feedback, objective);
169+
let converter = NautilusBytesConverter::new(&context);
170+
let mut fuzzer = StdFuzzerBuilder::new()
171+
.input_filter(BloomInputFilter::default())
172+
.bytes_converter(converter)
173+
.build(scheduler, feedback, objective)
174+
.unwrap();
170175

171176
// If we should debug the child
172177
let debug_child = opt.debug_child;
@@ -186,7 +191,6 @@ pub fn main() {
186191
.coverage_map_size(MAP_SIZE)
187192
.timeout(Duration::from_millis(opt.timeout))
188193
.kill_signal(opt.signal)
189-
.target_bytes_converter(NautilusTargetBytesConverter::new(&context))
190194
.build(tuple_list!(time_observer, edges_observer))
191195
.unwrap();
192196

‎fuzzers/structure_aware/nautilus_sync/src/lib.rs

+2-2
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ use libafl::{
1515
feedbacks::{CrashFeedback, MaxMapFeedback, NautilusChunksMetadata, NautilusFeedback},
1616
fuzzer::{Fuzzer, StdFuzzer},
1717
generators::{NautilusContext, NautilusGenerator},
18-
inputs::{NautilusInput, NautilusToBytesInputConverter},
18+
inputs::{NautilusBytesConverter, NautilusInput},
1919
monitors::SimpleMonitor,
2020
mutators::{
2121
HavocScheduledMutator, NautilusRandomMutator, NautilusRecursionMutator,
@@ -126,7 +126,7 @@ pub extern "C" fn libafl_main() {
126126
.build_on_port(
127127
shmem_provider.clone(),
128128
port,
129-
Some(NautilusToBytesInputConverter::new(&context)),
129+
Some(NautilusBytesConverter::new(&context)),
130130
none_input_converter!(),
131131
)
132132
.unwrap()

‎libafl/src/events/launcher.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -366,7 +366,7 @@ where
366366
"Not spawning broker (spawn_broker is false). Waiting for fuzzer children to exit..."
367367
);
368368
unsafe {
369-
libc::waitpid(*handle, &mut status, 0);
369+
libc::waitpid(*handle, &raw mut status, 0);
370370
if status != 0 {
371371
log::info!("Client with pid {handle} exited with status {status}");
372372
}

‎libafl/src/events/llmp/mod.rs

+2-11
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ use crate::{
1818
Error,
1919
events::{Event, EventFirer, EventWithStats},
2020
fuzzer::EvaluatorObservers,
21-
inputs::{Input, InputConverter, NopInput, NopInputConverter},
21+
inputs::{Input, InputConverter, NopInput},
2222
state::{HasCurrentTestcase, HasSolutions, NopState},
2323
};
2424

@@ -88,16 +88,7 @@ pub struct LlmpEventConverter<I, IC, ICB, S, SHM, SP> {
8888
phantom: PhantomData<(I, S)>,
8989
}
9090

91-
impl
92-
LlmpEventConverter<
93-
NopInput,
94-
NopInputConverter<NopInput>,
95-
NopInputConverter<NopInput>,
96-
NopState<NopInput>,
97-
NopShMem,
98-
NopShMemProvider,
99-
>
100-
{
91+
impl LlmpEventConverter<NopInput, (), (), NopState<NopInput>, NopShMem, NopShMemProvider> {
10192
/// Create a builder for [`LlmpEventConverter`]
10293
#[must_use]
10394
pub fn builder() -> LlmpEventConverterBuilder {

0 commit comments

Comments
 (0)