def mocked_fuzz(runner):
"""Mocked version of AflRunner.fuzz."""
fuzz_args = runner.generate_afl_args()
runner._fuzz_args = fuzz_args # pylint: disable=protected-access
engine_common.recreate_directory(runner.afl_output.output_directory)
runner._fuzzer_stderr = '' # pylint: disable=protected-access
# Create the queue directory within AFL's output directory.
queue = runner.afl_output.queue
engine_common.recreate_directory(queue)
new_corpus_dir = os.path.join(DATA_DIRECTORY, 'merge_new_corpus')
for filename in os.listdir(new_corpus_dir):
src = os.path.join(new_corpus_dir, filename)
dst = os.path.join(queue, filename)
shutil.copy(src, dst)
return new_process.ProcessResult(command=[],
return_code=0,
output='',
time_executed=1)
def _minimize_corpus_two_step(self, target_path, arguments,
existing_corpus_dirs, new_corpus_dir,
output_corpus_dir, reproducers_dir,
max_time):
"""Optional (but recommended): run corpus minimization.
Args:
target_path: Path to the target.
arguments: Additional arguments needed for corpus minimization.
existing_corpus_dirs: Input corpora that existed before the fuzzing run.
new_corpus_dir: Input corpus that was generated during the fuzzing run.
Must have at least one new file.
output_corpus_dir: Output directory to place minimized corpus.
reproducers_dir: The directory to put reproducers in when crashes are
found.
max_time: Maximum allowed time for the minimization.
Returns:
A Result object.
"""
if not _is_multistep_merge_supported(target_path):
# Fallback to the old single step merge. It does not support incremental
# stats and provides only `edge_coverage` and `feature_coverage` stats.
logs.log(
'Old version of libFuzzer is used. Using single step merge.')
return self.minimize_corpus(
target_path, arguments,
existing_corpus_dirs + [new_corpus_dir], output_corpus_dir,
reproducers_dir, max_time)
# The dir where merge control file is located must persist for both merge
# steps. The second step re-uses the MCF produced during the first step.
merge_control_file_dir = self._create_temp_corpus_dir('mcf_tmp_dir')
self._merge_control_file = os.path.join(merge_control_file_dir, 'MCF')
# Two step merge process to obtain accurate stats for the new corpus units.
# See https://reviews.llvm.org/D66107 for a more detailed description.
merge_stats = {}
# Step 1. Use only existing corpus and collect "initial" stats.
result_1 = self.minimize_corpus(target_path, arguments,
existing_corpus_dirs,
output_corpus_dir, reproducers_dir,
max_time)
merge_stats['initial_edge_coverage'] = result_1.stats['edge_coverage']
merge_stats['initial_feature_coverage'] = result_1.stats[
'feature_coverage']
# Clear the output dir as it does not have any new units at this point.
engine_common.recreate_directory(output_corpus_dir)
# Adjust the time limit for the time we spent on the first merge step.
max_time -= result_1.time_executed
if max_time <= 0:
logs.log_error('Merging new testcases timed out.',
fuzzer_output=result_1.logs)
raise TimeoutError('Merging new testcases timed out.')
# Step 2. Process the new corpus units as well.
result_2 = self.minimize_corpus(
target_path, arguments, existing_corpus_dirs + [new_corpus_dir],
output_corpus_dir, reproducers_dir, max_time)
merge_stats['edge_coverage'] = result_2.stats['edge_coverage']
merge_stats['feature_coverage'] = result_2.stats['feature_coverage']
# Diff the stats to obtain accurate values for the new corpus units.
merge_stats['new_edges'] = (merge_stats['edge_coverage'] -
merge_stats['initial_edge_coverage'])
merge_stats['new_features'] = (merge_stats['feature_coverage'] -
merge_stats['initial_feature_coverage'])
output = result_1.logs + '\n\n' + result_2.logs
if (merge_stats['new_edges'] < 0 or merge_stats['new_features'] < 0):
logs.log_error('Two step merge failed.',
merge_stats=merge_stats,
output=output)
merge_stats['new_edges'] = 0
merge_stats['new_features'] = 0
self._merge_control_file = None
# TODO(ochang): Get crashes found during merge.
return engine.FuzzResult(
output, result_2.command, [], merge_stats,
result_1.time_executed + result_2.time_executed)
def _create_temp_corpus_dir(self, name):
"""Create temporary corpus directory."""
new_corpus_directory = os.path.join(fuzzer_utils.get_temp_dir(), name)
engine_common.recreate_directory(new_corpus_directory)
return new_corpus_directory