示例#1
0
def prune_corpus(request, _):
    """Prune corpus."""
    context = corpus_pruning_task.Context(
        _proto_to_fuzz_target(request.fuzz_target), [
            _proto_to_cross_pollinate_fuzzer(proto)
            for proto in request.cross_pollinate_fuzzers
        ])

    result = corpus_pruning_task.do_corpus_pruning(
        context, request.last_execution_failed, request.revision)

    cross_pollination_stats = None
    if result.cross_pollination_stats:
        cross_pollination_stats = untrusted_runner_pb2.CrossPollinationStats(
            project_qualified_name=result.cross_pollination_stats.
            project_qualified_name,
            method=result.cross_pollination_stats.method,
            sources=result.cross_pollination_stats.sources,
            tags=result.cross_pollination_stats.tags,
            initial_corpus_size=result.cross_pollination_stats.
            initial_corpus_size,
            corpus_size=result.cross_pollination_stats.corpus_size,
            initial_edge_coverage=result.cross_pollination_stats.
            initial_edge_coverage,
            edge_coverage=result.cross_pollination_stats.edge_coverage,
            initial_feature_coverage=result.cross_pollination_stats.
            initial_feature_coverage,
            feature_coverage=result.cross_pollination_stats.feature_coverage)

    # Intentionally skip edge and function coverage values as those would come
    # from fuzzer coverage cron task (see src/go/server/cron/coverage.go).
    coverage_info = untrusted_runner_pb2.CoverageInfo(
        corpus_size_units=result.coverage_info.corpus_size_units,
        corpus_size_bytes=result.coverage_info.corpus_size_bytes,
        corpus_location=result.coverage_info.corpus_location,
        corpus_backup_location=result.coverage_info.corpus_backup_location,
        quarantine_size_units=result.coverage_info.quarantine_size_units,
        quarantine_size_bytes=result.coverage_info.quarantine_size_bytes,
        quarantine_location=result.coverage_info.quarantine_location)

    crashes = [
        untrusted_runner_pb2.CorpusCrash(
            crash_state=crash.crash_state,
            crash_type=crash.crash_type,
            crash_address=crash.crash_address,
            crash_stacktrace=crash.crash_stacktrace,
            unit_path=crash.unit_path,
            security_flag=crash.security_flag,
        ) for crash in result.crashes
    ]

    return untrusted_runner_pb2.PruneCorpusResponse(
        coverage_info=coverage_info,
        crashes=crashes,
        fuzzer_binary_name=result.fuzzer_binary_name,
        revision=result.revision,
        cross_pollination_stats=cross_pollination_stats)
示例#2
0
def prune_corpus(request, _):
    """Prune corpus."""
    context = corpus_pruning_task.Context(
        _proto_to_fuzz_target(request.fuzz_target),
        [
            _proto_to_cross_pollinate_fuzzer(proto)
            for proto in request.cross_pollinate_fuzzers
        ],
    )

    result = corpus_pruning_task.do_corpus_pruning(
        context, request.last_execution_failed, request.revision)

    # Intentionally skip edge and function coverage values as those would come
    # from fuzzer coverage cron task (see src/go/server/cron/coverage.go).
    coverage_info = untrusted_runner_pb2.CoverageInfo(
        corpus_size_units=result.coverage_info.corpus_size_units,
        corpus_size_bytes=result.coverage_info.corpus_size_bytes,
        corpus_location=result.coverage_info.corpus_location,
        corpus_backup_location=result.coverage_info.corpus_backup_location,
        quarantine_size_units=result.coverage_info.quarantine_size_units,
        quarantine_size_bytes=result.coverage_info.quarantine_size_bytes,
        quarantine_location=result.coverage_info.quarantine_location,
    )

    crashes = [
        untrusted_runner_pb2.CorpusCrash(
            crash_state=crash.crash_state,
            crash_type=crash.crash_type,
            crash_address=crash.crash_address,
            crash_stacktrace=protobuf_utils.encode_utf8_if_unicode(
                crash.crash_stacktrace),
            unit_path=crash.unit_path,
            security_flag=crash.security_flag,
        ) for crash in result.crashes
    ]

    return untrusted_runner_pb2.PruneCorpusResponse(
        coverage_info=coverage_info,
        crashes=crashes,
        fuzzer_binary_name=result.fuzzer_binary_name,
        revision=result.revision,
    )
示例#3
0
    def test_get_libfuzzer_flags(self):
        """Test get_libfuzzer_flags logic."""
        fuzz_target = data_handler.get_fuzz_target('libFuzzer_test_fuzzer')
        context = corpus_pruning_task.Context(
            fuzz_target, [], corpus_pruning_task.Pollination.RANDOM, None)

        runner = corpus_pruning_task.Runner(self.build_dir, context)
        flags = runner.get_libfuzzer_flags()
        expected_default_flags = [
            '-timeout=5', '-rss_limit_mb=2560', '-max_len=5242880',
            '-detect_leaks=1', '-use_value_profile=1'
        ]
        six.assertCountEqual(self, flags, expected_default_flags)

        runner.fuzzer_options = options.FuzzerOptions(
            os.path.join(self.build_dir, 'test_get_libfuzzer_flags.options'))
        flags = runner.get_libfuzzer_flags()
        expected_custom_flags = [
            '-timeout=5', '-rss_limit_mb=2560', '-max_len=1337',
            '-detect_leaks=0', '-use_value_profile=1'
        ]
        six.assertCountEqual(self, flags, expected_custom_flags)