Changeset 77482 in vbox for trunk/include/iprt

Timestamp:

Feb 27, 2019 1:17:24 PM (6 years ago)

Author:

vboxsync

Message:

Runtime/fuzz: Rewriting the core fuzzed input generator.

The new implementation stores only changes between mutations and not the
complete input. This saves memory (at the cost of a bit of increased complexity
when generating the input) and allows to generate mutations when no initial corpus
data is available which is useful when trying to fuzz data streams like network connections.

There are two modes when creating a new fuzzing context:

• BLOB is used for input data like files where an initial corpus is available
• STREAM is used for data streams like network connections

Location:

trunk/include/iprt

Files:

• fuzz.h (modified) (6 diffs)
• mangling.h (modified) (2 diffs)

trunk/include/iprt/fuzz.h

@@ -63 +63 @@
 
 
+/**
+ * Fuzzing context type.
+ */
+typedef enum RTFUZZCTXTYPE
+{
+    /** Invalid type. */
+    RTFUZZCTXTYPE_INVALID = 0,
+    /** Original input data is a single binary large object (BLOB), from a file or similar. */
+    RTFUZZCTXTYPE_BLOB,
+    /** Original input data is from a data stream like a network connection. */
+    RTFUZZCTXTYPE_STREAM,
+    /** 32bit hack. */
+    RTFUZZCTXTYPE_32BIT_HACK = 0x7fffffff
+} RTFUZZCTXTYPE;
+
 /** @name RTFUZZCTX_F_XXX - Flags for RTFuzzCtxCfgSetBehavioralFlags
  * @{ */
@@ -76 +91 @@
  * @returns IPRT status code.
  * @param   phFuzzCtx           Where to store the handle to the fuzzing context on success.
- */
-RTDECL(int) RTFuzzCtxCreate(PRTFUZZCTX phFuzzCtx);
+ * @param   enmType             Fuzzing context data type.
+ */
+RTDECL(int) RTFuzzCtxCreate(PRTFUZZCTX phFuzzCtx, RTFUZZCTXTYPE enmType);
 
 /**
@@ -242 +258 @@
 RTDECL(int) RTFuzzCtxInputGenerate(RTFUZZCTX hFuzzCtx, PRTFUZZINPUT phFuzzInput);
 
-/**
- * Mutates a raw buffer.
- *
- * @returns IPRT status code.
- * @param   hFuzzCtx            The fuzzing context handle.
- * @param   pvBuf               Pointer to the buffer to mutate.
- * @param   cbBuf               Size of the buffer iny bytes to mutate.
- * @param   phFuzzInput         Where to store the handle to the fuzzed input on success.
- */
-RTDECL(int) RTFuzzCtxMutateBuffer(RTFUZZCTX hFuzzCtx, void *pvBuf, size_t cbBuf,
-                                  PRTFUZZINPUT phFuzzInput);
-
 
 /**
@@ -272 +276 @@
 
 /**
- * Queries the data pointer and size of the given fuzzing input.
+ * Queries the data pointer and size of the given fuzzed input blob.
  *
  * @returns IPRT status code
@@ -279 +283 @@
  * @param   pcb                 Where to store the size of the input data on success.
  */
-RTDECL(int) RTFuzzInputQueryData(RTFUZZINPUT hFuzzInput, void **ppv, size_t *pcb);
+RTDECL(int) RTFuzzInputQueryBlobData(RTFUZZINPUT hFuzzInput, void **ppv, size_t *pcb);
+
+/**
+ * Processes the given data stream for a streamed fuzzing context.
+ *
+ * @returns IPRT status code.
+ * @param   hFuzzInput          The fuzzing input handle.
+ * @param   pvBuf               The data buffer.
+ * @param   cbBuf               Size of the buffer.
+ */
+RTDECL(int) RTFuzzInputMutateStreamData(RTFUZZINPUT hFuzzInput, void *pvBuf, size_t cbBuf);
 
 /**
@@ -368 +382 @@
  * @returns IPRT status code.
  * @param   phFuzzObs           Where to store the fuzzing observer handle on success.
- */
-RTDECL(int) RTFuzzObsCreate(PRTFUZZOBS phFuzzObs);
+ * @param   enmType             Fuzzing context data type.
+ */
+RTDECL(int) RTFuzzObsCreate(PRTFUZZOBS phFuzzObs, RTFUZZCTXTYPE enmType);
 
 /**

trunk/include/iprt/mangling.h

@@ -1038 +1038 @@
 # define RTFuzzCtxCreateFromStateFile                   RT_MANGLER(RTFuzzCtxCreateFromStateFile)
 # define RTFuzzCtxInputGenerate                         RT_MANGLER(RTFuzzCtxInputGenerate)
-# define RTFuzzCtxMutateBuffer                          RT_MANGLER(RTFuzzCtxMutateBuffer)
 # define RTFuzzCtxRelease                               RT_MANGLER(RTFuzzCtxRelease)
 # define RTFuzzCtxReseed                                RT_MANGLER(RTFuzzCtxReseed)
@@ -1045 +1044 @@
 # define RTFuzzCtxStateExportToFile                     RT_MANGLER(RTFuzzCtxStateExportToFile)
 # define RTFuzzInputAddToCtxCorpus                      RT_MANGLER(RTFuzzInputAddToCtxCorpus)
-# define RTFuzzInputQueryData                           RT_MANGLER(RTFuzzInputQueryData)
+# define RTFuzzInputMutateStreamData                    RT_MANGLER(RTFuzzInputMutateStreamData)
+# define RTFuzzInputQueryBlobData                       RT_MANGLER(RTFuzzInputQueryBlobData)
 # define RTFuzzInputQueryDigestString                   RT_MANGLER(RTFuzzInputQueryDigestString)
 # define RTFuzzInputRelease                             RT_MANGLER(RTFuzzInputRelease)