VirtualBox

Changeset 83266 in vbox for trunk/src


Ignore:
Timestamp:
Mar 11, 2020 6:38:31 PM (5 years ago)
Author:
vboxsync
Message:

Runtime/common/fuzz: Add API to specify the range in an input corpus where mutations are allowed, global and per input. Allows fuzzing certain interesting areas which might not be reached that often otherwise

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/src/VBox/Runtime/common/fuzz/fuzz.cpp

    r82968 r83266  
    206206    /** Parent mutation (no reference is held), NULL means root or original data. */
    207207    PRTFUZZMUTATION             pMutationParent;
     208    /** Start offset where new mutations are allowed to start. */
     209    uint64_t                    offMutStartNew;
     210    /** Size of the range in bytes where mutations are allowed to happen. */
     211    uint64_t                    cbMutNew;
    208212    /** Mutation level. */
    209213    uint32_t                    iLvl;
    … …  
    302306    /** Total number of bytes of memory currently allocated in total for this context. */
    303307    volatile size_t             cbMemTotal;
     308    /** Start offset in the input where a mutation is allowed to happen. */
     309    uint64_t                    offMutStart;
     310    /** size of the range where a mutation can happen. */
     311    uint64_t                    cbMutRange;
    304312} RTFUZZCTXINT;
    305313
    … …  
    784792
    785793/**
     794 * Creates a new mutation capable of holding the additional number of bytes - extended version.
     795 *
     796 * @returns Pointer to the newly created mutation or NULL if out of memory.
     797 * @param   pThis               The fuzzer context instance.
     798 * @param   offMutation         The starting offset for the mutation.
     799 * @param   pMutationParent     The parent mutation, can be NULL.
     800 * @param   offMuStartNew       Offset where descendants of the created mutation can start to mutate.
     801 * @param   cbMutNew            Range in bytes where descendants of the created mutation can mutate.c
     802 * @param   cbAdditional        Additional number of bytes to allocate after the core structure.
     803 * @param   ppvMutation         Where to store the pointer to the mutation dependent data on success.
     804 */
     805static PRTFUZZMUTATION rtFuzzMutationCreateEx(PRTFUZZCTXINT pThis, uint64_t offMutation, PRTFUZZMUTATION pMutationParent,
     806                                              uint64_t offMutStartNew, uint64_t cbMutNew, size_t cbAdditional, void **ppvMutation)
     807{
     808    PRTFUZZMUTATION pMutation = (PRTFUZZMUTATION)rtFuzzCtxMemoryAlloc(pThis, sizeof(RTFUZZMUTATION) + cbAdditional);
     809    if (RT_LIKELY(pMutation))
     810    {
     811        pMutation->u32Magic        = 0; /** @todo */
     812        pMutation->pFuzzer         = pThis;
     813        pMutation->cRefs           = 1;
     814        pMutation->iLvl            = 0;
     815        pMutation->offMutation     = offMutation;
     816        pMutation->pMutationParent = pMutationParent;
     817        pMutation->offMutStartNew  = offMutStartNew;
     818        pMutation->cbMutNew        = cbMutNew;
     819        pMutation->cbMutation      = cbAdditional;
     820        pMutation->fInTree         = false;
     821        pMutation->fCached         = false;
     822        pMutation->pvInput         = NULL;
     823        pMutation->cbInput         = 0;
     824        pMutation->cbAlloc         = 0;
     825
     826        if (pMutationParent)
     827            pMutation->iLvl = pMutationParent->iLvl + 1;
     828        if (ppvMutation)
     829            *ppvMutation = &pMutation->abMutation[0];
     830    }
     831
     832    return pMutation;
     833}
     834
     835
     836/**
    786837 * Creates a new mutation capable of holding the additional number of bytes.
    787838 *
    … …  
    793844 * @param   ppvMutation         Where to store the pointer to the mutation dependent data on success.
    794845 */
    795 static PRTFUZZMUTATION rtFuzzMutationCreate(PRTFUZZCTXINT pThis, uint64_t offMutation, PRTFUZZMUTATION pMutationParent,
    796                                             size_t cbAdditional, void **ppvMutation)
    797 {
    798     PRTFUZZMUTATION pMutation = (PRTFUZZMUTATION)rtFuzzCtxMemoryAlloc(pThis, sizeof(RTFUZZMUTATION) + cbAdditional);
    799     if (RT_LIKELY(pMutation))
    800     {
    801         pMutation->u32Magic        = 0; /** @todo */
    802         pMutation->pFuzzer         = pThis;
    803         pMutation->cRefs           = 1;
    804         pMutation->iLvl            = 0;
    805         pMutation->offMutation     = offMutation;
    806         pMutation->pMutationParent = pMutationParent;
    807         pMutation->cbMutation      = cbAdditional;
    808         pMutation->fInTree         = false;
    809         pMutation->fCached         = false;
    810         pMutation->pvInput         = NULL;
    811         pMutation->cbInput         = 0;
    812         pMutation->cbAlloc         = 0;
    813 
    814         if (pMutationParent)
    815             pMutation->iLvl = pMutationParent->iLvl + 1;
    816         if (ppvMutation)
    817             *ppvMutation = &pMutation->abMutation[0];
    818     }
    819 
    820     return pMutation;
     846DECLINLINE(PRTFUZZMUTATION) rtFuzzMutationCreate(PRTFUZZCTXINT pThis, uint64_t offMutation, PRTFUZZMUTATION pMutationParent,
     847                                                 size_t cbAdditional, void **ppvMutation)
     848{
     849    uint64_t offMutNew = pMutationParent ? pMutationParent->offMutStartNew : pThis->offMutStart;
     850    uint64_t cbMutNew = pMutationParent ? pMutationParent->cbMutNew : pThis->cbMutRange;
     851
     852    return rtFuzzMutationCreateEx(pThis, offMutation, pMutationParent, offMutNew, cbMutNew, cbAdditional, ppvMutation);
    821853}
    822854
    … …  
    14221454        pThis->cbMutationsAllocMax = _1G;
    14231455        pThis->cbMemTotal          = 0;
     1456        pThis->offMutStart         = 0;
     1457        pThis->cbMutRange          = UINT64_MAX;
    14241458        RTListInit(&pThis->LstMutationsAlloc);
    14251459
    … …  
    17881822    AssertReturn(cbInput, VERR_INVALID_POINTER);
    17891823
     1824    return RTFuzzCtxCorpusInputAddEx(hFuzzCtx, pvInput, cbInput, pThis->offMutStart, pThis->cbMutRange);
     1825}
     1826
     1827
     1828RTDECL(int) RTFuzzCtxCorpusInputAddEx(RTFUZZCTX hFuzzCtx, const void *pvInput, size_t cbInput,
     1829                                      uint64_t offMutStart, uint64_t cbMutRange)
     1830{
     1831    PRTFUZZCTXINT pThis = hFuzzCtx;
     1832    AssertPtrReturn(pThis, VERR_INVALID_POINTER);
     1833    AssertPtrReturn(pvInput, VERR_INVALID_POINTER);
     1834    AssertReturn(cbInput, VERR_INVALID_POINTER);
     1835
    17901836    int rc = VINF_SUCCESS;
    17911837    void *pvCorpus = NULL;
    1792     PRTFUZZMUTATION pMutation = rtFuzzMutationCreate(pThis, 0, NULL, cbInput, &pvCorpus);
     1838    PRTFUZZMUTATION pMutation = rtFuzzMutationCreateEx(pThis, 0, NULL, offMutStart, cbMutRange,
     1839                                                       cbInput, &pvCorpus);
    17931840    if (RT_LIKELY(pMutation))
    17941841    {
    … …  
    18141861    AssertPtrReturn(pszFilename, VERR_INVALID_POINTER);
    18151862
     1863    return RTFuzzCtxCorpusInputAddFromFileEx(hFuzzCtx, pszFilename, pThis->offMutStart, pThis->cbMutRange);
     1864}
     1865
     1866
     1867RTDECL(int) RTFuzzCtxCorpusInputAddFromFileEx(RTFUZZCTX hFuzzCtx, const char *pszFilename,
     1868                                              uint64_t offMutStart, uint64_t cbMutRange)
     1869{
     1870    PRTFUZZCTXINT pThis = hFuzzCtx;
     1871    AssertPtrReturn(pThis, VERR_INVALID_POINTER);
     1872    AssertPtrReturn(pszFilename, VERR_INVALID_POINTER);
     1873
    18161874    void *pv = NULL;
    18171875    size_t cb = 0;
    … …  
    18191877    if (RT_SUCCESS(rc))
    18201878    {
    1821         rc = RTFuzzCtxCorpusInputAdd(hFuzzCtx, pv, cb);
     1879        rc = RTFuzzCtxCorpusInputAddEx(hFuzzCtx, pv, cb, offMutStart, cbMutRange);
    18221880        RTFileReadAllFree(pv, cb);
    18231881    }
    … …  
    18281886
    18291887RTDECL(int) RTFuzzCtxCorpusInputAddFromVfsFile(RTFUZZCTX hFuzzCtx, RTVFSFILE hVfsFile)
     1888{
     1889    PRTFUZZCTXINT pThis = hFuzzCtx;
     1890    AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
     1891    AssertReturn(hVfsFile != NIL_RTVFSFILE, VERR_INVALID_HANDLE);
     1892
     1893    return RTFuzzCtxCorpusInputAddFromVfsFileEx(hFuzzCtx, hVfsFile, pThis->offMutStart, pThis->cbMutRange);
     1894}
     1895
     1896
     1897RTDECL(int) RTFuzzCtxCorpusInputAddFromVfsFileEx(RTFUZZCTX hFuzzCtx, RTVFSFILE hVfsFile,
     1898                                                 uint64_t offMutStart, uint64_t cbMutRange)
    18301899{
    18311900    PRTFUZZCTXINT pThis = hFuzzCtx;
    … …  
    18381907    if (RT_SUCCESS(rc))
    18391908    {
    1840         PRTFUZZMUTATION pMutation = rtFuzzMutationCreate(pThis, 0, NULL, cbFile, &pvCorpus);
     1909        PRTFUZZMUTATION pMutation = rtFuzzMutationCreateEx(pThis, 0, NULL, offMutStart, cbMutRange,
     1910                                                           cbFile, &pvCorpus);
    18411911        if (RT_LIKELY(pMutation))
    18421912        {
    … …  
    18511921                rtFuzzMutationDestroy(pMutation);
    18521922        }
     1923        else
     1924            rc = VERR_NO_MEMORY;
    18531925    }
    18541926
    … …  
    19672039
    19682040
     2041RTDECL(int) RTFuzzCtxCfgSetMutationRange(RTFUZZCTX hFuzzCtx, uint64_t offStart, uint64_t cbRange)
     2042{
     2043    PRTFUZZCTXINT pThis = hFuzzCtx;
     2044    AssertPtrReturn(pThis, VERR_INVALID_POINTER);
     2045
     2046    pThis->offMutStart = offStart;
     2047    pThis->cbMutRange  = cbRange;
     2048    return VINF_SUCCESS;
     2049}
     2050
     2051
    19692052RTDECL(int) RTFuzzCtxReseed(RTFUZZCTX hFuzzCtx, uint64_t uSeed)
    19702053{
    … …  
    19942077        uint64_t offStart = 0;
    19952078        if (!(pMutator->fFlags & RTFUZZMUTATOR_F_END_OF_BUF))
    1996             offStart = RTRandAdvU64Ex(pThis->hRand, 0, pMutationParent->cbInput - 1);
     2079        {
     2080            uint64_t offMax = pMutationParent->cbInput - 1;
     2081            if (   pMutation->cbMutNew != UINT64_MAX
     2082                && pMutation->offMutStartNew + pMutation->cbMutNew < offMax)
     2083                offMax = pMutation->offMutStartNew + pMutation->cbMutNew - 1;
     2084
     2085            offStart = RTRandAdvU64Ex(pThis->hRand, pMutation->offMutStartNew, offMax);
     2086        }
    19972087        else
    19982088            offStart = pMutationParent->cbInput;
Note: See TracChangeset for help on using the changeset viewer.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette