fmt

afl/src/events/mod.rs

@@ -3,8 +3,8 @@
 pub mod stats;
 pub use stats::*;
 
-use crate::llmp::LlmpReceiver;
 use crate::llmp::LlmpSender;
+use crate::{llmp::LlmpReceiver, utils::deserialize_state_mgr};
 use alloc::{
     string::{String, ToString},
     vec::Vec,
@@ -46,18 +46,10 @@ pub enum LogSeverity {
 impl fmt::Display for LogSeverity {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
-            LogSeverity::Debug => {
+            LogSeverity::Debug => write!(f, "Debug"),
-                write!(f, "Debug")
+            LogSeverity::Info => write!(f, "Info"),
-            }
+            LogSeverity::Warn => write!(f, "Warn"),
-            LogSeverity::Info => {
+            LogSeverity::Error => write!(f, "Error"),
-                write!(f, "Info")
-            }
-            LogSeverity::Warn => {
-                write!(f, "Warn")
-            }
-            LogSeverity::Error => {
-                write!(f, "Error")
-            }
         }
     }
 }
@@ -204,7 +196,12 @@ where
     }
 
     /// Send off an event to the broker
-    fn fire<C, FT, R>(&mut self, _state: &mut State<C, I, R, FT>, event: Event<I>) -> Result<(), AflError> where
+    fn fire<C, FT, R>(
+        &mut self,
+        _state: &mut State<C, I, R, FT>,
+        event: Event<I>,
+    ) -> Result<(), AflError>
+    where
         C: Corpus<I, R>,
         FT: FeedbacksTuple<I>,
         R: Rand;
@@ -228,10 +225,16 @@ where
         Ok(0)
     }
 
-    fn fire<C, FT, R>(&mut self, _state: &mut State<C, I, R, FT>, _event: Event<I>) -> Result<(), AflError> where
+    fn fire<C, FT, R>(
+        &mut self,
+        _state: &mut State<C, I, R, FT>,
+        _event: Event<I>,
+    ) -> Result<(), AflError>
+    where
         C: Corpus<I, R>,
         FT: FeedbacksTuple<I>,
-    R: Rand {
+        R: Rand,
+    {
         Ok(())
     }
 }
@@ -268,10 +271,16 @@ where
         Ok(count)
     }
 
-    fn fire<C, FT, R>(&mut self, _state: &mut State<C, I, R, FT>, event: Event<I>) -> Result<(), AflError> where
+    fn fire<C, FT, R>(
+        &mut self,
+        _state: &mut State<C, I, R, FT>,
+        event: Event<I>,
+    ) -> Result<(), AflError>
+    where
         C: Corpus<I, R>,
         FT: FeedbacksTuple<I>,
-    R: Rand, {
+        R: Rand,
+    {
         match Self::handle_in_broker(&mut self.stats, 0, &event)? {
             BrokerEventResult::Forward => self.events.push(event),
             BrokerEventResult::Handled => (),
@@ -367,6 +376,9 @@ const _LLMP_TAG_EVENT_TO_BROKER: llmp::Tag = 0x2B80438;
 ///
 const LLMP_TAG_EVENT_TO_BOTH: llmp::Tag = 0x2B0741;
 
+const _LLMP_TAG_RESTART: llmp::Tag = 0x8357A87;
+const _LLMP_TAG_NO_RESTART: llmp::Tag = 0x57A7EE71;
+
 #[derive(Clone, Debug)]
 pub struct LlmpEventManager<I, SH, ST>
 where
@@ -640,7 +652,11 @@ where
         Ok(count)
     }
 
-    fn fire<C, FT, R>(&mut self, _state: &mut State<C, I, R, FT>, event: Event<I>) -> Result<(), AflError>
+    fn fire<C, FT, R>(
+        &mut self,
+        _state: &mut State<C, I, R, FT>,
+        event: Event<I>,
+    ) -> Result<(), AflError>
     where
         C: Corpus<I, R>,
         FT: FeedbacksTuple<I>,
@@ -672,7 +688,7 @@ where
 
 */
 
-
+/// A manager that can restart on the fly
 #[derive(Clone, Debug)]
 pub struct LlmpRestartingEventManager<I, SH, ST>
 where
@@ -681,12 +697,12 @@ where
     ST: Stats,
     //CE: CustomEvent<I>,
 {
+    /// The embedded llmp event manager
     llmp_mgr: LlmpEventManager<I, SH, ST>,
+    /// The sender to serialize the state for the next runner
     sender: LlmpSender<SH>,
-    receiver: LlmpReceiver<SH>,
 }
 
-
 impl<I, SH, ST> EventManager<I> for LlmpRestartingEventManager<I, SH, ST>
 where
     I: Input,
@@ -702,21 +718,25 @@ where
         self.llmp_mgr.process(state)
     }
 
-    fn fire<C, FT, R>(&mut self, state: &mut State<C, I, R, FT>, event: Event<I>) -> Result<(), AflError> where
+    fn fire<C, FT, R>(
+        &mut self,
+        state: &mut State<C, I, R, FT>,
+        event: Event<I>,
+    ) -> Result<(), AflError>
+    where
         C: Corpus<I, R>,
         FT: FeedbacksTuple<I>,
         R: Rand,
     {
+        // Check if we are going to crash in the event, in which case we store our current state for the next runner
         match &event {
-            Event::Crash { input: _ } => {
+            Event::Crash { input: _ } | Event::Timeout { input: _ } => {
+                // First, reset the page to 0 so the next iteration can read read from the beginning of this page
+                unsafe { sender.reset_last_page() };
                 let buf = postcard::to_allocvec(&(&state, &self.llmp_mgr.describe()?))?;
-                self.sender.send_buf(0x1, &buf).unwrap();
+                self.sender.send_buf(_LLMP_TAG_RESTART, &buf).unwrap();
-            },
+            }
-            Event::Timeout { input: _ } => {
+            _ => (),
-                let buf = postcard::to_allocvec(&(&state, &self.llmp_mgr.describe()?))?;
-                self.sender.send_buf(0x1, &buf).unwrap();
-            },
-            _ => {}
         };
         self.llmp_mgr.fire(state, event)
     }
@@ -728,35 +748,30 @@ const ENV_FUZZER_RECEIVER: &str = &"_AFL_ENV_FUZZER_RECEIVER";
 /// The llmp (2 way) connection from a fuzzer to the broker (broadcasting all other fuzzer messages)
 const ENV_FUZZER_BROKER_CLIENT_INITIAL: &str = &"_AFL_ENV_FUZZER_BROKER_CLIENT";
 
-
 impl<I, SH, ST> LlmpRestartingEventManager<I, SH, ST>
 where
     I: Input,
     SH: ShMem,
     ST: Stats, //CE: CustomEvent<I>,
 {
-
     /// Create a new runner, the executed child doing the actual fuzzing.
-    pub fn new(llmp_mgr: LlmpEventManager<I, SH, ST>, receiver: LlmpReceiver<SH>, sender: LlmpSender<SH>) -> Self {
+    pub fn new(llmp_mgr: LlmpEventManager<I, SH, ST>, sender: LlmpSender<SH>) -> Self {
-        Self {
+        Self { llmp_mgr, sender }
-            llmp_mgr,
-            sender,
-            receiver,
-        }
     }
 
-    pub fn temp<C, FT, R>(stats: ST, broker_port: u16) -> Result<(Self, Option<State<C, I, R, FT>>), AflError>
+    pub fn temp<C, FT, R>(
+        stats: ST,
+        broker_port: u16,
+    ) -> Result<(Self, Option<State<C, I, R, FT>>), AflError>
     where
         C: Corpus<I, R>,
         FT: FeedbacksTuple<I>,
         R: Rand,
     {
-        
         let mut mgr;
 
         // We start ourself as child process to actually fuzz
         if std::env::var(ENV_FUZZER_SENDER).is_err() {
-
             // We are either the broker, or the parent of the fuzzing instance
             mgr = LlmpEventManager::new_on_port(stats, broker_port)?;
             if mgr.is_broker() {
@@ -807,9 +822,7 @@ where
             None => {
                 println!("First run. Let's set it all up");
                 // Mgr to send and receive msgs from/to all other fuzzer instances
-                mgr = LlmpEventManager::existing_client_from_env(
+                mgr = LlmpEventManager::existing_client_from_env(ENV_FUZZER_BROKER_CLIENT_INITIAL)?;
-                    ENV_FUZZER_BROKER_CLIENT_INITIAL,
-                )?;
 
                 (mgr, None)
             }
@@ -824,12 +837,13 @@ where
 
         Ok(mgr)
     }
-
 }
 
 /// A restarting state is a combination of restarter and runner, that can be used on systems without `fork`.
 /// The restarter will start a new process each time the child crashes or timeouts.
-pub fn setup_restarting_state<I, C, FT, R, SH, ST, >(mgr: &mut LlmpEventManager<I, SH, ST>) -> Result<Option<State<C, I, R, FT>>, AflError>
+pub fn setup_restarting_state<I, C, FT, R, SH, ST>(
+    mgr: &mut LlmpEventManager<I, SH, ST>,
+) -> Result<Option<State<C, I, R, FT>>, AflError>
 where
     I: Input,
     C: Corpus<I, R>,
@@ -838,10 +852,8 @@ pub fn setup_restarting_state<I, C, FT, R, SH, ST, >(mgr: &mut LlmpEventManager<
     SH: ShMem,
     ST: Stats,
 {
-
     // We start ourself as child process to actually fuzz
     if std::env::var(ENV_FUZZER_SENDER).is_err() {
-
         mgr.to_env(ENV_FUZZER_BROKER_CLIENT_INITIAL);
 
         // First, create a channel from the fuzzer (sender) to us (receiver) to report its state for restarts.
@@ -881,23 +893,26 @@ pub fn setup_restarting_state<I, C, FT, R, SH, ST, >(mgr: &mut LlmpEventManager<
         None => {
             println!("First run. Let's set it all up");
             // Mgr to send and receive msgs from/to all other fuzzer instances
-                let client_mgr = LlmpEventManager::existing_client_from_env(
+            let client_mgr =
-                    ENV_FUZZER_BROKER_CLIENT_INITIAL,
+                LlmpEventManager::existing_client_from_env(ENV_FUZZER_BROKER_CLIENT_INITIAL)?;
-                )?;
 
-                (LlmpRestartingEventManager::new(client_mgr, sender, receiver), receiver: LlmpReceiver<SH>, sender: LlmpSender<SH>), None)
+            (LlmpRestartingEventManager::new(client_mgr, sender), None)
         }
         // Restoring from a previous run, deserialize state and corpus.
         Some((_sender, _tag, msg)) => {
             println!("Subsequent run. Let's load all data from shmem (received {} bytes from previous instance)", msg.len());
-                deserialize_state_mgr(&msg, stats)?
+            deserialize_state_mgr(&msg)?
         }
     };
     // We reset the sender, the next sender and receiver (after crash) will reuse the page from the initial message.
     unsafe { sender.reset_last_page() };
+    /* TODO: Not sure if this is needed
+    // We commit an empty NO_RESTART message to this buf, against infinite loops,
+    // in case something crashes in the fuzzer.
+    sender.send_buf(_LLMP_TAG_NO_RESTART, []);
+    */
 }
 
-
 #[cfg(test)]
 mod tests {
 

afl/src/lib.rs

@@ -86,11 +86,14 @@ where
             let cur = current_milliseconds();
             if cur - last > 60 * 100 {
                 last = cur;
-                manager.fire(state, Event::UpdateStats {
+                manager.fire(
+                    state,
+                    Event::UpdateStats {
                         executions: state.executions(),
                         execs_over_sec: state.executions_over_seconds(),
                         phantom: PhantomData,
-                })?
+                    },
+                )?
             }
         }
     }

afl/src/state/mod.rs

@@ -143,11 +143,14 @@ where
         for in_dir in in_dirs {
             self.load_from_directory(executor, generator, manager, in_dir)?;
         }
-        manager.fire(self, Event::Log {
+        manager.fire(
+            self,
+            Event::Log {
                 severity_level: LogSeverity::Debug,
                 message: format!("Loaded {} initial testcases.", self.corpus().count()), // get corpus count
                 phantom: PhantomData,
-        })?;
+            },
+        )?;
         manager.process(self)?;
         Ok(())
     }
@@ -351,11 +354,14 @@ where
                 added += 1;
             }
         }
-        manager.fire(self, Event::Log {
+        manager.fire(
+            self,
+            Event::Log {
                 severity_level: LogSeverity::Debug,
                 message: format!("Loaded {} over {} initial testcases", added, num),
                 phantom: PhantomData,
-        })?;
+            },
+        )?;
         manager.process(self)?;
         Ok(())
     }