SYS-OSS/FRET-LibAFL
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Mark buffer_{self_,}copy as unsafe, don't export them (#1207)

Browse Source
This commit is contained in:
Langston Barrett 2023-04-12 11:42:16 -04:00 committed by GitHub
parent 1b9ffcec74
commit 863a6b8b7c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 241 additions and 201 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
libafl/src/mutators/encoded_mutations.rs
View File

@ -241,10 +241,12 @@ where
input.codes_mut().resize(size + len, 0); input.codes_mut().resize(size + len, 0);
self.tmp_buf.resize(len, 0); self.tmp_buf.resize(len, 0);
buffer_copy(&mut self.tmp_buf, input.codes(), from, 0, len); unsafe {
buffer_copy(&mut self.tmp_buf, input.codes(), from, 0, len);
buffer_self_copy(input.codes_mut(), off, off + len, size - off); buffer_self_copy(input.codes_mut(), off, off + len, size - off);
buffer_copy(input.codes_mut(), &self.tmp_buf, 0, off, len); buffer_copy(input.codes_mut(), &self.tmp_buf, 0, off, len);
};
Ok(MutationResult::Mutated) Ok(MutationResult::Mutated)
} }
@ -284,7 +286,9 @@ impl<S: HasRand> Mutator<EncodedInput, S> for EncodedCopyMutator {
let to = state.rand_mut().below(size as u64) as usize; let to = state.rand_mut().below(size as u64) as usize;
let len = 1 + state.rand_mut().below((size - max(from, to)) as u64) as usize; let len = 1 + state.rand_mut().below((size - max(from, to)) as u64) as usize;
buffer_self_copy(input.codes_mut(), from, to, len); unsafe {
buffer_self_copy(input.codes_mut(), from, to, len);
}
Ok(MutationResult::Mutated) Ok(MutationResult::Mutated)
} }
@ -356,8 +360,10 @@ where
} }
input.codes_mut().resize(size + len, 0); input.codes_mut().resize(size + len, 0);
buffer_self_copy(input.codes_mut(), to, to + len, size - to); unsafe {
buffer_copy(input.codes_mut(), other.codes(), from, to, len); buffer_self_copy(input.codes_mut(), to, to + len, size - to);
buffer_copy(input.codes_mut(), other.codes(), from, to, len);
}
Ok(MutationResult::Mutated) Ok(MutationResult::Mutated)
} }
@ -422,7 +428,9 @@ where
let mut other_testcase = state.corpus().get(idx)?.borrow_mut(); let mut other_testcase = state.corpus().get(idx)?.borrow_mut();
let other = other_testcase.load_input()?; let other = other_testcase.load_input()?;
buffer_copy(input.codes_mut(), other.codes(), from, to, len); unsafe {
buffer_copy(input.codes_mut(), other.codes(), from, to, len);
}
Ok(MutationResult::Mutated) Ok(MutationResult::Mutated)
} }

366
libafl/src/mutators/mutations.rs
View File

@ -15,7 +15,7 @@ use crate::{
/// Mem move in the own vec /// Mem move in the own vec
#[inline] #[inline]
pub fn buffer_self_copy<T>(data: &mut [T], from: usize, to: usize, len: usize) { pub(crate) unsafe fn buffer_self_copy<T>(data: &mut [T], from: usize, to: usize, len: usize) {
debug_assert!(!data.is_empty()); debug_assert!(!data.is_empty());
debug_assert!(from + len <= data.len()); debug_assert!(from + len <= data.len());
debug_assert!(to + len <= data.len()); debug_assert!(to + len <= data.len());
@ -29,7 +29,7 @@ pub fn buffer_self_copy<T>(data: &mut [T], from: usize, to: usize, len: usize) {
/// Mem move between vecs /// Mem move between vecs
#[inline] #[inline]
pub fn buffer_copy<T>(dst: &mut [T], src: &[T], from: usize, to: usize, len: usize) { pub(crate) unsafe fn buffer_copy<T>(dst: &mut [T], src: &[T], from: usize, to: usize, len: usize) {
debug_assert!(!dst.is_empty()); debug_assert!(!dst.is_empty());
debug_assert!(!src.is_empty()); debug_assert!(!src.is_empty());
debug_assert!(from + len <= src.len()); debug_assert!(from + len <= src.len());
@ -538,12 +538,14 @@ where
let range = rand_range(state, size, min(16, max_size - size)); let range = rand_range(state, size, min(16, max_size - size));
input.bytes_mut().resize(size + range.len(), 0); input.bytes_mut().resize(size + range.len(), 0);
buffer_self_copy( unsafe {
input.bytes_mut(), buffer_self_copy(
range.start, input.bytes_mut(),
range.start + range.len(), range.start,
size - range.start, range.start + range.len(),
); size - range.start,
);
}
Ok(MutationResult::Mutated) Ok(MutationResult::Mutated)
} }
@ -598,7 +600,9 @@ where
let val = input.bytes()[state.rand_mut().below(size as u64) as usize]; let val = input.bytes()[state.rand_mut().below(size as u64) as usize];
input.bytes_mut().resize(size + amount, 0); input.bytes_mut().resize(size + amount, 0);
buffer_self_copy(input.bytes_mut(), offset, offset + amount, size - offset); unsafe {
buffer_self_copy(input.bytes_mut(), offset, offset + amount, size - offset);
}
buffer_set(input.bytes_mut(), offset, amount, val); buffer_set(input.bytes_mut(), offset, amount, val);
Ok(MutationResult::Mutated) Ok(MutationResult::Mutated)
@ -654,7 +658,9 @@ where
let val = state.rand_mut().next() as u8; let val = state.rand_mut().next() as u8;
input.bytes_mut().resize(size + amount, 0); input.bytes_mut().resize(size + amount, 0);
buffer_self_copy(input.bytes_mut(), offset, offset + amount, size - offset); unsafe {
buffer_self_copy(input.bytes_mut(), offset, offset + amount, size - offset);
}
buffer_set(input.bytes_mut(), offset, amount, val); buffer_set(input.bytes_mut(), offset, amount, val);
Ok(MutationResult::Mutated) Ok(MutationResult::Mutated)
@ -784,7 +790,9 @@ where
let target = state.rand_mut().below(size as u64) as usize; let target = state.rand_mut().below(size as u64) as usize;
let range = rand_range(state, size, size - target); let range = rand_range(state, size, size - target);
buffer_self_copy(input.bytes_mut(), range.start, target, range.len()); unsafe {
buffer_self_copy(input.bytes_mut(), range.start, target, range.len());
}
Ok(MutationResult::Mutated) Ok(MutationResult::Mutated)
} }
@ -833,21 +841,23 @@ where
input.bytes_mut().resize(size + range.len(), 0); input.bytes_mut().resize(size + range.len(), 0);
self.tmp_buf.resize(range.len(), 0); self.tmp_buf.resize(range.len(), 0);
buffer_copy( unsafe {
&mut self.tmp_buf, buffer_copy(
input.bytes(), &mut self.tmp_buf,
range.start, input.bytes(),
0, range.start,
range.len(), 0,
); range.len(),
);
buffer_self_copy( buffer_self_copy(
input.bytes_mut(), input.bytes_mut(),
target, target,
target + range.len(), target + range.len(),
size - target, size - target,
); );
buffer_copy(input.bytes_mut(), &self.tmp_buf, 0, target, range.len()); buffer_copy(input.bytes_mut(), &self.tmp_buf, 0, target, range.len());
}
Ok(MutationResult::Mutated) Ok(MutationResult::Mutated)
} }
} }
@ -895,79 +905,81 @@ where
let second = rand_range(state, first.start, first.start); let second = rand_range(state, first.start, first.start);
self.tmp_buf.resize(first.len(), 0); self.tmp_buf.resize(first.len(), 0);
// If range first is larger unsafe {
if first.len() >= second.len() { // If range first is larger
let diff_in_size = first.len() - second.len(); if first.len() >= second.len() {
let diff_in_size = first.len() - second.len();
// copy first range to tmp // copy first range to tmp
buffer_copy( buffer_copy(
&mut self.tmp_buf, &mut self.tmp_buf,
input.bytes(), input.bytes(),
first.start, first.start,
0, 0,
first.len(), first.len(),
); );
// adjust second.end..first.start, move them by diff_in_size to the right // adjust second.end..first.start, move them by diff_in_size to the right
buffer_self_copy( buffer_self_copy(
input.bytes_mut(), input.bytes_mut(),
second.end, second.end,
second.end + diff_in_size, second.end + diff_in_size,
first.start - second.end, first.start - second.end,
); );
// copy second to where first was // copy second to where first was
buffer_self_copy( buffer_self_copy(
input.bytes_mut(), input.bytes_mut(),
second.start, second.start,
first.start + diff_in_size, first.start + diff_in_size,
second.len(), second.len(),
); );
// copy first back // copy first back
buffer_copy( buffer_copy(
input.bytes_mut(), input.bytes_mut(),
&self.tmp_buf, &self.tmp_buf,
0, 0,
second.start, second.start,
first.len(), first.len(),
); );
} else { } else {
let diff_in_size = second.len() - first.len(); let diff_in_size = second.len() - first.len();
// copy first range to tmp // copy first range to tmp
buffer_copy( buffer_copy(
&mut self.tmp_buf, &mut self.tmp_buf,
input.bytes(), input.bytes(),
first.start, first.start,
0, 0,
first.len(), first.len(),
); );
// adjust second.end..first.start, move them by diff_in_size to the left // adjust second.end..first.start, move them by diff_in_size to the left
buffer_self_copy( buffer_self_copy(
input.bytes_mut(), input.bytes_mut(),
second.end, second.end,
second.end - diff_in_size, second.end - diff_in_size,
first.start - second.end, first.start - second.end,
); );
// copy second to where first was // copy second to where first was
buffer_self_copy( buffer_self_copy(
input.bytes_mut(), input.bytes_mut(),
second.start, second.start,
first.start - diff_in_size, first.start - diff_in_size,
second.len(), second.len(),
); );
// copy first back // copy first back
buffer_copy( buffer_copy(
input.bytes_mut(), input.bytes_mut(),
&self.tmp_buf, &self.tmp_buf,
0, 0,
second.start, second.start,
first.len(), first.len(),
); );
}
} }
Ok(MutationResult::Mutated) Ok(MutationResult::Mutated)
} else if first.end != size { } else if first.end != size {
@ -977,76 +989,78 @@ where
second.end += first.end; second.end += first.end;
self.tmp_buf.resize(second.len(), 0); self.tmp_buf.resize(second.len(), 0);
if second.len() >= first.len() { unsafe {
let diff_in_size = second.len() - first.len(); if second.len() >= first.len() {
// copy second range to tmp let diff_in_size = second.len() - first.len();
buffer_copy( // copy second range to tmp
&mut self.tmp_buf, buffer_copy(
input.bytes(), &mut self.tmp_buf,
second.start, input.bytes(),
0, second.start,
second.len(), 0,
); second.len(),
);
// adjust first.end..second.start, move them by diff_in_size to the right // adjust first.end..second.start, move them by diff_in_size to the right
buffer_self_copy( buffer_self_copy(
input.bytes_mut(), input.bytes_mut(),
first.end, first.end,
first.end + diff_in_size, first.end + diff_in_size,
second.start - first.end, second.start - first.end,
); );
// copy first to where second was // copy first to where second was
buffer_self_copy( buffer_self_copy(
input.bytes_mut(), input.bytes_mut(),
first.start, first.start,
second.start + diff_in_size, second.start + diff_in_size,
first.len(), first.len(),
); );
// copy second back // copy second back
buffer_copy( buffer_copy(
input.bytes_mut(), input.bytes_mut(),
&self.tmp_buf, &self.tmp_buf,
0, 0,
first.start, first.start,
second.len(), second.len(),
); );
} else { } else {
let diff_in_size = first.len() - second.len(); let diff_in_size = first.len() - second.len();
// copy second range to tmp // copy second range to tmp
buffer_copy( buffer_copy(
&mut self.tmp_buf, &mut self.tmp_buf,
input.bytes(), input.bytes(),
second.start, second.start,
0, 0,
second.len(), second.len(),
); );
// adjust first.end..second.start, move them by diff_in_size to the left // adjust first.end..second.start, move them by diff_in_size to the left
buffer_self_copy( buffer_self_copy(
input.bytes_mut(), input.bytes_mut(),
first.end, first.end,
first.end - diff_in_size, first.end - diff_in_size,
second.start - first.end, second.start - first.end,
); );
// copy first to where second was // copy first to where second was
buffer_self_copy( buffer_self_copy(
input.bytes_mut(), input.bytes_mut(),
first.start, first.start,
second.start - diff_in_size, second.start - diff_in_size,
first.len(), first.len(),
); );
// copy second back // copy second back
buffer_copy( buffer_copy(
input.bytes_mut(), input.bytes_mut(),
&self.tmp_buf, &self.tmp_buf,
0, 0,
first.start, first.start,
second.len(), second.len(),
); );
}
} }
Ok(MutationResult::Mutated) Ok(MutationResult::Mutated)
@ -1118,19 +1132,21 @@ where
let other = other_testcase.load_input()?; let other = other_testcase.load_input()?;
input.bytes_mut().resize(size + range.len(), 0); input.bytes_mut().resize(size + range.len(), 0);
buffer_self_copy( unsafe {
input.bytes_mut(), buffer_self_copy(
target, input.bytes_mut(),
target + range.len(), target,
size - target, target + range.len(),
); size - target,
buffer_copy( );
input.bytes_mut(), buffer_copy(
other.bytes(), input.bytes_mut(),
range.start, other.bytes(),
target, range.start,
range.len(), target,
); range.len(),
);
}
Ok(MutationResult::Mutated) Ok(MutationResult::Mutated)
} }
} }
@ -1194,13 +1210,15 @@ where
let mut other_testcase = state.corpus().get(idx)?.borrow_mut(); let mut other_testcase = state.corpus().get(idx)?.borrow_mut();
let other = other_testcase.load_input()?; let other = other_testcase.load_input()?;
buffer_copy( unsafe {
input.bytes_mut(), buffer_copy(
other.bytes(), input.bytes_mut(),
range.start, other.bytes(),
target, range.start,
range.len(), target,
); range.len(),
);
}
Ok(MutationResult::Mutated) Ok(MutationResult::Mutated)
} }
} }

22
libafl/src/mutators/token_mutations.rs
View File

@ -329,8 +329,10 @@ where
} }
input.bytes_mut().resize(size + len, 0); input.bytes_mut().resize(size + len, 0);
buffer_self_copy(input.bytes_mut(), off, off + len, size - off); unsafe {
buffer_copy(input.bytes_mut(), token, 0, off, len); buffer_self_copy(input.bytes_mut(), off, off + len, size - off);
buffer_copy(input.bytes_mut(), token, 0, off, len);
}
Ok(MutationResult::Mutated) Ok(MutationResult::Mutated)
} }
@ -392,7 +394,9 @@ where
len = size - off; len = size - off;
} }
buffer_copy(input.bytes_mut(), token, 0, off, len); unsafe {
buffer_copy(input.bytes_mut(), token, 0, off, len);
}
Ok(MutationResult::Mutated) Ok(MutationResult::Mutated)
} }
@ -560,7 +564,9 @@ where
let mut size = core::cmp::min(v.0.len(), len - i); let mut size = core::cmp::min(v.0.len(), len - i);
while size != 0 { while size != 0 {
if v.0[0..size] == input.bytes()[i..i + size] { if v.0[0..size] == input.bytes()[i..i + size] {
buffer_copy(input.bytes_mut(), &v.1, 0, i, size); unsafe {
buffer_copy(input.bytes_mut(), &v.1, 0, i, size);
}
result = MutationResult::Mutated; result = MutationResult::Mutated;
break 'outer; break 'outer;
} }
@ -569,7 +575,9 @@ where
size = core::cmp::min(v.1.len(), len - i); size = core::cmp::min(v.1.len(), len - i);
while size != 0 { while size != 0 {
if v.1[0..size] == input.bytes()[i..i + size] { if v.1[0..size] == input.bytes()[i..i + size] {
buffer_copy(input.bytes_mut(), &v.0, 0, i, size); unsafe {
buffer_copy(input.bytes_mut(), &v.0, 0, i, size);
}
result = MutationResult::Mutated; result = MutationResult::Mutated;
break 'outer; break 'outer;
} }
@ -1037,7 +1045,9 @@ impl AFLppRedQueen {
} }
if copy_len > 0 { if copy_len > 0 {
buffer_copy(buf, repl, 0, buf_idx, copy_len); unsafe {
buffer_copy(buf, repl, 0, buf_idx, copy_len);
}
true true
} else { } else {
false false

32
libafl/src/stages/colorization.rs
View File

@ -202,13 +202,15 @@ where
let range_start = r.start; let range_start = r.start;
let range_end = r.end; let range_end = r.end;
let copy_len = r.len(); let copy_len = r.len();
buffer_copy( unsafe {
input.bytes_mut(), buffer_copy(
changed.bytes(), input.bytes_mut(),
range_start, changed.bytes(),
range_start, range_start,
copy_len, range_start,
); copy_len,
);
}
let consumed_input = input.clone(); let consumed_input = input.clone();
let changed_hash = Self::get_raw_map_hash_run( let changed_hash = Self::get_raw_map_hash_run(
@ -229,13 +231,15 @@ where
// Seems like this range is too big that we can't keep the original hash anymore // Seems like this range is too big that we can't keep the original hash anymore
// Revert the changes // Revert the changes
buffer_copy( unsafe {
input.bytes_mut(), buffer_copy(
backup.bytes(), input.bytes_mut(),
range_start, backup.bytes(),
range_start, range_start,
copy_len, range_start,
); copy_len,
);
}
// Add smaller range // Add smaller range
if copy_len > 1 { if copy_len > 1 {