SYS-OSS/FRET-LibAFL
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Mark buffer_{self_,}copy as unsafe, don't export them (#1207)

Browse Source
This commit is contained in:
Langston Barrett 2023-04-12 11:42:16 -04:00 committed by GitHub
parent 1b9ffcec74
commit 863a6b8b7c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 241 additions and 201 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libafl/src/mutators/encoded_mutations.rs
View File

@ -241,10 +241,12 @@ where
input.codes_mut().resize(size + len, 0);
self.tmp_buf.resize(len, 0);
unsafe {
buffer_copy(&mut self.tmp_buf, input.codes(), from, 0, len);
buffer_self_copy(input.codes_mut(), off, off + len, size - off);
buffer_copy(input.codes_mut(), &self.tmp_buf, 0, off, len);
};
Ok(MutationResult::Mutated)
}
@ -284,7 +286,9 @@ impl<S: HasRand> Mutator<EncodedInput, S> for EncodedCopyMutator {
let to = state.rand_mut().below(size as u64) as usize;
let len = 1 + state.rand_mut().below((size - max(from, to)) as u64) as usize;
unsafe {
buffer_self_copy(input.codes_mut(), from, to, len);
}
Ok(MutationResult::Mutated)
}
@ -356,8 +360,10 @@ where
}
input.codes_mut().resize(size + len, 0);
unsafe {
buffer_self_copy(input.codes_mut(), to, to + len, size - to);
buffer_copy(input.codes_mut(), other.codes(), from, to, len);
}
Ok(MutationResult::Mutated)
}
@ -422,7 +428,9 @@ where
let mut other_testcase = state.corpus().get(idx)?.borrow_mut();
let other = other_testcase.load_input()?;
unsafe {
buffer_copy(input.codes_mut(), other.codes(), from, to, len);
}
Ok(MutationResult::Mutated)
}

22
libafl/src/mutators/mutations.rs
View File

@ -15,7 +15,7 @@ use crate::{
/// Mem move in the own vec
#[inline]
pub fn buffer_self_copy<T>(data: &mut [T], from: usize, to: usize, len: usize) {
pub(crate) unsafe fn buffer_self_copy<T>(data: &mut [T], from: usize, to: usize, len: usize) {
debug_assert!(!data.is_empty());
debug_assert!(from + len <= data.len());
debug_assert!(to + len <= data.len());
@ -29,7 +29,7 @@ pub fn buffer_self_copy<T>(data: &mut [T], from: usize, to: usize, len: usize) {
/// Mem move between vecs
#[inline]
pub fn buffer_copy<T>(dst: &mut [T], src: &[T], from: usize, to: usize, len: usize) {
pub(crate) unsafe fn buffer_copy<T>(dst: &mut [T], src: &[T], from: usize, to: usize, len: usize) {
debug_assert!(!dst.is_empty());
debug_assert!(!src.is_empty());
debug_assert!(from + len <= src.len());
@ -538,12 +538,14 @@ where
let range = rand_range(state, size, min(16, max_size - size));
input.bytes_mut().resize(size + range.len(), 0);
unsafe {
buffer_self_copy(
input.bytes_mut(),
range.start,
range.start + range.len(),
size - range.start,
);
}
Ok(MutationResult::Mutated)
}
@ -598,7 +600,9 @@ where
let val = input.bytes()[state.rand_mut().below(size as u64) as usize];
input.bytes_mut().resize(size + amount, 0);
unsafe {
buffer_self_copy(input.bytes_mut(), offset, offset + amount, size - offset);
}
buffer_set(input.bytes_mut(), offset, amount, val);
Ok(MutationResult::Mutated)
@ -654,7 +658,9 @@ where
let val = state.rand_mut().next() as u8;
input.bytes_mut().resize(size + amount, 0);
unsafe {
buffer_self_copy(input.bytes_mut(), offset, offset + amount, size - offset);
}
buffer_set(input.bytes_mut(), offset, amount, val);
Ok(MutationResult::Mutated)
@ -784,7 +790,9 @@ where
let target = state.rand_mut().below(size as u64) as usize;
let range = rand_range(state, size, size - target);
unsafe {
buffer_self_copy(input.bytes_mut(), range.start, target, range.len());
}
Ok(MutationResult::Mutated)
}
@ -833,6 +841,7 @@ where
input.bytes_mut().resize(size + range.len(), 0);
self.tmp_buf.resize(range.len(), 0);
unsafe {
buffer_copy(
&mut self.tmp_buf,
input.bytes(),
@ -848,6 +857,7 @@ where
size - target,
);
buffer_copy(input.bytes_mut(), &self.tmp_buf, 0, target, range.len());
}
Ok(MutationResult::Mutated)
}
}
@ -895,6 +905,7 @@ where
let second = rand_range(state, first.start, first.start);
self.tmp_buf.resize(first.len(), 0);
unsafe {
// If range first is larger
if first.len() >= second.len() {
let diff_in_size = first.len() - second.len();
@ -969,6 +980,7 @@ where
first.len(),
);
}
}
Ok(MutationResult::Mutated)
} else if first.end != size {
// The first range comes before the second range
@ -977,6 +989,7 @@ where
second.end += first.end;
self.tmp_buf.resize(second.len(), 0);
unsafe {
if second.len() >= first.len() {
let diff_in_size = second.len() - first.len();
// copy second range to tmp
@ -1048,6 +1061,7 @@ where
second.len(),
);
}
}
Ok(MutationResult::Mutated)
} else {
@ -1118,6 +1132,7 @@ where
let other = other_testcase.load_input()?;
input.bytes_mut().resize(size + range.len(), 0);
unsafe {
buffer_self_copy(
input.bytes_mut(),
target,
@ -1131,6 +1146,7 @@ where
target,
range.len(),
);
}
Ok(MutationResult::Mutated)
}
}
@ -1194,6 +1210,7 @@ where
let mut other_testcase = state.corpus().get(idx)?.borrow_mut();
let other = other_testcase.load_input()?;
unsafe {
buffer_copy(
input.bytes_mut(),
other.bytes(),
@ -1201,6 +1218,7 @@ where
target,
range.len(),
);
}
Ok(MutationResult::Mutated)
}
}

10
libafl/src/mutators/token_mutations.rs
View File

@ -329,8 +329,10 @@ where
}
input.bytes_mut().resize(size + len, 0);
unsafe {
buffer_self_copy(input.bytes_mut(), off, off + len, size - off);
buffer_copy(input.bytes_mut(), token, 0, off, len);
}
Ok(MutationResult::Mutated)
}
@ -392,7 +394,9 @@ where
len = size - off;
}
unsafe {
buffer_copy(input.bytes_mut(), token, 0, off, len);
}
Ok(MutationResult::Mutated)
}
@ -560,7 +564,9 @@ where
let mut size = core::cmp::min(v.0.len(), len - i);
while size != 0 {
if v.0[0..size] == input.bytes()[i..i + size] {
unsafe {
buffer_copy(input.bytes_mut(), &v.1, 0, i, size);
}
result = MutationResult::Mutated;
break 'outer;
}
@ -569,7 +575,9 @@ where
size = core::cmp::min(v.1.len(), len - i);
while size != 0 {
if v.1[0..size] == input.bytes()[i..i + size] {
unsafe {
buffer_copy(input.bytes_mut(), &v.0, 0, i, size);
}
result = MutationResult::Mutated;
break 'outer;
}
@ -1037,7 +1045,9 @@ impl AFLppRedQueen {
}
if copy_len > 0 {
unsafe {
buffer_copy(buf, repl, 0, buf_idx, copy_len);
}
true
} else {
false

4
libafl/src/stages/colorization.rs
View File

@ -202,6 +202,7 @@ where
let range_start = r.start;
let range_end = r.end;
let copy_len = r.len();
unsafe {
buffer_copy(
input.bytes_mut(),
changed.bytes(),
@ -209,6 +210,7 @@ where
range_start,
copy_len,
);
}
let consumed_input = input.clone();
let changed_hash = Self::get_raw_map_hash_run(
@ -229,6 +231,7 @@ where
// Seems like this range is too big that we can't keep the original hash anymore
// Revert the changes
unsafe {
buffer_copy(
input.bytes_mut(),
backup.bytes(),
@ -236,6 +239,7 @@ where
range_start,
copy_len,
);
}
// Add smaller range
if copy_len > 1 {