From 86ca7863caf3585709b289e08a5a608659330843 Mon Sep 17 00:00:00 2001
From: Alwin Berger <alwin.berger@tu-dortmund.de>
Date: Sun, 8 May 2022 13:45:10 +0200
Subject: [PATCH] add RandGraphSuffixMutator

---
 fuzzers/wcet_qemu_sys/src/sysstate/graph.rs | 94 ++++++++++++++++++++-
 1 file changed, 92 insertions(+), 2 deletions(-)

diff --git a/fuzzers/wcet_qemu_sys/src/sysstate/graph.rs b/fuzzers/wcet_qemu_sys/src/sysstate/graph.rs
index a9601d0bf0..22e8b63d57 100644
--- a/fuzzers/wcet_qemu_sys/src/sysstate/graph.rs
+++ b/fuzzers/wcet_qemu_sys/src/sysstate/graph.rs
@@ -307,7 +307,7 @@ impl Named for SysMapFeedback
 }
 
 //============================= Mutators
-
+//=============================== Snippets
 pub struct RandGraphSnippetMutator<I, S>
 where
     I: Input + HasBytesVec,
@@ -380,7 +380,7 @@ where
         }
         let mut new_input : Vec<u8> = vec![];
         for c in snippet_collector {
-            new_input.clone_from_slice(myrand.choose(c).1);
+            new_input.extend_from_slice(myrand.choose(c).1);
         }
         for i in new_input.iter().enumerate() {
             input.bytes_mut()[i.0]=*i.1;
@@ -407,4 +407,94 @@ where
     fn name(&self) -> &str {
         "RandGraphSnippetMutator"
     }
+}
+//============================= Mutators
+//=============================== Suffix
+pub struct RandGraphSuffixMutator<I, S>
+where
+    I: Input + HasBytesVec,
+    S: HasRand + HasMetadata + HasCorpus<I> + HasSolutions<I>,
+{
+    phantom: PhantomData<(I, S)>,
+}
+impl<I, S> RandGraphSuffixMutator<I, S>
+where
+    I: Input + HasBytesVec,
+    S: HasRand + HasMetadata + HasCorpus<I> + HasSolutions<I>,
+{
+    pub fn new() -> Self {
+        RandGraphSuffixMutator{phantom: PhantomData}
+    }
+}
+impl<I, S> Mutator<I, S> for RandGraphSuffixMutator<I, S>
+where
+    I: Input + HasBytesVec,
+    S: HasRand + HasMetadata + HasCorpus<I> + HasSolutions<I> + HasFeedbackStates,
+{
+    fn mutate(
+        &mut self, 
+        state: &mut S, 
+        input: &mut I, 
+        _stage_idx: i32
+    ) -> Result<MutationResult, Error>
+    {
+        // need our own random generator, because borrowing rules
+        let mut myrand = StdRand::new();
+        let tmp = &mut state.rand_mut();
+        myrand.set_seed(tmp.next());   
+        drop(tmp);
+
+        let feedbackstate = state
+            .feedback_states()
+            .match_name::<SysGraphFeedbackState>("SysMap")
+            .unwrap();
+        let g = &feedbackstate.graph;
+        let tmp = state.metadata().get::<SysGraphMetadata>();
+        if tmp.is_none() {  // if there are no metadata it was probably not interesting anyways
+            return Ok(MutationResult::Skipped);
+        }
+        let trace =tmp.expect("SysGraphMetadata not found");
+        // follow the path, extract snippets from last reads, find common snippets.
+        // those are likley keys parts. choose random parts from other sibling traces
+        let inp_c_end = g[*trace.inner.last().unwrap()].base.input_counter;
+        let mut num_to_reverse = 1;
+        for t in trace.inner.iter().rev() {
+            let int_c_prefix = g[*t].base.input_counter;
+            if int_c_prefix < inp_c_end {
+                num_to_reverse-=1;
+                if num_to_reverse<=0 {
+                    let mut new_input=input.bytes()[..(int_c_prefix as usize)].to_vec();
+                    let mut ext : Vec<u8> = (int_c_prefix..inp_c_end).map(|_| myrand.next().to_le_bytes()).flatten().collect();
+                    new_input.append(&mut ext);
+                    for i in new_input.iter().enumerate() {
+                        if input.bytes_mut().len()>i.0 {
+                            input.bytes_mut()[i.0]=*i.1;
+                        }
+                        else { break };
+                    }
+                    break;
+                }
+            }
+        }
+        Ok(MutationResult::Mutated)
+    }
+
+    fn post_exec(
+        &mut self, 
+        _state: &mut S, 
+        _stage_idx: i32, 
+        _corpus_idx: Option<usize>
+    ) -> Result<(), Error> {
+        Ok(())
+    }
+}
+
+impl<I, S> Named for RandGraphSuffixMutator<I, S>
+where
+    I: Input + HasBytesVec,
+    S: HasRand + HasMetadata + HasCorpus<I> + HasSolutions<I> + HasFeedbackStates,
+{
+    fn name(&self) -> &str {
+        "RandGraphSuffixMutator"
+    }
 }
\ No newline at end of file