add TimeoutFeedback and send ExitKind::Timeout from the handler

fuzzers/libfuzzer_libpng/harness.cc

@@ -17,7 +17,6 @@
 #include <stddef.h>
 #include <stdint.h>
 #include <string.h>
-#include <unistd.h>
 
 #include <vector>
 
@@ -84,7 +83,6 @@ static const int kPngHeaderSize = 8;
 // Roughly follows the libpng book example:
 // http://www.libpng.org/pub/png/book/chapter13.html
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
-  sleep(3);
   if (size < kPngHeaderSize) {
     return 0;
   }

fuzzers/libfuzzer_libpng/src/fuzzer.rs

@@ -11,7 +11,7 @@ use libafl::{
         QueueCorpusScheduler,
     },
     events::setup_restarting_mgr,
-    executors::{inprocess::InProcessExecutor, Executor, ExitKind, inprocess::TimeoutExecutor},
+    executors::{inprocess::InProcessExecutor, Executor, ExitKind},
     feedbacks::{CrashFeedback, MaxMapFeedback, TimeFeedback},
     fuzzer::{Fuzzer, HasCorpusScheduler, StdFuzzer},
     inputs::Input,
@@ -150,7 +150,7 @@ fn fuzz(corpus_dirs: Vec<PathBuf>, objective_dir: PathBuf, broker_port: u16) ->
         &mut state,
         &mut restarting_mgr,
     )?;
-    let mut tmexecutor = TimeoutExecutor::new(executor, 2);
+
     // The actual target run starts here.
     // Call LLVMFUzzerInitialize() if present.
     unsafe {
@@ -163,7 +163,7 @@ fn fuzz(corpus_dirs: Vec<PathBuf>, objective_dir: PathBuf, broker_port: u16) ->
     if state.corpus().count() < 1 {
         state
             .load_initial_inputs(
-                &mut tmexecutor,
+                &mut executor,
                 &mut restarting_mgr,
                 fuzzer.scheduler(),
                 &corpus_dirs,
@@ -175,7 +175,7 @@ fn fuzz(corpus_dirs: Vec<PathBuf>, objective_dir: PathBuf, broker_port: u16) ->
         println!("We imported {} inputs from disk.", state.corpus().count());
     }
 
-    fuzzer.fuzz_loop(&mut state, &mut tmexecutor, &mut restarting_mgr)?;
+    fuzzer.fuzz_loop(&mut state, &mut executor, &mut restarting_mgr)?;
 
     // Never reached
     Ok(())

libafl/src/executors/inprocess.rs

@@ -257,7 +257,12 @@ where
     OT: ObserversTuple,
 {
     #[inline]
-    fn pre_exec<EM: EventManager<I, S>, S>(&mut self, _state: &mut S, _event_mgr: &mut EM, _input: &I,) -> Result<(), Error>{
+    fn pre_exec<EM: EventManager<I, S>, S>(
+        &mut self,
+        _state: &mut S,
+        _event_mgr: &mut EM,
+        _input: &I,
+    ) -> Result<(), Error> {
         unsafe {
             let milli_sec = self.exec_tmout.as_millis();
             let it_value = Timeval {
@@ -281,7 +286,6 @@ where
     }
 
     fn run_target(&mut self, input: &I) -> Result<ExitKind, Error> {
-
         let run_result = self.executor.run_target(input);
         unsafe {
             let it_value = Timeval {
@@ -305,7 +309,6 @@ where
     }
 }
 
-
 #[cfg(unix)]
 mod unix_signal_handler {
     use alloc::vec::Vec;
@@ -373,9 +376,7 @@ mod unix_signal_handler {
                     Signal::SigUser2 | Signal::SigAlarm => {
                         (data.timeout_handler)(signal, info, void, data)
                     },
-                    _ => {
+                    _ => (data.crash_handler)(signal, info, void, data),
-                        (data.crash_handler)(signal, info, void, data)
-                    },
                 }
             }
         }
@@ -426,7 +427,7 @@ mod unix_signal_handler {
 
             let obj_fitness = state
                 .objectives_mut()
-                .is_interesting_all(&input, observers, ExitKind::Crash)
+                .is_interesting_all(&input, observers, ExitKind::Timeout)
                 .expect("In timeout handler objectives failure.");
             if obj_fitness > 0 {
                 state

libafl/src/feedbacks/mod.rs

@@ -157,6 +157,46 @@ impl Default for CrashFeedback {
     }
 }
 
+#[derive(Serialize, Deserialize, Clone, Debug)]
+pub struct TimeoutFeedback {}
+
+impl<I> Feedback<I> for TimeoutFeedback
+where
+    I: Input,
+{
+    fn is_interesting<OT: ObserversTuple>(
+        &mut self,
+        _input: &I,
+        _observers: &OT,
+        exit_kind: ExitKind,
+    ) -> Result<u32, Error> {
+        if exit_kind == ExitKind::Timeout {
+            Ok(1)
+        } else {
+            Ok(0)
+        }
+    }
+}
+
+impl Named for TimeoutFeedback {
+    #[inline]
+    fn name(&self) -> &str {
+        "TimeoutFeedback"
+    }
+}
+
+impl TimeoutFeedback {
+    pub fn new() -> Self {
+        Self {}
+    }
+}
+
+impl Default for TimeoutFeedback {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 /// Nop feedback that annotates execution time in the new testcase, if any
 #[derive(Serialize, Deserialize, Clone, Debug)]
 pub struct TimeFeedback {