SYS-OSS/FRET-LibAFL
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixes for multiple subtle bugs with grimoire, mutators, and state (#1001)

Browse Source 
* fix multiple subtle bugs with grimoire, mutators, and state

* obey the clippy overlord

* grimoire: skip over token after splice

* remove extraneous length check
This commit is contained in:
Addison Crump 2023-01-18 13:53:31 +01:00 committed by GitHub
parent 333a51aeaa
commit ebc886032f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 24 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
libafl/src/mutators/grimoire.rs
View File

@ -277,40 +277,46 @@ where
'first: for item in &mut gen[..rand_idx] {
if let GeneralizedItem::Bytes(bytes) = item {
if bytes.len() < token_1.len() {
continue;
}
let mut i = 0;
while i < bytes.len() - token_1.len() {
while bytes
.len()
.checked_sub(token_1.len())
.map_or(false, |len| i < len)
{
if bytes[i..].starts_with(token_1) {
bytes.splice(i..(i + token_1.len()), token_2.clone());
bytes.splice(i..(i + token_1.len()), token_2.iter().copied());
mutated = MutationResult::Mutated;
if stop_at_first {
break 'first;
}
i += token_2.len();
} else {
i += 1;
}
i += 1;
}
}
}
if mutated == MutationResult::Skipped || !stop_at_first {
'second: for item in &mut gen[rand_idx..] {
if let GeneralizedItem::Bytes(bytes) = item {
if bytes.len() < token_1.len() {
continue;
}
let mut i = 0;
while i < bytes.len() - token_1.len() {
while bytes
.len()
.checked_sub(token_1.len())
.map_or(false, |len| i < len)
{
if bytes[i..].starts_with(token_1) {
bytes.splice(i..(i + token_1.len()), token_2.clone());
bytes.splice(i..(i + token_1.len()), token_2.iter().copied());
mutated = MutationResult::Mutated;
if stop_at_first {
break 'second;
}
i += token_2.len();
} else {
i += 1;
}
i += 1;
}
}
}

2
libafl/src/stages/mutational.rs
View File

@ -117,7 +117,7 @@ where
start_timer!(state);
let testcase = state.corpus().get(corpus_idx)?.borrow();
let input = I::try_transform_from(&testcase, state, corpus_idx)?;
let Ok(input) = I::try_transform_from(&testcase, state, corpus_idx) else { return Ok(()); };
drop(testcase);
mark_feature_time!(state, PerfFeature::GetInputFromCorpus);

2
libafl/src/stages/power.rs
View File

@ -83,7 +83,7 @@ where
let num = self.iterations(state, corpus_idx)?;
let testcase = state.corpus().get(corpus_idx)?.borrow();
let input = I::try_transform_from(&testcase, state, corpus_idx)?;
let Ok(input) = I::try_transform_from(&testcase, state, corpus_idx) else { return Ok(()); };
drop(testcase);
for i in 0..num {

4
libafl/src/state/mod.rs
View File

@ -367,6 +367,10 @@ where
for entry in fs::read_dir(in_dir)? {
let entry = entry?;
let path = entry.path();
if path.file_name().unwrap().to_string_lossy().starts_with('.') {
continue;
}
let attributes = fs::metadata(&path);
if attributes.is_err() {