SYS-OSS/FRET-LibAFL
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Make calibration stage independent of powerschedules (#589)

Browse Source 
* fix

* clippy
This commit is contained in:
Dongjia Zhang 2022-04-05 01:02:16 +09:00 committed by GitHub
parent e77e147a74
commit f732b76115
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 60 additions and 61 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
libafl/src/corpus/testcase.rs
View File

@ -31,6 +31,8 @@ where
cached_len: Option<usize>,
/// Number of executions done at discovery time
executions: usize,
/// Number of fuzzing iterations of this particular input updated in perform_mutational
fuzz_level: usize,
/// If it has been fuzzed
fuzzed: bool,
}
@ -154,6 +156,18 @@ where
&mut self.executions
}
/// Get the `fuzz_level`
#[inline]
pub fn fuzz_level(&self) -> usize {
self.fuzz_level
}
/// Set the `fuzz_level`
#[inline]
pub fn set_fuzz_leve(&mut self, fuzz_level: usize) {
self.fuzz_level = fuzz_level;
}
/// Get if it was fuzzed
#[inline]
pub fn fuzzed(&self) -> bool {
@ -216,6 +230,7 @@ where
metadata: SerdeAnyMap::new(),
exec_time: None,
cached_len: None,
fuzz_level: 0,
executions: 0,
fuzzed: false,
}
@ -264,8 +279,6 @@ where
pub struct PowerScheduleTestcaseMetaData {
/// Number of bits set in bitmap, updated in calibrate_case
bitmap_size: u64,
/// Number of fuzzing iterations, updated in perform_mutational
fuzz_level: u64,
/// Number of queue cycles behind
handicap: u64,
/// Path depth, initialized in on_add
@ -280,7 +293,6 @@ impl PowerScheduleTestcaseMetaData {
pub fn new(depth: u64) -> Self {
Self {
bitmap_size: 0,
fuzz_level: 0,
handicap: 0,
depth,
n_fuzz_entry: 0,
@ -298,17 +310,6 @@ impl PowerScheduleTestcaseMetaData {
self.bitmap_size = val;
}
/// Get the fuzz level
#[must_use]
pub fn fuzz_level(&self) -> u64 {
self.fuzz_level
}
/// Set the fuzz level
pub fn set_fuzz_level(&mut self, val: u64) {
self.fuzz_level = val;
}
/// Get the handicap
#[must_use]
pub fn handicap(&self) -> u64 {

13
libafl/src/schedulers/testcase_score.rs
View File

@ -73,7 +73,8 @@ where
#[allow(
clippy::cast_precision_loss,
clippy::too_many_lines,
clippy::cast_sign_loss
clippy::cast_sign_loss,
clippy::cast_lossless
)]
fn compute(entry: &mut Testcase<I>, state: &S) -> Result<f64, Error> {
let psmeta = state
@ -195,7 +196,7 @@ where
}
}
PowerSchedule::FAST => {
if tcmeta.fuzz_level() != 0 {
if entry.fuzz_level() != 0 {
let lg = libm::log2(f64::from(psmeta.n_fuzz()[tcmeta.n_fuzz_entry()]));
match lg {
@ -234,11 +235,11 @@ where
}
}
PowerSchedule::LIN => {
factor = (tcmeta.fuzz_level() as f64)
factor = (entry.fuzz_level() as f64)
/ f64::from(psmeta.n_fuzz()[tcmeta.n_fuzz_entry()] + 1);
}
PowerSchedule::QUAD => {
factor = ((tcmeta.fuzz_level() * tcmeta.fuzz_level()) as f64)
factor = ((entry.fuzz_level() * entry.fuzz_level()) as f64)
/ f64::from(psmeta.n_fuzz()[tcmeta.n_fuzz_entry()] + 1);
}
}
@ -297,7 +298,7 @@ where
// This means that this testcase has never gone through the calibration stage before1,
// In this case we'll just return the default weight
if tcmeta.fuzz_level() == 0 || psmeta.cycles() == 0 {
if entry.fuzz_level() == 0 || psmeta.cycles() == 0 {
return Ok(weight);
}
@ -344,7 +345,7 @@ where
}
// was it fuzzed before?
if tcmeta.fuzz_level() == 0 {
if entry.fuzz_level() == 0 {
weight *= 2.0;
}

79
libafl/src/stages/calibrate.rs
View File

@ -59,27 +59,12 @@ where
corpus_idx: usize,
) -> Result<(), Error> {
// Run this stage only once for each corpus entry
if state
.corpus()
.get(corpus_idx)?
.borrow_mut()
.metadata()
.get::<PowerScheduleTestcaseMetaData>()
.ok_or_else(|| {
Error::KeyNotFound("PowerScheduleTescaseMetatdata not found".to_string())
})?
.fuzz_level()
> 0
{
if state.corpus().get(corpus_idx)?.borrow_mut().fuzz_level() > 0 {
return Ok(());
}
let mut iter = self.stage_max;
let handicap = state
.metadata()
.get::<PowerScheduleMetadata>()
.ok_or_else(|| Error::KeyNotFound("PowerScheduleMetadata not found".to_string()))?
.queue_cycles();
let input = state
.corpus()
.get(corpus_idx)?
@ -175,36 +160,48 @@ where
}
};
let psmeta = state
.metadata_mut()
.get_mut::<PowerScheduleMetadata>()
.ok_or_else(|| Error::KeyNotFound("PowerScheduleMetadata not found".to_string()))?;
// If power schedule is used, update it
let use_powerschedule = state.has_metadata::<PowerScheduleMetadata>()
&& state
.corpus()
.get(corpus_idx)?
.borrow()
.has_metadata::<PowerScheduleTestcaseMetaData>();
let map = executor
.observers()
.match_name::<O>(&self.map_observer_name)
.ok_or_else(|| Error::KeyNotFound("MapObserver not found".to_string()))?;
if use_powerschedule {
let map = executor
.observers()
.match_name::<O>(&self.map_observer_name)
.ok_or_else(|| Error::KeyNotFound("MapObserver not found".to_string()))?;
let bitmap_size = map.count_bytes();
let bitmap_size = map.count_bytes();
psmeta.set_exec_time(psmeta.exec_time() + total_time);
psmeta.set_cycles(psmeta.cycles() + (iter as u64));
psmeta.set_bitmap_size(psmeta.bitmap_size() + bitmap_size);
psmeta.set_bitmap_entries(psmeta.bitmap_entries() + 1);
let psmeta = state
.metadata_mut()
.get_mut::<PowerScheduleMetadata>()
.unwrap();
let handicap = psmeta.queue_cycles();
let mut testcase = state.corpus().get(corpus_idx)?.borrow_mut();
psmeta.set_exec_time(psmeta.exec_time() + total_time);
psmeta.set_cycles(psmeta.cycles() + (iter as u64));
psmeta.set_bitmap_size(psmeta.bitmap_size() + bitmap_size);
psmeta.set_bitmap_entries(psmeta.bitmap_entries() + 1);
testcase.set_exec_time(total_time / (iter as u32));
// println!("time: {:#?}", testcase.exec_time());
let data = testcase
.metadata_mut()
.get_mut::<PowerScheduleTestcaseMetaData>()
.ok_or_else(|| Error::KeyNotFound("PowerScheduleTestData not found".to_string()))?;
let mut testcase = state.corpus().get(corpus_idx)?.borrow_mut();
let fuzz_level = testcase.fuzz_level();
data.set_bitmap_size(bitmap_size);
data.set_handicap(handicap);
data.set_fuzz_level(data.fuzz_level() + 1);
// println!("data: {:#?}", data);
testcase.set_exec_time(total_time / (iter as u32));
testcase.set_fuzz_leve(fuzz_level + 1);
// println!("time: {:#?}", testcase.exec_time());
let data = testcase
.metadata_mut()
.get_mut::<PowerScheduleTestcaseMetaData>()
.ok_or_else(|| Error::KeyNotFound("PowerScheduleTestData not found".to_string()))?;
data.set_bitmap_size(bitmap_size);
data.set_handicap(handicap);
}
Ok(())
}