SYS-OSS/FRET-LibAFL
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix out of bounds interrupt mutation

Browse Source
This commit is contained in:
Alwin Berger 2024-09-17 17:09:48 +02:00
parent a9ce2d787b
commit fb3837f725
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
fuzzers/FRET/src/systemstate/mutational.rs
View File

@ -88,8 +88,13 @@ pub fn try_force_new_branches(interrupt_ticks : &[u32], fbs: &STGFeedbackState,
if !(exec_interval.start_capture.0==CaptureEvent::ISRStart) { // shortcut to skip interrupt handers without node lookup
let node_index = fbs.state_abb_hash_index.get(&exec_interval.get_hash_index()).unwrap();
if !has_interrupt_handler_non_systick(&fbs.graph, node_index.clone()) {
new_interrupt_times.push((exec_interval.start_tick.saturating_add((exec_interval.end_tick+exec_interval.start_tick)/4)).try_into().expect("ticks > u32"));
new_interrupt_times.append(interrupt_ticks[num+2..].to_vec().as_mut());
let new_time = exec_interval.start_tick.saturating_add((exec_interval.end_tick+exec_interval.start_tick)/4);
new_interrupt_times.push(new_time.try_into().expect("ticks > u32"));
if (new_time + config.1 as u64) < next as u64 { // the new interrupt is not too close to the next one
new_interrupt_times.extend(interrupt_ticks.iter().skip(num).cloned());
} else { // the new interrupt is too close to the next one, skip the next one
new_interrupt_times.extend(interrupt_ticks.iter().skip(num+1).cloned());
}
new=true;
break;
}