fuzzer

Documentation

Index

• func DefaultExecOpts(cfg *mgrconfig.Config, features flatrpc.Feature, debug bool) flatrpc.ExecOpts
• type Candidate
• type Config
• type Cover
  • func (cover *Cover) AddMaxSignal(sign signal.Signal)
  • func (cover *Cover) CopyMaxSignal() signal.Signal
  • func (cover *Cover) GrabSignalDelta() signal.Signal
• type Fuzzer
  • func NewFuzzer(ctx context.Context, cfg *Config, rnd *rand.Rand, target *prog.Target) *Fuzzer
  • func (fuzzer *Fuzzer) AddCandidates(candidates []Candidate)
  • func (fuzzer *Fuzzer) CandidateTriageFinished() bool
  • func (fuzzer *Fuzzer) ChoiceTable() *prog.ChoiceTable
  • func (fuzzer *Fuzzer) Logf(level int, msg string, args ...interface{})
  • func (fuzzer *Fuzzer) Next() *queue.Request
  • func (fuzzer *Fuzzer) RunningJobs() []*JobInfo
• type JobInfo
  • func (sb *JobInfo) Bytes() []byte
  • func (ji *JobInfo) ID() string
  • func (sb *JobInfo) Logf(logFmt string, args ...any)
• type ProgFlags
• type Stats
• type SyscallStats

Functions

func DefaultExecOpts

func DefaultExecOpts(cfg *mgrconfig.Config, features flatrpc.Feature, debug bool) flatrpc.ExecOpts

TODO: This method belongs better to pkg/flatrpc, but we currently end up having a cyclic dependency error.

Types

type Candidate

type Candidate struct {
	Prog  *prog.Prog
	Flags ProgFlags
}

type Config

type Config struct {
	Debug          bool
	Corpus         *corpus.Corpus
	Logf           func(level int, msg string, args ...interface{})
	Snapshot       bool
	Coverage       bool
	FaultInjection bool
	Comparisons    bool
	Collide        bool
	EnabledCalls   map[*prog.Syscall]bool
	NoMutateCalls  map[int]bool
	FetchRawCover  bool
	NewInputFilter func(call string) bool
	PatchTest      bool
}

type Cover

type Cover struct {
	// contains filtered or unexported fields
}

Cover keeps track of the signal known to the fuzzer.

func (*Cover) AddMaxSignal

func (cover *Cover) AddMaxSignal(sign signal.Signal)

Signal that should no longer be chased after. It is not returned in GrabSignalDelta().

func (*Cover) CopyMaxSignal

func (cover *Cover) CopyMaxSignal() signal.Signal

func (*Cover) GrabSignalDelta

func (cover *Cover) GrabSignalDelta() signal.Signal

type Fuzzer

type Fuzzer struct {
	Stats
	Config *Config
	Cover  *Cover
	// contains filtered or unexported fields
}

func NewFuzzer

func NewFuzzer(ctx context.Context, cfg *Config, rnd *rand.Rand,
	target *prog.Target) *Fuzzer

func (*Fuzzer) AddCandidates

func (fuzzer *Fuzzer) AddCandidates(candidates []Candidate)

func (*Fuzzer) CandidateTriageFinished

func (fuzzer *Fuzzer) CandidateTriageFinished() bool

func (*Fuzzer) ChoiceTable

func (fuzzer *Fuzzer) ChoiceTable() *prog.ChoiceTable

func (*Fuzzer) Logf

func (fuzzer *Fuzzer) Logf(level int, msg string, args ...interface{})

func (*Fuzzer) Next

func (fuzzer *Fuzzer) Next() *queue.Request

func (*Fuzzer) RunningJobs

func (fuzzer *Fuzzer) RunningJobs() []*JobInfo

type JobInfo

type JobInfo struct {
	Name  string
	Calls []string
	Type  string
	Execs atomic.Int32
	// contains filtered or unexported fields
}

func (*JobInfo) Bytes

func (sb *JobInfo) Bytes() []byte

func (*JobInfo) ID

func (ji *JobInfo) ID() string

func (*JobInfo) Logf

func (sb *JobInfo) Logf(logFmt string, args ...any)

type ProgFlags

type ProgFlags int

const (
	// The candidate was loaded from our local corpus rather than come from hub.
	ProgFromCorpus ProgFlags = 1 << iota
	ProgMinimized
	ProgSmashed
)

type Stats

type Stats struct {
	// Indexed by prog.Syscall.ID + the last element for extra/remote.
	Syscalls []SyscallStats
	// contains filtered or unexported fields
}

type SyscallStats

type SyscallStats struct {
	// Number of times coverage buffer for this syscall has overflowed.
	CoverOverflows atomic.Uint64
	// Number of times comparisons buffer for this syscall has overflowed.
	CompsOverflows atomic.Uint64
}