autarkie 0.8.0

autarkie - instant grammar fuzzing using rust
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95

use crate::Visitor;
use crate::{MutationType, Node};
use libafl::{
    corpus::Corpus,
    mutators::{MutationResult, Mutator},
    state::{HasCorpus, HasRand},
    HasMetadata,
};
use libafl_bolts::{HasLen, Named};
use std::{borrow::Cow, cell::RefCell, collections::VecDeque, marker::PhantomData, rc::Rc};

use crate::fuzzer::context::Context;

use super::commons::calculate_subslice_bounds;

pub const RECURSE_STACK: usize = 1000;

pub struct AutarkieRandomMutator<I> {
    max_subslice_size: usize,
    visitor: Rc<RefCell<Visitor>>,
    phantom: PhantomData<I>,
}

impl<I, S> Mutator<I, S> for AutarkieRandomMutator<I>
where
    I: Node,
    S: HasCorpus<I> + HasRand + HasMetadata,
{
    fn mutate(&mut self, state: &mut S, input: &mut I) -> Result<MutationResult, libafl::Error> {
        let mut metadata = state.metadata_mut::<Context>()?;
        input.__autarkie_fields(&mut self.visitor.borrow_mut(), 0);
        let mut fields = self.visitor.borrow_mut().fields();
        let field_splice_index = self.visitor.borrow_mut().random_range(0, fields.len() - 1);
        let field = &mut fields[field_splice_index];
        let ((id, node_ty), ty) = field.last().expect("YjBYG4Fr____");
        let mut bias = self.visitor.borrow().generate_depth();
        if let crate::NodeType::Iterable(is_fixed_len, field_len, inner_ty) = node_ty {
            if *field_len < 3 {
                return Ok(MutationResult::Skipped);
            }
            let mut path = VecDeque::from_iter(field.iter().map(|(i, ty)| i.0));
            let subslice_bounds = calculate_subslice_bounds(
                *field_len,
                self.max_subslice_size,
                &mut self.visitor.borrow_mut(),
            );
            for index in subslice_bounds {
                let mut path = VecDeque::from_iter(field.iter().map(|(i, ty)| i.0));
                path.push_back(index);
                #[cfg(feature = "debug_mutators")]
                println!("recursive_mutate | subslice | {:?}", field);
                input.__autarkie_mutate(
                    &mut MutationType::GenerateReplace(bias / 2),
                    &mut self.visitor.borrow_mut(),
                    path,
                );
            }
            metadata.add_mutation(crate::fuzzer::context::MutationMetadata::RandomMutateSubsplice);
        } else {
            let mut path = VecDeque::from_iter(field.iter().map(|(i, ty)| i.0));
            #[cfg(feature = "debug_mutators")]
            println!("recursive_mutate | single | {:?}", field);
            input.__autarkie_mutate(
                &mut MutationType::GenerateReplace(bias),
                &mut self.visitor.borrow_mut(),
                path,
            );
            metadata.add_mutation(crate::fuzzer::context::MutationMetadata::RandomMutateSingle);
        }
        Ok(MutationResult::Mutated)
    }

    fn post_exec(
        &mut self,
        _state: &mut S,
        _new_corpus_id: Option<libafl::corpus::CorpusId>,
    ) -> Result<(), libafl::Error> {
        Ok(())
    }
}

impl<I> Named for AutarkieRandomMutator<I> {
    fn name(&self) -> &std::borrow::Cow<'static, str> {
        &Cow::Borrowed("AutarkieRandomMutator")
    }
}
impl<I> AutarkieRandomMutator<I> {
    pub fn new(visitor: Rc<RefCell<Visitor>>, max_subslice_size: usize) -> Self {
        Self {
            visitor,
            max_subslice_size,
            phantom: PhantomData,
        }
    }
}