libafl 0.15.4

Slot your own fuzzers together and extend their features using Rust
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101

//! Gramatron generator
use alloc::{string::String, vec::Vec};
use core::{marker::PhantomData, num::NonZero};

use libafl_bolts::rands::Rand;
use serde::{Deserialize, Serialize};

use crate::{
    Error,
    generators::Generator,
    inputs::{GramatronInput, Terminal},
    state::HasRand,
};

/// A trigger
#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq)]
pub struct Trigger {
    /// the destination
    pub dest: usize,
    /// the term
    pub term: String,
}

/// The [`Automaton`]
#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq)]
pub struct Automaton {
    /// final state
    pub final_state: usize,
    /// init state
    pub init_state: usize,
    /// pda of [`Trigger`]s
    pub pda: Vec<Vec<Trigger>>,
}

#[derive(Debug, Clone)]
/// Generates random inputs from a grammar automaton
pub struct GramatronGenerator<'a, S> {
    automaton: &'a Automaton,
    phantom: PhantomData<S>,
}

impl<S> Generator<GramatronInput, S> for GramatronGenerator<'_, S>
where
    S: HasRand,
{
    fn generate(&mut self, state: &mut S) -> Result<GramatronInput, Error> {
        let mut input = GramatronInput::new(vec![]);
        self.append_generated_terminals(&mut input, state);
        Ok(input)
    }
}

impl<'a, S> GramatronGenerator<'a, S>
where
    S: HasRand,
{
    /// Returns a new [`GramatronGenerator`]
    #[must_use]
    pub fn new(automaton: &'a Automaton) -> Self {
        Self {
            automaton,
            phantom: PhantomData,
        }
    }

    /// Append the generated terminals
    pub fn append_generated_terminals(&self, input: &mut GramatronInput, state: &mut S) -> usize {
        let mut counter = 0;
        let final_state = self.automaton.final_state;
        let mut current_state =
            input
                .terminals()
                .last()
                .map_or(self.automaton.init_state, |last| {
                    let triggers = &self.automaton.pda[last.state];
                    let idx = state.rand_mut().below(
                        NonZero::new(triggers.len())
                            .expect("Triggers are empty in append_generated_terminals!"),
                    );
                    triggers[idx].dest
                });

        while current_state != final_state {
            let triggers = &self.automaton.pda[current_state];
            let idx =
                state
                    .rand_mut()
                    .below(NonZero::new(triggers.len()).expect(
                        "Automation.pda triggers are empty in append_generated_terminals!",
                    ));
            let trigger = &triggers[idx];
            input
                .terminals_mut()
                .push(Terminal::new(current_state, idx, trigger.term.clone()));
            current_state = trigger.dest;
            counter += 1;
        }

        counter
    }
}