authorgravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2024-08-05 18:37:19-07:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2024-08-07 00:48:32-07:00
log529df8c0075a1a91860523ed33c475473d332ae3
tree925f0606ce54fd9f6f76649f933ff95f8e6920d8
parent5f5a7b53a4639c618061ee363a513487d2f684c6

libfuzzer: fix looking at wrong memory for pc counters

this fix bypasses the slice bounds, reading garbage data for up to the last 7 bits (which are technically supposed to be ignored). that's going to need to be fixed, let's fix that along with switching from byte elems to usize elems.

1 files changed, 10 insertions(+), 10 deletions(-)

lib/fuzzer.zig+10-10
...@@ -276,7 +276,7 @@ const Fuzzer = struct {...@@ -276,7 +276,7 @@ const Fuzzer = struct {
276 .score = 0,276 .score = 0,
277 }, {});277 }, {});
278 } else {278 } else {
279 if (f.n_runs % 1000 == 0) f.dumpStats();279 if (f.n_runs % 10000 == 0) f.dumpStats();
280280
281 const analysis = f.analyzeLastRun();281 const analysis = f.analyzeLastRun();
282 const gop = f.recent_cases.getOrPutAssumeCapacity(.{282 const gop = f.recent_cases.getOrPutAssumeCapacity(.{
...@@ -303,16 +303,16 @@ const Fuzzer = struct {...@@ -303,16 +303,16 @@ const Fuzzer = struct {
303 {303 {
304 const seen_pcs = f.seen_pcs.items[@sizeOf(SeenPcsHeader) + f.flagged_pcs.len * @sizeOf(usize) ..];304 const seen_pcs = f.seen_pcs.items[@sizeOf(SeenPcsHeader) + f.flagged_pcs.len * @sizeOf(usize) ..];
305 for (seen_pcs, 0..) |*elem, i| {305 for (seen_pcs, 0..) |*elem, i| {
306 const byte_i = i / 8;306 const byte_i = i * 8;
307 const mask: u8 =307 const mask: u8 =
308 (@as(u8, @intFromBool(f.pc_counters[byte_i + 0] != 0)) << 0) |308 (@as(u8, @intFromBool(f.pc_counters.ptr[byte_i + 0] != 0)) << 0) |
309 (@as(u8, @intFromBool(f.pc_counters[byte_i + 1] != 0)) << 1) |309 (@as(u8, @intFromBool(f.pc_counters.ptr[byte_i + 1] != 0)) << 1) |
310 (@as(u8, @intFromBool(f.pc_counters[byte_i + 2] != 0)) << 2) |310 (@as(u8, @intFromBool(f.pc_counters.ptr[byte_i + 2] != 0)) << 2) |
311 (@as(u8, @intFromBool(f.pc_counters[byte_i + 3] != 0)) << 3) |311 (@as(u8, @intFromBool(f.pc_counters.ptr[byte_i + 3] != 0)) << 3) |
312 (@as(u8, @intFromBool(f.pc_counters[byte_i + 4] != 0)) << 4) |312 (@as(u8, @intFromBool(f.pc_counters.ptr[byte_i + 4] != 0)) << 4) |
313 (@as(u8, @intFromBool(f.pc_counters[byte_i + 5] != 0)) << 5) |313 (@as(u8, @intFromBool(f.pc_counters.ptr[byte_i + 5] != 0)) << 5) |
314 (@as(u8, @intFromBool(f.pc_counters[byte_i + 6] != 0)) << 6) |314 (@as(u8, @intFromBool(f.pc_counters.ptr[byte_i + 6] != 0)) << 6) |
315 (@as(u8, @intFromBool(f.pc_counters[byte_i + 7] != 0)) << 7);315 (@as(u8, @intFromBool(f.pc_counters.ptr[byte_i + 7] != 0)) << 7);
316316
317 _ = @atomicRmw(u8, elem, .Or, mask, .monotonic);317 _ = @atomicRmw(u8, elem, .Or, mask, .monotonic);
318 }318 }