AFLplusplus / AFLplusplus/LibAFL

Don't require entries in the corpus

Abierto
#2,161 9 comentarios 1 reacción 0 asignados Ver en GitHub
enhancement
Lenguaje dominante
Rust
Estrellas
2.6k
Forks
481
Merge medio
2 d 30 min
PR fusionados (30 d)
16

Descripción

When writing a generative (e.g., black-box, grammar-based) fuzzer that doesn't do mutations, I use `ConstFeedback::False` as the feedback, because I don't need to save any inputs that don't cause crashes. But I can't just leave the corpus empty. In particular, this fuzzer panics:
```rust
use libafl::feedbacks::ConstFeedback;
use libafl::monitors::SimpleMonitor;
use libafl::{
corpus::InMemoryCorpus,
events::SimpleEventManager,
executors::{inprocess::InProcessExecutor, ExitKind},
feedbacks::CrashFeedback,
fuzzer::{Fuzzer, StdFuzzer},
generators::RandPrintablesGenerator,
inputs::BytesInput,
schedulers::QueueScheduler,
stages::generation::GenStage,
state::StdState,
};
use libafl_bolts::{current_nanos, rands::StdRand, tuples::tuple_list};

pub fn main() {
let mut harness = |_input: &BytesInput| ExitKind::Ok;
let mut feedback = ConstFeedback::False;
let mut objective = CrashFeedback::new();
let mut state = StdState::new(
StdRand::with_seed(current_nanos()),
InMemoryCorpus::new(),
InMemoryCorpus::new(),
&mut feedback,
&mut objective,
)
.unwrap();

let mon = SimpleMonitor::new(|s| println!("{s}"));
let mut mgr = SimpleEventManager::new(mon);
let scheduler = QueueScheduler::new();
let mut fuzzer = StdFuzzer::new(scheduler, feedback, objective);
let mut executor = InProcessExecutor::new(&mut harness, (), &mut fuzzer, &mut state, &mut mgr)
.expect("Failed to create the Executor");
let generator = RandPrintablesGenerator::new(32);
// state
// .generate_initial_inputs(&mut fuzzer, &mut executor, &mut generator, &mut mgr, 1)
// .expect("Failed to generate the initial corpus");
let mut stages = tuple_list!(GenStage::new(generator));
fuzzer
.fuzz_loop(&mut stages, &mut executor, &mut state, &mut mgr)
.expect("Error in the fuzzing loop");
}
```
```
thread 'main' panicked at src/main.rs:43:10:
Error in the fuzzing loop: Empty("No entries in corpus. This often implies the target is not properly instrumented.", ErrorBacktrace)
stack backtrace:
0: rust_begin_unwind
at /rustc/9b00956e56009bab2aa15d7bff10916599e3d6d6/library/std/src/panicking.rs:645:5
1: core::panicking::panic_fmt
at /rustc/9b00956e56009bab2aa15d7bff10916599e3d6d6/library/core/src/panicking.rs:72:14
2: core::result::unwrap_failed
at /rustc/9b00956e56009bab2aa15d7bff10916599e3d6d6/library/core/src/result.rs:1654:5
3: core::result::Result::expect
at /rustc/9b00956e56009bab2aa15d7bff10916599e3d6d6/library/core/src/result.rs:1034:23
4: no_entries::main
at ./src/main.rs:41:5
5: core::ops::function::FnOnce::call_once
at /rustc/9b00956e56009bab2aa15d7bff10916599e3d6d6/library/core/src/ops/function.rs:250:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.
```
Note that the error message is also misleading. This panics because I didn't do `generate_initial_inputs{,_forced}`, not because of instrumentation. However, I shouldn't *need* to `generate_initial_inputs_forced`, because I don't need them in my corpus!

**Describe the solution you'd like**
Don't panic in this case

**Describe alternatives you've considered**
Status quo

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.