AFLplusplus / AFLplusplus/LibAFL

Crossover mutators currently don't work with nested MappingMutators

オープン
#2,944 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る
enhancement
主要言語
Rust
スター
2.6k
フォーク
481
平均マージ
2日 30分
マージ済み PR(30日)
16

説明

One may want to use two (or more) nested `MappingMutator`s, one to map from a complex input type to a primitive that can be mutated by built-in mutators such as `havoc_mutations`, and one to map from a composite input type (such as a list of the complex input type, which would e.g. be a list of network packets) to the complex input type.

This limitation is because one can only pass a single mapper to the mutator which extracts the data to be injected from the corpus. In the future, this mapping should be done in `MappingMutator` as well (maybe an alternate crossover version). However, for crossover the dependency between the different stages of `MappingMutator`s is the reverse to the mapping of the current input. This makes it somewhat tricky.

I have at some point toyed around with an implementation which would create a new `CrossoverMutator` trait, which has a default `Mutator` implementation and just maps the current input and the crossover input and passes those two to the default impl for the actual mutation. With this approach, for the crossover mapping, one needs to create closures at each level of mapping, each owning the next-lower crossover mapper. I've not managed to get past lifetime limitations because the default impl needs to receive both a mut reference to state (because certain mutators need a source of randomness), and a reference to the input, which depends on state as well, so the borrow checker complained.

I may give it another go at some point, for now I just wanted to document this limitation. If anyone wants to work on this though, please do!

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。