fuzz_mutator.h File Reference

Prefix-aware LibFuzzer custom mutator. More...

#include <stddef.h>
#include <stdint.h>
#include <string.h>

Include dependency graph for fuzz_mutator.h:

Go to the source code of this file.

Macros
#define	FUZZ_APP_DATA_OFF   0
#define	FUZZ_APP_DATA_LEN   0

Enumerations
enum	{   FUZZ_MUT_INITIAL_POST_PREFIX_SIZE = 256 , FUZZ_MUT_PREFIX_WINDOW_MAX = 32 , FUZZ_MUT_APP_DATA_WINDOW_MAX = 64 , FUZZ_MUT_STRUCTURED_CTRL_CUTOFF = 90 ,   FUZZ_MUT_RAW_PREFIX_MASK = 3 , FUZZ_MUT_TOKEN_INJECT_MASK = 1 }
enum	{ FUZZ_MUT_STRUCTURED_POST_PREFIX_CUTOFF = 60 }

Functions
size_t	LLVMFuzzerMutate (uint8_t *data, size_t size, size_t max_size)
const size_t absolution_globals_size	__attribute__ ((weak))
static size_t	fuzz_prefix_size (void)
static int	fuzz_split_is_valid (size_t prefix_size, size_t max_size)
static size_t	fuzz_bootstrap_input (uint8_t *data, size_t size, size_t prefix_size, size_t max_size)
static void	fuzz_mutate_window (uint8_t *data, size_t data_len, size_t max_span, unsigned int pick)
static void	fuzz_mutate_prefix_window (uint8_t *data, size_t prefix_size, unsigned int pick)
static void	fuzz_mutate_ctrl (uint8_t *data)
static size_t	fuzz_mutate_post_prefix (uint8_t *data, size_t size, size_t max_size)
static int	fuzz_should_inject_token (unsigned int seed)
static size_t	fuzz_mutate_structured (uint8_t *data, size_t prefix_size, size_t post_prefix_size, size_t max_size, unsigned int seed)
static size_t	fuzz_mutate_raw (uint8_t *data, size_t prefix_size, size_t post_prefix_size, size_t max_size, unsigned int seed)
static size_t	fuzz_mutate_with_split (uint8_t *data, size_t size, size_t max_size, unsigned int seed)
static size_t	fuzz_custom_mutator (uint8_t *data, size_t size, size_t max_size, unsigned int seed)

Detailed Description

Prefix-aware LibFuzzer custom mutator.

LibFuzzer's default mutator treats the input as a flat byte array and would silently corrupt the Absolution prefix that holds the app's restored global state. This header provides fuzz_custom_mutator() which keeps prefix and tail as separate mutation regions: the control bytes are steered independently, the prefix is mutated in small windows to stay coherent, and the tail is mutated freely by LLVMFuzzerMutate().

Wire it by defining FUZZ_PREFIX_SIZE_FALLBACK, FUZZ_CTRL_OFF/LEN, and fuzz_lane_is_structured() from mock/scenario_layout.h before including this header, then forwarding LLVMFuzzerCustomMutator() to fuzz_custom_mutator(). See The harness for the full pattern. For TLV-framed payloads see tlv_mutator.h.

Definition in file fuzz_mutator.h.

Macro Definition Documentation

FUZZ_APP_DATA_LEN

#define FUZZ_APP_DATA_LEN   0

Definition at line 28 of file fuzz_mutator.h.

FUZZ_APP_DATA_OFF

#define FUZZ_APP_DATA_OFF   0

Definition at line 25 of file fuzz_mutator.h.

Enumeration Type Documentation

anonymous enum

anonymous enum

Enumerator
FUZZ_MUT_INITIAL_POST_PREFIX_SIZE
FUZZ_MUT_PREFIX_WINDOW_MAX
FUZZ_MUT_APP_DATA_WINDOW_MAX
FUZZ_MUT_STRUCTURED_CTRL_CUTOFF
FUZZ_MUT_RAW_PREFIX_MASK
FUZZ_MUT_TOKEN_INJECT_MASK

Definition at line 34 of file fuzz_mutator.h.

anonymous enum

anonymous enum

Enumerator
FUZZ_MUT_STRUCTURED_POST_PREFIX_CUTOFF

Definition at line 49 of file fuzz_mutator.h.

Function Documentation

__attribute__()

const size_t absolution_globals_size __attribute__ ( (weak)  )

extern

fuzz_bootstrap_input()

static size_t fuzz_bootstrap_input ( uint8_t *  data, size_t  size, size_t  prefix_size, size_t  max_size  )

static

Definition at line 82 of file fuzz_mutator.h.

fuzz_custom_mutator()

static size_t fuzz_custom_mutator ( uint8_t *  data, size_t  size, size_t  max_size, unsigned int  seed  )

static

Definition at line 240 of file fuzz_mutator.h.

fuzz_mutate_ctrl()

static void fuzz_mutate_ctrl ( uint8_t *  data )

static

Definition at line 116 of file fuzz_mutator.h.

fuzz_mutate_post_prefix()

static size_t fuzz_mutate_post_prefix ( uint8_t *  data, size_t  size, size_t  max_size  )

static

Definition at line 121 of file fuzz_mutator.h.

fuzz_mutate_prefix_window()

static void fuzz_mutate_prefix_window ( uint8_t *  data, size_t  prefix_size, unsigned int  pick  )

static

Definition at line 111 of file fuzz_mutator.h.

fuzz_mutate_raw()

static size_t fuzz_mutate_raw ( uint8_t *  data, size_t  prefix_size, size_t  post_prefix_size, size_t  max_size, unsigned int  seed  )

static

Definition at line 192 of file fuzz_mutator.h.

fuzz_mutate_structured()

static size_t fuzz_mutate_structured ( uint8_t *  data, size_t  prefix_size, size_t  post_prefix_size, size_t  max_size, unsigned int  seed  )

static

Definition at line 157 of file fuzz_mutator.h.

fuzz_mutate_window()

static void fuzz_mutate_window ( uint8_t *  data, size_t  data_len, size_t  max_span, unsigned int  pick  )

static

Definition at line 96 of file fuzz_mutator.h.

fuzz_mutate_with_split()

static size_t fuzz_mutate_with_split ( uint8_t *  data, size_t  size, size_t  max_size, unsigned int  seed  )

static

Definition at line 212 of file fuzz_mutator.h.

fuzz_prefix_size()

static size_t fuzz_prefix_size ( void  )

static

Definition at line 54 of file fuzz_mutator.h.

fuzz_should_inject_token()

static int fuzz_should_inject_token ( unsigned int  seed )

static

Definition at line 126 of file fuzz_mutator.h.

fuzz_split_is_valid()

static int fuzz_split_is_valid ( size_t  prefix_size, size_t  max_size  )

static

Definition at line 64 of file fuzz_mutator.h.

LLVMFuzzerMutate()

size_t LLVMFuzzerMutate ( uint8_t *  data, size_t  size, size_t  max_size  )

extern