Prefix-aware LibFuzzer custom mutator. More...

#include <stddef.h>
#include <stdint.h>
#include <string.h>
#include "fuzz_defs.h"

Include dependency graph for fuzz_mutator.h:

This graph shows which files directly or indirectly include this file:

Typedefs
typedef size_t(*	fuzz_input_mutator_fn) (uint8_t *input, size_t size, size_t max_size, unsigned int seed)
	Mutates a harness input in place, returning its new size.

Functions
size_t	LLVMFuzzerMutate (uint8_t *data, size_t size, size_t max_size)

size_t	fuzz_prefix_size (void)
	Where Absolution's sampled state ends (see cmake/EmitPrefixSize.cmake).

size_t	fuzz_custom_mutator (uint8_t *data, size_t size, size_t max_size, unsigned int seed)
	The framework's `LLVMFuzzerCustomMutator()` body.

size_t	fuzz_mutate_input_with (uint8_t *data, size_t size, size_t max_size, unsigned int seed, fuzz_input_mutator_fn mutate_input)
	Run a grammar-aware mutator over the harness input only, leaving the sampled prefix untouched.

Detailed Description

Prefix-aware LibFuzzer custom mutator.

A fuzzer input is [ Absolution prefix | harness input ] (see fuzz_defs.h). LibFuzzer's default mutator treats that as a flat byte array, which mostly produces incoherent global state; fuzz_custom_mutator() splits the two and treats them differently:

the harness input is mutated freely by LLVMFuzzerMutate(),
the sampled prefix is perturbed in small windows so restored state stays coherent,
the harness control bytes (lane, command) are mutated on their own, so the fuzzer can deliberately switch lane or command instead of waiting to hit those bytes by chance.

fuzz_harness.h forwards LLVMFuzzerCustomMutator() here by default; the only layout fact needed is the prefix size.

An app with its own input grammar defines FUZZ_APP_CUSTOM_MUTATOR and builds on fuzz_mutate_input_with(). For TLV-framed payloads see tlv_mutator.h.

Definition in file fuzz_mutator.h.

Typedef Documentation

◆ fuzz_input_mutator_fn

typedef size_t(* fuzz_input_mutator_fn) (uint8_t *input, size_t size, size_t max_size, unsigned int seed)

Mutates a harness input in place, returning its new size.

Definition at line 40 of file fuzz_mutator.h.

Function Documentation

◆ fuzz_custom_mutator()

size_t fuzz_custom_mutator	(	uint8_t *	data,
		size_t	size,
		size_t	max_size,
		unsigned int	seed
	)

The framework's LLVMFuzzerCustomMutator() body.

◆ fuzz_mutate_input_with()

size_t fuzz_mutate_input_with	(	uint8_t *	data,
		size_t	size,
		size_t	max_size,
		unsigned int	seed,
		fuzz_input_mutator_fn	mutate_input
	)

Run a grammar-aware mutator over the harness input only, leaving the sampled prefix untouched.

Harnesses with their own input grammar (TLV, for example) use this instead of repeating the prefix arithmetic themselves.

◆ fuzz_prefix_size()

size_t fuzz_prefix_size ( void )

Where Absolution's sampled state ends (see cmake/EmitPrefixSize.cmake).

◆ LLVMFuzzerMutate()

size_t LLVMFuzzerMutate	(	uint8_t *	data,
		size_t	size,
		size_t	max_size
	)

extern

Typedefs

Functions