(&self, fuzzer: &Path, corpus: Vec<&Path>)
| 336 | } |
| 337 | |
| 338 | pub fn execute_fuzzer(&self, fuzzer: &Path, corpus: Vec<&Path>) -> Result<()> { |
| 339 | // make up corpus for each standalone fuzzer. |
| 340 | let dict = self.deopt.get_library_build_dict_path()?; |
| 341 | |
| 342 | let work_dir = fuzzer.parent().unwrap(); |
| 343 | let log_file: PathBuf = [PathBuf::from(work_dir), "fuzz.log".into()] |
| 344 | .iter() |
| 345 | .collect(); |
| 346 | |
| 347 | let mut extra_args: Vec<OsString> = corpus |
| 348 | .iter() |
| 349 | .map(|x| x.as_os_str().to_os_string()) |
| 350 | .collect(); |
| 351 | if dict.exists() { |
| 352 | let dict_arg = format!("-dict={}", dict.to_string_lossy()); |
| 353 | extra_args.push(OsString::from(dict_arg)); |
| 354 | } |
| 355 | extra_args.push(OsString::from("-close_fd_mask=3")); |
| 356 | |
| 357 | let mut child = self.spawn( |
| 358 | fuzzer, |
| 359 | extra_args, |
| 360 | vec![], |
| 361 | None, |
| 362 | Some(std::fs::File::create(&log_file)?.into()), |
| 363 | false, |
| 364 | ); |
| 365 | |
| 366 | let mut cost_time: u64 = 0; |
| 367 | let mut previous_cov = None; |
| 368 | let mut should_break = false; |
| 369 | loop { |
| 370 | if cost_time >= config::MAX_FUZZ_TIME { |
| 371 | should_break = true; |
| 372 | } |
| 373 | let wait_time = config::MIN_FUZZ_TIME; |
| 374 | // no coverage gained during config::MIN_FUZZ_TIME, break |
| 375 | if cost_time >= wait_time && cost_time.is_multiple_of(wait_time) { |
| 376 | let cov = parse_cov_from_log(&log_file)?; |
| 377 | if let Some(cov) = cov { |
| 378 | if let Some(p_cov) = previous_cov { |
| 379 | if cov == p_cov { |
| 380 | should_break = true; |
| 381 | } |
| 382 | } else { |
| 383 | previous_cov = Some(cov) |
| 384 | } |
| 385 | } |
| 386 | } |
| 387 | match child.try_wait() { |
| 388 | Ok(Some(_status)) => { |
| 389 | let bytes = std::fs::read(log_file)?; |
| 390 | let err_msg = String::from_utf8_lossy(&bytes); |
| 391 | eyre::bail!("cost time: {cost_time} \n{err_msg}") |
| 392 | } |
| 393 | Ok(None) => { |
| 394 | log::debug!("{fuzzer:?} running."); |
| 395 | if should_break { |
no test coverage detected