Method evolve_corpus

src/execution/sanitize.rs:243–280

Evolving the fuzzing corpus by finding the new coverage corpus files and merge them in shared corpus.

(&self, program_path: &Path)

    // Evolving the fuzzing corpus by finding the new coverage corpus files and merge them in shared corpus.
    fn evolve_corpus(&self, program_path: &Path) -> Result<()> {
        log::debug!("Evolve fuzzing corpus by merge new coverage corpora");
        let work_dir = crate::deopt::utils::get_file_dirname(program_path);
        let time_logger = TimeUsage::new(work_dir.clone());
        let fuzzer_binary = program_path.with_extension("sancov");
        self.compile(vec![program_path], &fuzzer_binary, super::Compile::Minimize)?;

        let global_feature_file = self.deopt.get_library_global_feature_file()?;
        let mut global_featuers: GlobalFeature = if global_feature_file.exists() {
            let buf = std::fs::read(&global_feature_file)?;
            serde_json::from_slice(&buf)?
        } else {
            GlobalFeature::init_by_corpus(self, &fuzzer_binary)?
        };

        let corpus: PathBuf = [work_dir.clone(), "corpus".into()].iter().collect();

        let corpus_dict = Self::collect_sancov_from_corpus(&fuzzer_binary, &corpus)?;
        let mut intrestings = Vec::new();
        for (corpus_file, sancov) in corpus_dict {
            let mut has_new = false;
            let features = sancov.covered_points;
            for fe in features {
                if global_featuers.insert_feature(fe) {
                    has_new = true;
                }
            }
            if has_new {
                intrestings.push(corpus_file);
            }
        }
        log::debug!("Find {} new interesting corpus files to evolve the corpus.", intrestings.len());
        self.deopt.copy_file_to_shared_corpus(intrestings)?;
        let buf = serde_json::to_vec(&global_featuers)?;
        std::fs::write(global_feature_file, buf)?;
        time_logger.log("update")?;
        Ok(())
    }

    /// After the first half of converge, performs sanitization on the seeds again. It aims to:
    /// Sanitize the erroneous programs that were ignored due to no suitable fuzzing corpus to trigger the error.