Method collect_fuzzable_variants

src/program/transform.rs:1365–1392

Analyze the AST of the program. Collect the API calls that contained the fuzzable arguments.

(
        &self,
        visitor: &Visitor,
        constraints: &APIConstraints,
    )

impl Visitor {
    /// Analyze the AST of the program. Collect the API calls that contained the fuzzable arguments.
    fn collect_fuzzable_variants(
        &self,
        visitor: &Visitor,
        constraints: &APIConstraints,
    ) -> Vec<FuzzVariant> {
        let mut fuzz_variants = Vec::new();
        let calls = self.visit_library_calls();
        for (n_th_call, call) in calls.iter().enumerate() {
            // cannot locate code elements in macro expansion, skip it.
            if let Clang::CallExpr(ce) = &call.kind {
                if is_macro_stmt(&ce.range) {
                    continue;
                }
            }

            let call_name = call.get_call_name();
            // get the positions of constant array parameters of this API call.
            let fuzz_arrays =
                collect_fuzzable_array_args(&call_name, call, n_th_call, constraints, visitor);
            // get the positions of integer (scalar) type parameters of this API call.
            let fuzz_integers =
                collect_fuzzable_integer_args(&call_name, call, n_th_call, constraints, visitor);

            fuzz_variants.extend(fuzz_arrays);
            fuzz_variants.extend(fuzz_integers);
        }
        fuzz_variants
    }
}

/// those array args are not fuzzable arrays, they should not be transformed to receive fuzz bytes.