| 472 | } |
| 473 | |
| 474 | pub(crate) struct Fuzzer { |
| 475 | /// Directory to store data into. |
| 476 | pub workdir: PathBuf, |
| 477 | /// The Vm instance use for executing the target. |
| 478 | pub vm: Vm, |
| 479 | /// Controls how to fuzz the target. |
| 480 | pub target: CortexmMultiStream, |
| 481 | /// Random number source for the fuzzer.. |
| 482 | pub rng: SmallRng, |
| 483 | /// The root-level snapshot to restore from when running a new test case. |
| 484 | pub snapshot: Snapshot, |
| 485 | /// A snapshot corresponding to the execution from a prefix. |
| 486 | pub prefix_snapshot: Option<Snapshot>, |
| 487 | /// The current fuzzing stage. |
| 488 | pub stage: Stage, |
| 489 | /// A storage location for test cases. |
| 490 | pub corpus: CorpusStore<MultiStream>, |
| 491 | /// A queue for ordering the next test case to fuzz. |
| 492 | pub queue: CoverageQueue, |
| 493 | /// The ID of the current input input selected by the fuzzer. |
| 494 | pub input_id: Option<InputId>, |
| 495 | /// The state used for generating and monitoring test cases. |
| 496 | pub state: State, |
| 497 | /// Stores coverage information for the fuzzer. |
| 498 | pub coverage: Box<dyn CoverageAny>, |
| 499 | /// Keeps track of all the crashes discovered by the fuzzer. |
| 500 | pub crash_logger: CrashLogger, |
| 501 | /// Additional fuzzer configuration. |
| 502 | pub config: FuzzConfig, |
| 503 | /// A reference to the global state shared across fuzzing instances. |
| 504 | pub global: GlobalRef, |
| 505 | /// A reference to (optional) tracing instrumentation used for diagnosing fuzzing bugs. |
| 506 | pub path_tracer: Option<PathTracerRef>, |
| 507 | /// A reference to CmpLog instrumentation. |
| 508 | pub cmplog: Option<CmpLog2Ref>, |
| 509 | /// The blocks seen by the fuzzer with the number of executions and input ID corresponding to |
| 510 | /// when the first input reaching that block was found. |
| 511 | pub seen_blocks: BlockCoverageTracker, |
| 512 | /// Keeps track of bits (by index) in the coverage bitmap found by crashes before regular |
| 513 | /// inputs. |
| 514 | pub crash_coverage_bits: HashSet<u32>, |
| 515 | /// The total number of executions performed by this fuzzing instance. |
| 516 | pub execs: u64, |
| 517 | /// The number of execs were were at the last time we found an interesting input. |
| 518 | pub last_find: u64, |
| 519 | /// A per stream dictionary. |
| 520 | pub dict: MultiStreamDict, |
| 521 | /// A global dictionary. |
| 522 | pub global_dict: Dictionary, |
| 523 | /// The total number of inputs stored in `dict`. |
| 524 | pub dict_items: usize, |
| 525 | /// The cycle count that we refreshed input prioritization at. |
| 526 | pub re_prioritization_cycle: usize, |
| 527 | /// The number of inputs we had when we last refreshed input prioritization. |
| 528 | pub re_prioritization_inputs: usize, |
| 529 | /// Controls which fuzzer features should be enabled or not. (used for benchmarking). |
| 530 | pub features: config::EnabledFeatures, |
| 531 | /// Controls which debugging features should be enabled. |
nothing calls this directly
no outgoing calls
no test coverage detected