Method run

hail-fuzz/src/extension.rs:263–336

(fuzzer: &mut Fuzzer, stats: &mut monitor::LocalStats)

impl FuzzerStage for MultiStreamExtendStage {
    fn run(fuzzer: &mut Fuzzer, stats: &mut monitor::LocalStats) -> anyhow::Result<StageExit> {
        let mut state = match MultiStreamExtendStage::start(fuzzer) {
            Ok(data) => data,
            Err(err) => return Ok(err.into()),
        };

        loop {
            if state.attempts == 0 {
                // Check if there any pending partial extensions to try.
                if let Err(exit) = state.prepare_new_input(fuzzer) {
                    // Done with this stage.
                    fuzzer.prefix_snapshot = None;
                    return Ok(exit);
                }
            }
            state.attempts -= 1;

            let Some(exit) = state.exec_one(fuzzer)
            else {
                return Ok(StageExit::Interrupted);
            };

            let mut new_mmio_addr = false;
            if matches!(exit, VmExit::UnhandledException((ExceptionCode::ReadWatch, _))) {
                // If the mutated input ends at a new location then consider saving it, for a second
                // multi-stream extension stage.
                let end_addr = fuzzer.vm.cpu.read_pc();
                if state.end_addrs.insert(end_addr) {
                    state.rare_input = Some((end_addr, fuzzer.state.input.clone()));
                }
                else if state.rare_input.as_ref().map_or(false, |(addr, _)| *addr == end_addr) {
                    // We found the same ending point again (meaning this was not a rare input).
                    state.rare_input = None;
                }

                // If fuzzing stops because a different stream was read from, added to the list of
                // streams we are extending.
                if let Some(addr) = fuzzer.state.input.last_read {
                    // Record metadata for the input causing the exit. This is used to increase
                    // the size of extensions on inputs with a large number of exits.
                    let metadata = fuzzer.corpus.metadata.streams.entry(addr).or_default();
                    metadata.reached_end_of_stream += 1;

                    if let Some(id) = fuzzer.input_id {
                        *fuzzer.corpus[id]
                            .stage_data::<LengthExtData>(Stage::MultiStreamExtend)
                            .stream_exits
                            .entry(addr)
                            .or_default() += 1;
                    }

                    state.streams_to_mutate.entry(addr).or_insert_with(|| {
                        new_mmio_addr = true;
                        fuzzer.get_extension_factor(addr)
                    });
                };
            }