(&mut self, fuzzer: &mut Fuzzer)
| 134 | } |
| 135 | |
| 136 | fn fuzz_one(&mut self, fuzzer: &mut Fuzzer) -> Option<()> { |
| 137 | let range = self.next_range()?; |
| 138 | |
| 139 | // Copy random bytes from the mutated input for the current range. |
| 140 | let input = &mut fuzzer.state.input; |
| 141 | range.get_mut(input).copy_from_slice(range.get(&self.mutated_input)); |
| 142 | |
| 143 | // Execute the modified input in the fuzzer. |
| 144 | Snapshot::restore_initial(fuzzer); |
| 145 | fuzzer.reset_input_cursor().unwrap(); |
| 146 | fuzzer.write_input_to_target().unwrap(); |
| 147 | let exit = fuzzer.execute()?; |
| 148 | self.total_execs += 1; |
| 149 | |
| 150 | let diverged = |
| 151 | CrashKind::from(exit).is_crash() || fuzzer.vm.cpu.icount != self.original_icount; |
| 152 | |
| 153 | // Check if the fuzzer thinks the input is interesting, Note: this needs to be done now, |
| 154 | // since the code below may modify the input. |
| 155 | let _ = fuzzer.check_exit_state(exit); |
| 156 | |
| 157 | // Check that the input executes the same path as before. |
| 158 | let original_input = &mut fuzzer.corpus[self.input_id]; |
| 159 | if diverged { |
| 160 | // Input trace no longer matches, so restore the mutated bytes and split the range. |
| 161 | range.get_mut(&mut fuzzer.state.input).copy_from_slice(range.get(&original_input.data)); |
| 162 | |
| 163 | if range.len() > 1 { |
| 164 | // Split the range in half and push the two halves onto the heap. |
| 165 | let mid = range.start + (range.len() / 2); |
| 166 | self.ranges.push(SortByLen(Range { |
| 167 | stream: range.stream, |
| 168 | start: range.start, |
| 169 | end: mid, |
| 170 | })); |
| 171 | self.ranges.push(SortByLen(Range { |
| 172 | stream: range.stream, |
| 173 | start: mid, |
| 174 | end: range.end, |
| 175 | })); |
| 176 | } |
| 177 | } |
| 178 | else { |
| 179 | *self.colorized_bytes.entry(range.stream).or_default() += |
| 180 | (range.end - range.start) as usize; |
| 181 | self.untainted_ranges.push(range); |
| 182 | } |
| 183 | |
| 184 | Some(()) |
| 185 | } |
| 186 | |
| 187 | fn end(&mut self, fuzzer: &mut Fuzzer) { |
| 188 | if fuzzer.debug.cmplog && fuzzer.global.is_main_instance() { |
no test coverage detected