Function wasm_mutate

crates/fuzzing/src/mutators.rs:14–100

Use [`wasm-mutate`][wasm-mutate] to mutate a fuzz input. [wasm-mutate]: https://github.com/bytecodealliance/wasm-tools/tree/main/crates/wasm-mutate

(
    data: &mut [u8],
    size: usize,
    max_size: usize,
    seed: u32,
    libfuzzer_mutate: fn(data: &mut [u8], size: usize, max_size: usize) -> usize,
)

///
/// [wasm-mutate]: https://github.com/bytecodealliance/wasm-tools/tree/main/crates/wasm-mutate
pub fn wasm_mutate(
    data: &mut [u8],
    size: usize,
    max_size: usize,
    seed: u32,
    libfuzzer_mutate: fn(data: &mut [u8], size: usize, max_size: usize) -> usize,
) -> usize {
    const MUTATION_FUEL: u64 = 100;
    const MUTATION_ITERS: usize = 100;

    let wasm = &data[..size];

    if wasmparser::validate(wasm).is_ok() {
        let mut wasm_mutate = wasm_mutate::WasmMutate::default();
        wasm_mutate
            .seed(seed.into())
            .fuel(MUTATION_FUEL)
            .reduce(max_size < size)
            .raw_mutate_func(Some(Arc::new(move |data, max_size| {
                let len = data.len();

                // The given max could be very large, so clamp it to no more
                // than `len * 2` in any single, given mutation. This way we
                // don't over-allocate a bunch of space.
                let max_size = std::cmp::min(max_size, len * 2);
                // Also, the max must always be greater than zero (`libfuzzer`
                // asserts this).
                let max_size = std::cmp::max(max_size, 1);

                // Make sure we have capacity in case `libfuzzer` decides to
                // grow this data.
                if max_size > len {
                    data.resize(max_size, 0);
                }

                // Finally, have `libfuzzer` mutate the data!
                let new_len = libfuzzer_mutate(data, len, max_size);

                // Resize the data to the mutated size, releasing any extra
                // capacity that we don't need anymore.
                data.resize(new_len, 0);
                data.shrink_to_fit();

                Ok(())
            })));

        let wasm = wasm.to_vec();
        let mutations = wasm_mutate.run(&wasm);
        if let Ok(mutations) = mutations {
            for mutation in mutations.take(MUTATION_ITERS) {
                if let Ok(mutated_wasm) = mutation {
                    if mutated_wasm.len() <= max_size {
                        data[..mutated_wasm.len()].copy_from_slice(&mutated_wasm);
                        return mutated_wasm.len();
                    }
                }
            }
        }