Fuzzing only N times

[GoogleCodeExporter]

Fuzzing only N times

Original issue reported on code.google.com by groeb...@google.com on 15 Mar 2013 at 10:05

Attachments:

• fuzz.c
• common.h
• honggfuzz.c

[GoogleCodeExporter]

Index: fuzz.c
===================================================================
--- fuzz.c  (revision 51)
+++ fuzz.c  (working copy)
@@ -275,6 +275,21 @@
     for (;;) {
         while (hfuzz->threadsCnt < hfuzz->threadsMax) {
             fuzz_runNext(hfuzz);
+
+            if (hfuzz->mutationsMax != 0) {
+                /* We just want a limited number of mutations */
+                hfuzz->mutationsCnt++;
+
+                if (hfuzz->mutationsCnt >= hfuzz->mutationsMax) {
+                    LOGMSG(l_INFO, "Waiting for childs and exiting.");
+
+                    while (hfuzz->threadsCnt != 0) {
+                        fuzz_reapChild(hfuzz);
+                    }
+                    LOGMSG(l_INFO, "Finished fuzzing %ld times.", 
hfuzz->mutationsMax);
+                    exit(EXIT_SUCCESS);
+                }
+            }
         }
         fuzz_reapChild(hfuzz);
     }
Index: honggfuzz.c
===================================================================
--- honggfuzz.c (revision 51)
+++ honggfuzz.c (working copy)
@@ -66,8 +66,10 @@
            AC "]: command modifying input files externally (instead of -r/-m)\n" " [" AB "-t val" AC
            "]: timeout (in secs), default: '" AB "3" AC "' (0 - no timeout)\n" " [" AB "-a val" AC
            "]: address limit (from si.si_addr) below which crashes\n"
-           "           are not reported, default: '" AB "0" AC "' (suggested: 
65535)\n" " [" AB
-           "-n val" AC "]: number of concurrent fuzzing processes, default: '" 
AB "5" AC "'\n" " [-"
+           "           are not reported, default: '" AB "0" AC "' (suggested: 
65535)\n"
+           " [" AB "-n val" AC "]: number of concurrent fuzzing processes, 
default: '" AB "5" AC "'\n"
+           " [" AB "-N val" AC "]: number of fuzzing mutations, default: '" AB 
"0" AC "' (infintive)\n"
+           " [-"
            AB "l val" AC "]: per process memory limit in MiB, default: '" AB "0" AC "' (no limit)\n"
 #ifdef _HAVE_ARCH_PTRACE
            " [" AB "-p val" AC
@@ -95,6 +97,8 @@
     hfuzz.externalCommand = NULL;
     hfuzz.tmOut = 3;
     hfuzz.ignoreAddr = (void *)0UL;
+    hfuzz.mutationsMax = 0;
+    hfuzz.mutationsCnt = 0;
     hfuzz.threadsMax = 5;
     hfuzz.asLimit = 0UL;
     hfuzz.cmdline = NULL;
@@ -110,7 +114,7 @@
     }

     for (;;) {
-        c = getopt(argc, argv, "hqsuf:d:e:r:m:c:t:a:n:l:p:");
+        c = getopt(argc, argv, "hqsuf:d:e:r:m:c:t:a:n:N:l:p:");
         if (c < 0)
             break;

@@ -154,6 +158,9 @@
         case 'n':
             hfuzz.threadsMax = atol(optarg);
             break;
+        case 'N':
+            hfuzz.mutationsMax = atol(optarg);
+            break;
         case 'l':
             hfuzz.asLimit = strtoul(optarg, NULL, 10);
             break;
@@ -193,12 +200,12 @@

     LOGMSG(l_INFO,
            "debugLevel: %d, inputFile '%s', nullifyStdio: %d, fuzzStdin: %d, saveUnique: %d, flipRate: %lf, "
-           "flipMode: '%c', externalCommand: '%s', tmOut: %ld, threadsMax: 
%ld, fileExtn '%s', ignoreAddr: %p, "
+           "flipMode: '%c', externalCommand: '%s', tmOut: %ld, mutationsMax: 
%ld, threadsMax: %ld, fileExtn '%s', ignoreAddr: %p, "
            "memoryLimit: %lu (MiB), fuzzExe: '%s', fuzzedPid: %d",
            ll, hfuzz.inputFile, hfuzz.nullifyStdio ? 1 : 0,
            hfuzz.fuzzStdin ? 1 : 0, hfuzz.saveUnique ? 1 : 0, hfuzz.flipRate, hfuzz.flipMode,
            hfuzz.externalCommand == NULL ? "NULL" : hfuzz.externalCommand, hfuzz.tmOut,
-           hfuzz.threadsMax, hfuzz.fileExtn, hfuzz.ignoreAddr, hfuzz.asLimit, 
hfuzz.cmdline[0],
+           hfuzz.mutationsMax, hfuzz.threadsMax, hfuzz.fileExtn, 
hfuzz.ignoreAddr, hfuzz.asLimit, hfuzz.cmdline[0],
            hfuzz.pid);

     if (!(hfuzz.fuzzers = malloc(sizeof(hfuzz.fuzzers[0]) * hfuzz.threadsMax))) {
Index: common.h
===================================================================
--- common.h    (revision 51)
+++ common.h    (working copy)
@@ -47,6 +47,8 @@
     char flipMode;
     char *externalCommand;
     long tmOut;
+    long mutationsMax;
+    long mutationsCnt;
     long threadsMax;
     long threadsCnt;
     void *ignoreAddr;

Original comment by groeb...@google.com on 15 Mar 2013 at 10:07

• Added labels: ****
• Removed labels: ****

[GoogleCodeExporter]

Original comment by robert.s...@gmail.com on 16 May 2013 at 1:10

• Changed state: Fixed
• Added labels: ****
• Removed labels: ****