executor: Introduce Executor "Trait Objects" by using Type Erasure

algorithms/aflfast/aflfast_state.cpp

@@ -25,7 +25,7 @@ namespace fuzzuf::algorithm::aflfast {
 // FIXME: check if we are initializing all the members that need to be initialized
 AFLFastState::AFLFastState(
     std::shared_ptr<const AFLFastSetting> setting,
-    std::shared_ptr<NativeLinuxExecutor> executor
+    std::shared_ptr<executor::AFLExecutorInterface> executor
 ) : AFLStateTemplate<AFLFastTestcase>(setting, executor),
     setting(setting) {}
 

algorithms/ijon/ijon_state.cpp

@@ -22,7 +22,7 @@ namespace fuzzuf::algorithm::ijon {
 
 IJONState::IJONState(
     std::shared_ptr<const afl::AFLSetting> setting,
-    std::shared_ptr<NativeLinuxExecutor> executor
+    std::shared_ptr<executor::AFLExecutorInterface> executor
 ) : 
     afl::AFLStateTemplate<IJONTestcase>(setting, executor) {}
 

algorithms/nautilus/fuzzer/state.cpp

@@ -24,6 +24,7 @@
 #include <iomanip>
 #include <sstream>
 #include "fuzzuf/algorithms/nautilus/fuzzer/state.hpp"
+#include "fuzzuf/exceptions.hpp"
 #include "fuzzuf/feedback/inplace_memory_feedback.hpp"
 #include "fuzzuf/feedback/persistent_memory_feedback.hpp"
 #include "fuzzuf/feedback/put_exit_reason_type.hpp"
@@ -35,7 +36,7 @@ namespace fuzzuf::algorithm::nautilus::fuzzer {
 // MEMO: "this->" is used for members of Fuzzer in original Nautilus
 NautilusState::NautilusState(
     std::shared_ptr<const NautilusSetting> setting,
-    std::shared_ptr<NativeLinuxExecutor> executor
+    std::shared_ptr<executor::AFLExecutorInterface> executor
 ) : setting (setting),
     executor (executor),
     cks (setting->path_to_workdir.string()),

cli/fuzzers/afl/register_afl_fuzzer.cpp

@@ -18,6 +18,7 @@
 #include "fuzzuf/algorithms/afl/afl_fuzzer.hpp"
 #include "fuzzuf/cli/fuzzer_builder_register.hpp"
 #include "fuzzuf/cli/fuzzer/afl/build_afl_fuzzer_from_args.hpp"
+#include "fuzzuf/executor/afl_executor_interface.hpp"
 #include <boost/program_options.hpp>
 
 namespace fuzzuf::algorithm::afl {
@@ -26,6 +27,6 @@ namespace fuzzuf::algorithm::afl {
 // object file.
 // Conversely, if AFL cannot be built in a certain environment, do not compile it into an object file to prevent AFL
 // from being registered by accident.
-static FuzzerBuilderRegister global_afl_register("afl", BuildAFLFuzzerFromArgs<Fuzzer, AFLFuzzer>);
+static FuzzerBuilderRegister global_afl_register("afl", BuildAFLFuzzerFromArgs<Fuzzer, AFLFuzzer, executor::AFLExecutorInterface>);
 
 } // namespace fuzzuf::algorithm::afl

cli/fuzzers/aflfast/register_aflfast_fuzzer.cpp

@@ -18,13 +18,14 @@
 #include "fuzzuf/algorithms/aflfast/aflfast_fuzzer.hpp"
 #include "fuzzuf/cli/fuzzer_builder_register.hpp"
 #include "fuzzuf/cli/fuzzer/aflfast/build_aflfast_fuzzer_from_args.hpp"
+#include "fuzzuf/executor/afl_executor_interface.hpp"
 
 namespace fuzzuf::algorithm::aflfast {
 
 // builder_map.insert is called before main function if the below is declared as a global variable and linked as an
 // object file.
 // Conversely, if AFL cannot be built in a certain environment, do not compile it into an object file to prevent AFL
 // from being registered by accident.
-static FuzzerBuilderRegister global_afl_register("aflfast", BuildAFLFastFuzzerFromArgs<Fuzzer, AFLFastFuzzer>);
+static FuzzerBuilderRegister global_afl_register("aflfast", BuildAFLFastFuzzerFromArgs<Fuzzer, AFLFastFuzzer, executor::AFLExecutorInterface>);
 
 } // namespace fuzzuf::algorithm::aflfast

cli/fuzzers/die/register_die_fuzzer.cpp

@@ -23,9 +23,10 @@
 #include "fuzzuf/algorithms/die/die_fuzzer.hpp"
 #include "fuzzuf/cli/fuzzer_builder_register.hpp"
 #include "fuzzuf/cli/fuzzer/die/build_die_fuzzer_from_args.hpp"
+#include "fuzzuf/executor/afl_executor_interface.hpp"
 
 namespace fuzzuf::algorithm::die {
 
-static FuzzerBuilderRegister global_die_register("die", BuildDIEFuzzerFromArgs<Fuzzer, DIEFuzzer>);
+static FuzzerBuilderRegister global_die_register("die", BuildDIEFuzzerFromArgs<Fuzzer, DIEFuzzer, executor::AFLExecutorInterface>);
 
 } // namespace fuzzuf::algorithm::die

cli/fuzzers/ijon/register_ijon_fuzzer.cpp

@@ -19,13 +19,14 @@
 #include "fuzzuf/algorithms/ijon/ijon_fuzzer.hpp"
 #include "fuzzuf/cli/fuzzer_builder_register.hpp"
 #include "fuzzuf/cli/fuzzer/ijon/build_ijon_fuzzer_from_args.hpp"
+#include "fuzzuf/executor/afl_executor_interface.hpp"
 
 namespace fuzzuf::cli::fuzzer::ijon {
 
 // builder_map.insert is called before main function if the below is declared as a global variable and linked as an
 // object file.
 // Conversely, if IJON cannot be built in a certain environment, do not compile it into an object file to prevent IJON
 // from being registered by accident.
-static FuzzerBuilderRegister global_ijon_register("ijon", BuildIJONFuzzerFromArgs<Fuzzer, algorithm::ijon::IJONFuzzer>);
+static FuzzerBuilderRegister global_ijon_register("ijon", BuildIJONFuzzerFromArgs<Fuzzer, algorithm::ijon::IJONFuzzer, executor::AFLExecutorInterface>);
 
 } // namespace fuzzuf::cli::fuzzer::ijon

cli/fuzzers/libfuzzer/register_libfuzzer.cpp

@@ -18,8 +18,9 @@
 #include "fuzzuf/algorithms/libfuzzer/cli_compat/fuzzer.hpp"
 #include "fuzzuf/cli/fuzzer_builder_register.hpp"
 #include "fuzzuf/cli/fuzzer/libfuzzer/build_libfuzzer_from_args.hpp"
+#include "fuzzuf/executor/libfuzzer_executor_interface.hpp"
 
 namespace fuzzuf::algorithm::libfuzzer {
-  static FuzzerBuilderRegister global_libfuzzer_register("libfuzzer", BuildLibFuzzerFromArgs<Fuzzer, fuzzuf::algorithm::libfuzzer::LibFuzzer>);
+  static FuzzerBuilderRegister global_libfuzzer_register("libfuzzer", BuildLibFuzzerFromArgs<Fuzzer, fuzzuf::algorithm::libfuzzer::LibFuzzer, executor::LibFuzzerExecutorInterface>);
 }
 

cli/fuzzers/nautilus/register_nautilus_fuzzer.cpp

@@ -18,8 +18,13 @@
 #include "fuzzuf/algorithms/nautilus/fuzzer/fuzzer.hpp"
 #include "fuzzuf/cli/fuzzer_builder_register.hpp"
 #include "fuzzuf/cli/fuzzer/nautilus/build_nautilus_fuzzer_from_args.hpp"
+#include "fuzzuf/executor/afl_executor_interface.hpp"
+
+namespace fuzzuf::cli::fuzzer::nautilus {
 
 static FuzzerBuilderRegister global_nautilus_register(
   "nautilus",
-  BuildNautilusFuzzerFromArgs<Fuzzer, NautilusFuzzer>
+  BuildNautilusFuzzerFromArgs<Fuzzer, NautilusFuzzer, executor::AFLExecutorInterface>
 );
+
+} // namespace fuzzuf::cli::fuzzer::nautilus

cli/fuzzers/nezha/register_nezha_fuzzer.cpp

@@ -18,9 +18,10 @@
 #include "fuzzuf/algorithms/nezha/cli_compat/fuzzer.hpp"
 #include "fuzzuf/cli/fuzzer_builder_register.hpp"
 #include "fuzzuf/cli/fuzzer/nezha/build_nezha_fuzzer_from_args.hpp"
+#include "fuzzuf/executor/libfuzzer_executor_interface.hpp"
 #include <iostream>
 
 namespace fuzzuf::algorithm::nezha {
-  static FuzzerBuilderRegister global_nezha_register("nezha", BuildNezhaFuzzerFromArgs<Fuzzer, fuzzuf::algorithm::nezha::NezhaFuzzer>);
+  static FuzzerBuilderRegister global_nezha_register("nezha", BuildNezhaFuzzerFromArgs<Fuzzer, fuzzuf::algorithm::nezha::NezhaFuzzer, executor::LibFuzzerExecutorInterface>);
 }
 

include/fuzzuf/algorithms/afl/afl_state.hpp

@@ -24,7 +24,7 @@
 #include "fuzzuf/utils/common.hpp"
 #include "fuzzuf/utils/filesystem.hpp"
 #include "fuzzuf/exec_input/exec_input_set.hpp"
-#include "fuzzuf/executor/native_linux_executor.hpp"
+#include "fuzzuf/executor/afl_executor_interface.hpp"
 #include "fuzzuf/feedback/inplace_memory_feedback.hpp"
 #include "fuzzuf/feedback/exit_status_feedback.hpp"
 #include "fuzzuf/algorithms/afl/afl_option.hpp"
@@ -54,7 +54,7 @@ struct AFLStateTemplate {
     using Tag = typename Testcase::Tag;
 
     // FIXME: how to support other executors?
-    explicit AFLStateTemplate(std::shared_ptr<const AFLSetting> setting, std::shared_ptr<NativeLinuxExecutor> executor);
+    explicit AFLStateTemplate(std::shared_ptr<const AFLSetting> setting, std::shared_ptr<executor::AFLExecutorInterface> executor);
     virtual ~AFLStateTemplate();
 
     AFLStateTemplate( const AFLStateTemplate& ) = delete;
@@ -129,7 +129,7 @@ struct AFLStateTemplate {
     void SetShouldConstructAutoDict(bool v);
 
     std::shared_ptr<const AFLSetting> setting;
-    std::shared_ptr<NativeLinuxExecutor> executor;
+    std::shared_ptr<executor::AFLExecutorInterface> executor;
     ExecInputSet input_set;
 
     // TODO: what if this product works on environments other than *NIX?

include/fuzzuf/algorithms/afl/templates/afl_state.hpp

@@ -27,7 +27,7 @@
 #include "fuzzuf/utils/filesystem.hpp"
 #include "fuzzuf/exec_input/exec_input.hpp"
 #include "fuzzuf/exec_input/exec_input_set.hpp"
-#include "fuzzuf/executor/native_linux_executor.hpp"
+#include "fuzzuf/executor/afl_executor_interface.hpp"
 #include "fuzzuf/feedback/inplace_memory_feedback.hpp"
 #include "fuzzuf/feedback/exit_status_feedback.hpp"
 #include "fuzzuf/algorithms/afl/afl_option.hpp"
@@ -43,7 +43,7 @@ namespace fuzzuf::algorithm::afl {
 template<class Testcase>
 AFLStateTemplate<Testcase>::AFLStateTemplate(
     std::shared_ptr<const AFLSetting> setting,
-    std::shared_ptr<NativeLinuxExecutor> executor
+    std::shared_ptr<executor::AFLExecutorInterface> executor
 )
     : setting( setting ),
       executor( executor ),

include/fuzzuf/algorithms/aflfast/aflfast_state.hpp

@@ -28,7 +28,7 @@ namespace fuzzuf::algorithm::aflfast {
 struct AFLFastState : public afl::AFLStateTemplate<AFLFastTestcase> {
     explicit AFLFastState(
         std::shared_ptr<const AFLFastSetting> setting,
-        std::shared_ptr<NativeLinuxExecutor> executor
+        std::shared_ptr<executor::AFLExecutorInterface> executor
     );
 
     std::shared_ptr<AFLFastTestcase> AddToQueue(

include/fuzzuf/algorithms/die/die_state.hpp

@@ -35,7 +35,7 @@ namespace fuzzuf::algorithm::die {
 struct DIEState : public afl::AFLStateTemplate<DIETestcase> {
   explicit DIEState(
     std::shared_ptr<const DIESetting> setting,
-    std::shared_ptr<NativeLinuxExecutor> executor
+    std::shared_ptr<executor::AFLExecutorInterface> executor
   ) : AFLStateTemplate<DIETestcase>(setting, executor),
       setting(setting) {};
 

include/fuzzuf/algorithms/ijon/ijon_state.hpp

@@ -24,7 +24,7 @@
 
 #include "fuzzuf/utils/filesystem.hpp"
 #include "fuzzuf/exec_input/exec_input_set.hpp"
-#include "fuzzuf/executor/native_linux_executor.hpp"
+#include "fuzzuf/executor/afl_executor_interface.hpp"
 #include "fuzzuf/algorithms/afl/afl_state.hpp"
 #include "fuzzuf/algorithms/ijon/ijon_option.hpp"
 #include "fuzzuf/algorithms/ijon/ijon_testcase.hpp"
@@ -38,7 +38,7 @@ namespace fuzzuf::algorithm::ijon {
  * The lifetime for an instance of this class must be longer than that of HierarFlow.
  */
 struct IJONState : public afl::AFLStateTemplate<IJONTestcase> {
-    explicit IJONState(std::shared_ptr<const afl::AFLSetting> setting, std::shared_ptr<NativeLinuxExecutor> executor);
+    explicit IJONState(std::shared_ptr<const afl::AFLSetting> setting, std::shared_ptr<executor::AFLExecutorInterface> executor);
     ~IJONState();
 
     IJONState( const IJONState& ) = delete;

include/fuzzuf/algorithms/libfuzzer/config.hpp

@@ -22,7 +22,7 @@
 #ifndef FUZZUF_INCLUDE_ALGORITHM_LIBFUZZER_CONFIG_HPP
 #define FUZZUF_INCLUDE_ALGORITHM_LIBFUZZER_CONFIG_HPP
 
-#include "fuzzuf/executor/native_linux_executor.hpp"
+#include "fuzzuf/executor/libfuzzer_executor_interface.hpp"
 #include "fuzzuf/utils/filesystem.hpp"
 #include "fuzzuf/utils/setter.hpp"
 #include <vector>

include/fuzzuf/algorithms/libfuzzer/create.hpp

@@ -119,19 +119,21 @@ auto createExecuteAndFeedback(const fs::path &target_path,
                               bool persistent, bool strict_match,
                               const Sink &sink) {
   namespace hf = fuzzuf::hierarflow;
+  using fuzzuf::executor::LibFuzzerExecutorInterface;
 
   const auto output_file_path = create_info.output_dir / "result";
   const auto path_to_write_seed = create_info.output_dir / "cur_input";
 
   auto create_coverage = hf::CreateNode<Clear<F, decltype(Ord::coverage)>>();
 
-  std::unique_ptr<NativeLinuxExecutor> executor_(new NativeLinuxExecutor(
+  std::shared_ptr<NativeLinuxExecutor> nle_(new NativeLinuxExecutor(
       {target_path.string(), output_file_path.string()},
       create_info.exec_timelimit_ms, create_info.exec_memlimit,
       create_info.forksrv, path_to_write_seed, create_info.afl_shm_size,
       create_info.bb_shm_size));
+  auto executor_ = std::make_unique<LibFuzzerExecutorInterface>(std::move(nle_));
   auto execute_ =
-      hf::CreateNode<standard_order::Execute<F, NativeLinuxExecutor, Ord>>(
+      hf::CreateNode<standard_order::Execute<F, LibFuzzerExecutorInterface, Ord>>(
           std::move(executor_), create_info.use_afl_coverage);
 
   auto collect_features =

include/fuzzuf/algorithms/nautilus/fuzzer/state.hpp

@@ -36,7 +36,7 @@
 #include "fuzzuf/algorithms/nautilus/grammartec/context.hpp"
 #include "fuzzuf/algorithms/nautilus/grammartec/mutator.hpp"
 #include "fuzzuf/algorithms/nautilus/grammartec/tree.hpp"
-#include "fuzzuf/executor/native_linux_executor.hpp"
+#include "fuzzuf/executor/afl_executor_interface.hpp"
 
 
 namespace fuzzuf::algorithm::nautilus::fuzzer {
@@ -51,7 +51,7 @@ enum ExecutionReason {
 struct NautilusState {
   explicit NautilusState(
     std::shared_ptr<const NautilusSetting> setting,
-    std::shared_ptr<NativeLinuxExecutor> executor
+    std::shared_ptr<executor::AFLExecutorInterface> executor
   );
 
   bool RunOnWithDedup(const TreeLike& tree,
@@ -81,7 +81,7 @@ struct NautilusState {
                                  size_t end_index);
 
   std::shared_ptr<const NautilusSetting> setting;
-  std::shared_ptr<NativeLinuxExecutor> executor;
+  std::shared_ptr<executor::AFLExecutorInterface> executor;
 
   /* Local state */
   Context ctx;

include/fuzzuf/algorithms/nezha/create.hpp

@@ -63,19 +63,21 @@ auto CreateRunSingleTarget(const fs::path &target_path,
                            const Sink &sink) {
   namespace lf = fuzzuf::algorithm::libfuzzer;
   namespace hf = fuzzuf::hierarflow;
+  using fuzzuf::executor::LibFuzzerExecutorInterface;
   auto create_local_coverage =
       hf::CreateNode<lf::Clear<F, decltype(Ord::coverage)>>();
 
   const auto output_file_path = create_info.output_dir / "result";
   const auto path_to_write_seed = create_info.output_dir / "cur_input";
 
-  std::unique_ptr<NativeLinuxExecutor> executor(new NativeLinuxExecutor(
+  std::shared_ptr<NativeLinuxExecutor> nle(new NativeLinuxExecutor(
       {target_path.string(), output_file_path.string()},
       create_info.exec_timelimit_ms, create_info.exec_memlimit,
       create_info.forksrv, path_to_write_seed, create_info.afl_shm_size,
       create_info.bb_shm_size, true));
+  auto executor = std::make_unique<LibFuzzerExecutorInterface>(std::move(nle));
   auto execute =
-      hf::CreateNode<lf::standard_order::Execute<F, NativeLinuxExecutor, Ord>>(
+      hf::CreateNode<lf::standard_order::Execute<F, LibFuzzerExecutorInterface, Ord>>(
           std::move(executor), create_info.use_afl_coverage);
   auto collect_features =
       hf::CreateNode<standard_order::CollectFeatures<F, Ord>>(

include/fuzzuf/cli/fuzzer/afl/build_afl_fuzzer_from_args.hpp

@@ -55,7 +55,7 @@ static void usage(po::options_description &desc) {
 }
 
 // Used only for CLI
-template <class TFuzzer, class TAFLFuzzer>
+template <class TFuzzer, class TAFLFuzzer, class TExecutor>
 std::unique_ptr<TFuzzer> BuildAFLFuzzerFromArgs(
     FuzzerArgs &fuzzer_args, 
     GlobalFuzzerOptions &global_options
@@ -157,9 +157,7 @@ std::unique_ptr<TFuzzer> BuildAFLFuzzerFromArgs(
     using fuzzuf::algorithm::afl::option::GetMapSize;
 
     // Create NativeLinuxExecutor
-    // TODO: support more types of executors
-
-    auto executor = std::make_shared<NativeLinuxExecutor>(
+    auto nle = std::make_shared<NativeLinuxExecutor>(
                         setting->argv,
                         setting->exec_timelimit_ms,
                         setting->exec_memlimit,
@@ -169,6 +167,9 @@ std::unique_ptr<TFuzzer> BuildAFLFuzzerFromArgs(
                                            0  //  bb_shm_size
                     );
 
+    // TODO: support more types of executors
+    auto executor = std::make_shared<TExecutor>(std::move(nle));
+
     // Create AFLState
     using fuzzuf::algorithm::afl::AFLState;
     auto state = std::make_unique<AFLState>(setting, executor);

include/fuzzuf/cli/fuzzer/aflfast/build_aflfast_fuzzer_from_args.hpp

@@ -54,7 +54,7 @@ static void usage(po::options_description &desc) {
 
 
 // Used only for CLI
-template <class TFuzzer, class TAFLFuzzer>
+template <class TFuzzer, class TAFLFuzzer, class TExecutor>
 std::unique_ptr<TFuzzer> BuildAFLFastFuzzerFromArgs(
     FuzzerArgs &fuzzer_args, 
     GlobalFuzzerOptions &global_options
@@ -156,9 +156,7 @@ std::unique_ptr<TFuzzer> BuildAFLFastFuzzerFromArgs(
     using fuzzuf::algorithm::afl::option::GetMapSize;
 
     // Create NativeLinuxExecutor
-    // TODO: support more types of executors
-
-    auto executor = std::make_shared<NativeLinuxExecutor>(
+    auto nle = std::make_shared<NativeLinuxExecutor>(
                         setting->argv,
                         setting->exec_timelimit_ms,
                         setting->exec_memlimit,
@@ -168,6 +166,9 @@ std::unique_ptr<TFuzzer> BuildAFLFastFuzzerFromArgs(
                                            0      //  bb_shm_size
                     );
 
+    // TODO: support more types of executors
+    auto executor = std::make_shared<TExecutor>(std::move(nle));
+
     // Create AFLFastState
     using fuzzuf::algorithm::aflfast::AFLFastState;
     auto state = std::make_unique<AFLFastState>(setting, executor);

include/fuzzuf/cli/fuzzer/die/build_die_fuzzer_from_args.hpp

@@ -71,7 +71,7 @@ struct DIEOptions {
  * @param (fuzzer_args) Arguments passed to DIE
  * @param (global_options) Global options
  */
-template <class TFuzzer, class TDIEFuzzer>
+template <class TFuzzer, class TDIEFuzzer, class TExecutor>
 std::unique_ptr<TFuzzer> BuildDIEFuzzerFromArgs(FuzzerArgs &fuzzer_args,
                                                 GlobalFuzzerOptions &global_options) {
   po::positional_options_description pargs_desc;
@@ -184,7 +184,7 @@ std::unique_ptr<TFuzzer> BuildDIEFuzzerFromArgs(FuzzerArgs &fuzzer_args,
   using fuzzuf::algorithm::afl::option::GetMapSize;
 
   /* Create NativeLinuxExecutor */
-  auto executor = std::make_shared<NativeLinuxExecutor>(
+  auto nle = std::make_shared<NativeLinuxExecutor>(
     setting->argv,
     setting->exec_timelimit_ms,
     setting->exec_memlimit,
@@ -194,6 +194,8 @@ std::unique_ptr<TFuzzer> BuildDIEFuzzerFromArgs(FuzzerArgs &fuzzer_args,
     0 // bb_shm_size
   );
 
+  auto executor = std::make_shared<TExecutor>(std::move(nle));
+
   using fuzzuf::algorithm::die::DIEState;
 
   /* Create state for DIE */