Question on Grammar-based mutation

[leepeter2019]

1. If there are seeds in input folder in the beginning, it failed to run with this message:
   FATAL("Incorrectly encoded grammar sample");
   I found it is generated becase of if sentence as below:
   bool GrammarFuzzer::OutputFilter(Sample* original_sample, Sample* output_sample, ThreadContext* tc) {
   uint64_t string_size = ((uint64_t)original_sample->bytes);
   if (original_sample->size < (string_size + sizeof(string_size))) {
   FATAL("Incorrectly encoded grammar sample");
   }
   I dont understant exact meaning of "if (original_sample->size < (string_size + sizeof(string_size)))": why do you put this comparison here?

2. I began to run javascript fuzzer with empty files in input folder. it continues to generate samples in sample folder, but most (almost everything) is grammar/syntantically incorrect. so it could not pass the parsing process at all. Do you have any idea to solve this problem? In the Domato fuzzer, you put trycatch phrases for every sentence. Is any easy way to put trycatch phrases for sentence? or do you have other options to solve it?

Thank you for reading my issue.
Best.

[ifratric]

Hi!

For 1) see the answers in #26

For 2), this is where

Jackalope/main.cpp

Line 159 in 73ebb84

bool GrammarFuzzer::IsReturnValueInteresting(uint64_t return_value) {

comes in :-) Your target function can return 0 if the target is parsed correctly, and any other value otherwise. That way, only correctly parsed samples get saved.

[leepeter2019]

Thanks.