86_instruction_emulator/fuzz-emul.c
@@ -21,7 +21,9 @@
=20
#define SEG_NUM x86_seg_none
=20
-struct input_struct {
+/* Layout of data expected as fuzzing input. */
+struct fuzz_corpus
+{
unsigned long cr[5];
uint64_t msr[MSR_INDEX_MAX];
struct cpu_user_regs regs;
@@ -29,19 +31,36 @@ struct input_struct {
unsigned long options;
unsigned char data[4096];
} input;
-#define DATA_OFFSET offsetof(struct input_struct, data)
-static unsigned int data_index;
-static unsigned int data_num;
+#define DATA_OFFSET offsetof(struct fuzz_corpus, data)
+
+/*
+ * Internal state of the fuzzing harness. Calculated initially from the i=
nput
+ * corpus, and later mutates by the emulation callbacks.
+ */
+struct fuzz_state
+{
+ /* Fuzzer's input data. */
+ struct fuzz_corpus *corpus;
+
+ /* Real amount of data backing corpus->data[]. */
+ size_t data_num;
+
+ /* Amount of corpus->data[] consumed thus far. */
+ size_t data_index;
+};
=20
/*
* Randomly return success or failure when processing data. If
* `exception` is false, this function turns _EXCEPTION to _OKAY.
*/
-static int maybe_fail(const char *why, bool exception)
+static int maybe_fail(struct x86_emulate_ctxt *ctxt,
+ const char *why, bool exception)
{
+ struct fuzz_state *s =3D ctxt->data;
+ const struct fuzz_corpus *c =3D s->corpus;
int rc;
=20
- if ( data_index >=3D data_num )
+ if ( s->data_index >=3D s->data_num )
rc =3D X86EMUL_EXCEPTION;
else