86_instruction_emulator/fuzz-emul.c
@@ -21,7 +21,9 @@
=20
#define SEG_NUM x86_seg_none
=20
-struct input_struct {
+/* Layout of data expected as fuzzing input. */
+struct fuzz_corpus
+{
unsigned long cr[5];
uint64_t msr[MSR_INDEX_MAX];
struct cpu_user_regs regs;
@@ -29,19 +31,36 @@ struct input_struct {
unsigned long options;
unsigned char data[4096];
} input;
-#define DATA_OFFSET offsetof(struct input_struct, data)
-static unsigned int data_index;
-static unsigned int data_num;
+#define DATA_OFFSET offsetof(struct fuzz_corpus, data)
+
+/*
+ * Internal state of the fuzzing harness. Calculated initially from the i=
nput
+ * corpus, and later mutates by the emulation callbacks.
+ */
+struct fuzz_state
+{
+ /* Fuzzer's input data. */
+ struct fuzz_corpus *corpus;
+
+ /* Real amount of data backing corpus->data[]. */
+ size_t data_num;
+
+ /* Amount of corpus->data[] consumed thus far. */
+ size_t data_index;
+};
=20
/*
* Randomly return success or failure when processing data. If
* `exception` is false, this function turns _EXCEPTION to _OKAY.
*/
-static int maybe_fail(const char *why, bool exception)
+static int maybe_fail(struct x86_emulate_ctxt *ctxt,
+ const char *why, bool exception)
{
+ struct fuzz_state *s =3D ctxt->data;
+ const struct fuzz_corpus *c =3D s->corpus;
int rc;
=20
- if ( data_index >=3D data_num )
+ if ( s->data_index >=3D s->data_num )
rc =3D X86EMUL_EXCEPTION;
else
** Delivery incomplete ** There was a temporary problem delivering your message to curtiskwong9@gmail.com. Gmail will retry for 21 more hours. You'll be notified if the delivery fails permanently. The response was: Receive rate too high ; Wed, 12 Apr 2017 09:02:31 -0700 (PDT) Return-Path: <FWD-737QHYSMHVAYQAUCAOIQBDAAGAQLMA2YAMHECCJDLIBAYAWYAKIAZAQHS= MCCWMBLIA4UANQUEIGCIMBKMAZUZ4AAEAACA=3D=3D=3D@opayq.com> Received: from [23.21.143.60] (smtp4.opayq.com. [23.21.143.60]) by mx.google.com with ESMTPS id f7si19900306qtf.104.2017.04.12.09.0= 2.31 for <curtiskwong9@gmail.com> (version=3DTLS1_2 cipher=3DAES128-SHA bits=3D128/128); Wed, 12 Apr 2017 09:02:31 -0700 (PDT) Received-SPF: pass (google.com: domain of fwd-737qhysmhvayqaucaoiqbdaagaqlm= a2yamheccjdlibayawyakiazaqhsmccwmblia4uanqueigcimbkmazuz4aaeaaca=3D=3D=3D@o= payq.com designates 23.21.143.60 as permitted sender) client-ip=3D23.21.143= .60; Authentication-Results: mx.google.com; dkim=3Dpass header.i=3D@opayq.com; spf=3Dpass (google.com: domain of fwd-737qhysmhvayqaucaoiqbdaagaqlma= 2yamheccjdlibayawyakiazaqhsmccwmblia4uanqueigcimbkmazuz4aaeaaca=3D=3D=3D@op= ayq.com designates 23.21.143.60 as permitted sender) smtp.mailfrom=3DFWD-73= 7QHYSMHVAYQAUCAOIQBDAAGAQLMA2YAMHECCJDLIBAYAWYAKIAZAQHSMCCWMBLIA4UANQUEIGCI= MBKMAZUZ4AAEAACA=3D=3D=3D@opayq.com DKIM-Signature: v=3D1; d=3Dopayq.com; t=3D1492012949; b=3DlNMvW4qO5SAnjc5qB= h7LE8l9d5rNgWOFXIFXbpT6PHyjWh5VSrCSTbyO7DCgBgrtQgELCZHlxgr6C/iwLDEJj07+8B4X= 4Go+m7rOYgQHjN4UoKU5modxwch+KikuuLi/X6aC1gCb0lp23cdQQhQZWaFFjUeF9MGmT42gYYt= LEK0=3D; s=3Dabine; c=3Drelaxed/relaxed; a=3Drsa-sha256; bh=3DmR+bU3SgWYDwE= +TQsgekraNC5ZywMSIHKTctywSxFdY=3D; h=3DDate:From:Reply-To:Subject:To:List-U= nsubscribe; MIME-Version: 1.0 Content-Type: text/plain; charset=3D"utf-8" Content-Transfer-Encoding: 7bit X-GetAbine-Processed: 1 From: "lists.xen.org [Masked]" <FWD-737QHYSMHVAYQAUCAOIQBDAAGAQLMA2YAMHECCJ= DLIBAYAWYAKIAZAQHSMCCWMBLIA4UANQUEIGCIMBKMAZUZ4AAEAACA=3D=3D=3D@opayq.com> Sender: "lists.xen.org [Masked]" <FWD-737QHYSMHVAYQAUCAOIQBDAAGAQLMA2YAMHEC= CJDLIBAYAWYAKIAZAQHSMCCWMBLIA4UANQUEIGCIMBKMAZUZ4AAEAACA=3D=3D=3D@opayq.com= > Reply-To:=20 FWD-737QHYSMHVAYQAUCAOIQBDAAGAQLMA2YAMHECCJDLIBAYAWYAKIAZAQHSMCCWMBLIA4UAN= QUEIGCIMBKMAZUZ4AAEAACA=3D=3D=3D@opayq.com To: f4da1594@opayq.com X-GetAbine-Sender: xen-changelog-bounces@lists.xen.org X-GetAbine-Disposable: f4da1594@opayq.com X-GetAbine-Host-Address: 23.21.143.60 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrDLMWRWlGSWpSXmKPExsWS0XRdVVdW412 EwZn7yhYTthk4MHps79vFHsAYxZqZl5RfkcCasXv5VraC4/UVK2ZXNDBuTehi5OIQEvjCKNG/ uY0RwjnPKLFy23KmLkYODjYBMYm5exW6GDk5RARUJWatWM4MYgsJqEs0/W5gA7GFBdwk9h07C xbnFTCTeNN0AizOAlT/8t5mxgmMHAsYGVYxahSnFpWlFukaGuolFWWmZ5TkJmbm6BoamOnlph YXJ6an5iQmFesl5+duYgT6hAEIdjB+WhZwiFGSg0lJlPeywtsIIb6k/JTKjMTijPii0pzU4kO MMhwcShK8R9XeRQgJFqWmp1akZeYAgwMmLcHBoyTCmwKS5i0uSMwtzkyHSJ1i1OV4t/TDeyYh lrz8vFQpcV5jdaAiAZCijNI8uBGwQL3EKCslzMsIdJQQT0FqUW5mCar8K0ZxDkYlYd6XIKt4M vNK4Da9AjqCCeiItXvfghxRkoiQkmpg3Peqe5tfzYmvKZbTljupPYyqfxx3drF5WcbzN3tjDp xuvCP8xVbZe5qC/eeO9PtBBydnfqjSP9H1Wdxe8KPZ1evPnSa2Hfu8b2PopJpEucPXnhxuPbv hwJmnzrG1TGyPqnp5+csffp995rbymo/npeR2c++NPXpIWVOxt9zRdvX/W4pa4nxfpyuxFGck GmoxFxUnAgC7LLY0TwIAAA=3D=3D X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-14.tower-27.messagelabs.com!1492002844!84565039!1 X-Originating-IP: [104.130.215.37] X-SpamReason: No, hits=3D0.5 required=3D7.0 tests=3DBODY_RANDOM_LONG X-StarScan-Received:=20 X-StarScan-Version: 9.4.12; banners=3D-,-,- X-VirusChecked: Checked Message-Id: <E1cyI60-0001sg-Cd@xenbits.xenproject.org> Date: Wed, 12 Apr 2017 13:14:04 +0000 Subject: [Xen-changelog] [xen master] tools/insn-fuzz: Avoid making use of static data X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: "Change log for Mercurial \(receive only\)" <xen-changelog.lists.xen.org> List-Unsubscribe: <https://lists.xen.org/cgi-bin/mailman/options/xen-change= log>,=20 <mailto:xen-changelog-request@lists.xen.org?subject=3Dunsubscribe> List-Unsubscribe: <mailto:unsubscribe-1188110264-f4da1594@opayq.com>, <http= s://emails.abine.com/disableDisposable?fwd=3DFWD-737QHYSMHVAYQAUCAOIQBDAAGA= QLMA2YAMHECCJDLIBAYAWYAKIAZAQHSMCCWMBLIA4UANQUEIGCIMBKMAZUZ4AAEAACA=3D=3D= =3D@opayq.com> List-Post: <mailto:xen-changelog@lists.xen.org> List-Help: <mailto:xen-changelog-request@lists.xen.org?subject=3Dhelp> List-Subscribe: <https://lists.xen.org/cgi-bin/mailman/listinfo/xen-changel= og>,=20 <mailto:xen-changelog-request@lists.xen.org?subject=3Dsubscribe> -------------------------Blur------------------------- This email is forwarded from a MASKED EMAIL you created using Blur. (https= ://dnt.abine.com/#help/faq/faq-whataremaskedemails). IF THIS IS SPAM, CLICK HERE TO BLOCK: https://dnt.abine.com/#/block_email/f4da1594@opayq.com/FWD-737QHYSMHVAYQAUC= AOIQBDAAGAQLMA2YAMHECCJDLIBAYAWYAKIAZAQHSMCCWMBLIA4UANQUEIGCIMBKMAZUZ4AAEAA= CA=3D=3D=3D@opayq.com Want to shop safely and privately online? Go Premium: https://dnt.abine.com= /?pk_campaign=3DmaskHeader#premium -------------------------by Abine------------------------- commit b163e550df2127b2bd1fbce682bed87e8d18d0dc Author: Andrew Cooper <andrew.cooper3@citrix.com> AuthorDate: Mon Mar 20 18:33:59 2017 +0000 Commit: Andrew Cooper <andrew.cooper3@citrix.com> CommitDate: Thu Apr 6 18:42:49 2017 +0100 tools/insn-fuzz: Avoid making use of static data =20 AFL has a measure of stability, where it passes the same corpus into th= e fuzzing harness and observes whether the execution path changes from be= fore. Any instability in the fuzzing harness reduces its effectiveness, as an observed crash may not reliably be caused by the original corpus. =20 In preparation to fix a stability bug, introduce struct fuzz_state, all= ocated on the stack and passed around via struct x86_emulate_ctxt's data param= eter. Propagate ctxt into the helpers such as maybe_fail(), so the state can = be retrieved. =20 Move the previously-static data_{index,num} into struct fuzz_state. =20 Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> --- tools/fuzz/x86_instruction_emulator/fuzz-emul.c | 181 +++++++++++++++-----= ---- 1 file changed, 116 insertions(+), 65 deletions(-) { @@ -50,13 +69,13 @@ static int maybe_fail(const char *why, bool exception) * 25% unhandlable * 25% exception */ - if ( input.data[data_index] > 0xc0 ) + if ( c->data[s->data_index] > 0xc0 ) rc =3D X86EMUL_EXCEPTION; - else if ( input.data[data_index] > 0x80 ) + else if ( c->data[s->data_index] > 0x80 ) rc =3D X86EMUL_UNHANDLEABLE; else rc =3D X86EMUL_OKAY; - data_index++; + s->data_index++; } =20 =20 ----- Message truncated -----