Skip to content

add ssa_afl_fuzzer, export SSA parser and interpreter#8640

Draft
michaeljklein wants to merge 19 commits intomasterfrom
michaeljklein/afl_ssa_fuzzer_branching
Draft

add ssa_afl_fuzzer, export SSA parser and interpreter#8640
michaeljklein wants to merge 19 commits intomasterfrom
michaeljklein/afl_ssa_fuzzer_branching

Conversation

@michaeljklein
Copy link
Contributor

@michaeljklein michaeljklein commented May 22, 2025

Description

Problem*

It's hard to write a valid-input-AST generator while also generating counterintuitive SSA programs.

Summary*

#8407 is focused on modifying the existing ssa_fuzzer while this PR is focused on a new afl.rs fuzzer using the SSA interpreter.

  1. I was able to avoid writing a valid-input-AST generator by using the following to filter afl.rs-detected crashes:
  • std::process::exit(0) to filter invalid-input errors
  • The stacker crate to filter out stack overflow errors
  1. I found test cases for the defunctionalize SSA pass using this fuzzer: chore(test): add panicking tests for 'defunctionalize' #8510

Additional Context

  • I based this off of sn/ssa_fuzzer_branching, which was WIP when I started, to get the latest support for CFG-related instructions
  • Renamed from afl_ssa_fuzzer_branching
  • afl.rs docs
  • I think that std::process::exit(0)'s should only be enabled when a fuzzing-specific cfg feature is enabled

Documentation*

Check one:

  • No documentation needed.
  • Documentation included in this PR.
  • [For Experimental Features] Documentation to be submitted in a separate PR.

PR Checklist*

  • I have tested the changes locally.
  • I have formatted the changes with Prettier and/or cargo fmt on default settings.

defkit and others added 19 commits April 23, 2025 14:29
…llect_outputs' script, 'collect_unique_crashes' script, 'keep_inputs_upto_1kb', script for unique locations
… input files for fuzzing next pass, replace all blocking-panic locations during input validation (before the target pass) with successful exits, fix hang and clear previous outputs in collect_unique_crashes.rb, fuzzing 'inline_functions_with_at_most_one_instruction', use uninitalized parameters for all fuzzing-input parameters, add fuzzing readme, add some fuzzing results
…to 2kb, make_combined_inputs.rb, add final results from fuzz's
…missing fn, add results, update readme, fix borrow error from cloning parameters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants