Skip to content

Commit 48cc2a7

Browse files
committed
libfuzzer: fix looking at wrong memory for pc counters
this fix bypasses the slice bounds, reading garbage data for up to the last 7 bits (which are technically supposed to be ignored). that's going to need to be fixed, let's fix that along with switching from byte elems to usize elems.
1 parent ddfbac2 commit 48cc2a7

File tree

1 file changed

+10
-10
lines changed

1 file changed

+10
-10
lines changed

lib/fuzzer.zig

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -276,7 +276,7 @@ const Fuzzer = struct {
276276
.score = 0,
277277
}, {});
278278
} else {
279-
if (f.n_runs % 1000 == 0) f.dumpStats();
279+
if (f.n_runs % 10000 == 0) f.dumpStats();
280280

281281
const analysis = f.analyzeLastRun();
282282
const gop = f.recent_cases.getOrPutAssumeCapacity(.{
@@ -303,16 +303,16 @@ const Fuzzer = struct {
303303
{
304304
const seen_pcs = f.seen_pcs.items[@sizeOf(SeenPcsHeader) + f.flagged_pcs.len * @sizeOf(usize) ..];
305305
for (seen_pcs, 0..) |*elem, i| {
306-
const byte_i = i / 8;
306+
const byte_i = i * 8;
307307
const mask: u8 =
308-
(@as(u8, @intFromBool(f.pc_counters[byte_i + 0] != 0)) << 0) |
309-
(@as(u8, @intFromBool(f.pc_counters[byte_i + 1] != 0)) << 1) |
310-
(@as(u8, @intFromBool(f.pc_counters[byte_i + 2] != 0)) << 2) |
311-
(@as(u8, @intFromBool(f.pc_counters[byte_i + 3] != 0)) << 3) |
312-
(@as(u8, @intFromBool(f.pc_counters[byte_i + 4] != 0)) << 4) |
313-
(@as(u8, @intFromBool(f.pc_counters[byte_i + 5] != 0)) << 5) |
314-
(@as(u8, @intFromBool(f.pc_counters[byte_i + 6] != 0)) << 6) |
315-
(@as(u8, @intFromBool(f.pc_counters[byte_i + 7] != 0)) << 7);
308+
(@as(u8, @intFromBool(f.pc_counters.ptr[byte_i + 0] != 0)) << 0) |
309+
(@as(u8, @intFromBool(f.pc_counters.ptr[byte_i + 1] != 0)) << 1) |
310+
(@as(u8, @intFromBool(f.pc_counters.ptr[byte_i + 2] != 0)) << 2) |
311+
(@as(u8, @intFromBool(f.pc_counters.ptr[byte_i + 3] != 0)) << 3) |
312+
(@as(u8, @intFromBool(f.pc_counters.ptr[byte_i + 4] != 0)) << 4) |
313+
(@as(u8, @intFromBool(f.pc_counters.ptr[byte_i + 5] != 0)) << 5) |
314+
(@as(u8, @intFromBool(f.pc_counters.ptr[byte_i + 6] != 0)) << 6) |
315+
(@as(u8, @intFromBool(f.pc_counters.ptr[byte_i + 7] != 0)) << 7);
316316

317317
_ = @atomicRmw(u8, elem, .Or, mask, .monotonic);
318318
}

0 commit comments

Comments
 (0)