mirror of
https://github.com/cloud-hypervisor/cloud-hypervisor.git
synced 2026-08-05 02:19:16 +00:00
fuzz: explicitly keep or reject fuzzer corpus
When the main fuzzer function returns (), it is equivalent to returning Corpus::Keep. In some of the return paths, we want to reject the input so that the libfuzzer won't spend more time mutating them. The should make fuzzing more efficient. No functional change intended. Signed-off-by: Wei Liu <liuwe@microsoft.com>
This commit is contained in:
@@ -8,7 +8,7 @@ use std::path::PathBuf;
|
||||
use std::sync::mpsc::{channel, Receiver};
|
||||
use std::thread;
|
||||
|
||||
use libfuzzer_sys::fuzz_target;
|
||||
use libfuzzer_sys::{fuzz_target, Corpus};
|
||||
use micro_http::Request;
|
||||
use once_cell::sync::Lazy;
|
||||
use vm_migration::MigratableError;
|
||||
@@ -27,9 +27,9 @@ use vmm_sys_util::eventfd::EventFd;
|
||||
static ROUTES: Lazy<Vec<&Box<dyn EndpointHandler + Sync + Send>>> =
|
||||
Lazy::new(|| HTTP_ROUTES.routes.values().collect());
|
||||
|
||||
fuzz_target!(|bytes| {
|
||||
fuzz_target!(|bytes: &[u8]| -> Corpus {
|
||||
if bytes.len() < 2 {
|
||||
return;
|
||||
return Corpus::Reject;
|
||||
}
|
||||
|
||||
let route = ROUTES[bytes[0] as usize % ROUTES.len()];
|
||||
@@ -53,6 +53,8 @@ fuzz_target!(|bytes| {
|
||||
exit_evt.write(1).ok();
|
||||
http_receiver_thread.join().unwrap();
|
||||
};
|
||||
|
||||
Corpus::Keep
|
||||
});
|
||||
|
||||
fn generate_request(bytes: &[u8]) -> Option<Request> {
|
||||
|
||||
Reference in New Issue
Block a user