NO MERGE -- all the automatic bugfixes in a single branch Part 3

differential/Cargo.toml

@@ -7,3 +7,26 @@ description = "The Rust side of the differential fuzzing harness for pathmap's z
 
 [dependencies]
 pathmap = { path = "..", features = ["arena_compact"] }
+# `crash_fuzz` attributes segfaults and aborts to an input from a signal handler.
+libc = "0.2"
+# Only for `bin/afl_differential.rs`, behind the `afl` feature, so a plain
+# `cargo build -p differential` neither needs it nor builds it.  See that file.
+afl = { version = "0.18", optional = true }
+
+[features]
+afl = ["dep:afl"]
+
+# Coverage-guided front end for the in-process comparator.  Declared explicitly
+# rather than left to src/bin autodiscovery so it can carry `required-features`:
+# without it, `cargo build -p differential` would try to compile a file that
+# needs the `afl` crate.  Build it with `cargo afl build`, not `cargo build` --
+# the instrumentation is a rustc flag `cargo afl` sets.
+[[bin]]
+name = "afl_differential"
+path = "src/bin/afl_differential.rs"
+required-features = ["afl"]
+
+[[bin]]
+name = "afl_crash"
+path = "src/bin/afl_crash.rs"
+required-features = ["afl"]

differential/crash_shrink.py

@@ -0,0 +1,89 @@
+#!/usr/bin/env python3
+"""Shrink an input that makes `crash_fuzz` fail, keeping the failure the same.
+
+    differential/crash_shrink.py <input.bin> [-o out.bin] [--timeout SECS] [--bin PATH]
+
+The failure is identified by its kind and, for a panic, its site (file:line and
+the message with numbers blanked), as `crash_fuzz --keep-going` groups them.  A
+hang is identified by the kind alone and tested with a short timeout, so shrink
+hangs with a timeout comfortably above how long the input takes to get stuck.
+
+Greedy: delete chunks of halving size from the end towards the start, then try
+lowering each byte, keeping any change that preserves the failure.
+"""
+import argparse, os, re, subprocess, sys, tempfile
+
+ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+
+
+def signature(binary, blob, timeout, tmp):
+    with open(tmp, "wb") as f:
+        f.write(blob)
+    try:
+        p = subprocess.run([binary, tmp, "-j", "1", "--timeout", str(timeout)],
+                           capture_output=True, timeout=timeout + 20)
+    except subprocess.TimeoutExpired:
+        return "hang"
+    err = p.stderr.decode(errors="replace")
+    m = re.search(r"CRASH .*?kind=(\w+).*?(?:msg=(.*))?$", err, re.M)
+    if not m:
+        return None if p.returncode in (0,) else "exit %d" % p.returncode
+    kind, msg = m.group(1), m.group(2) or ""
+    if kind == "panic":
+        site = re.sub(r"\b\d+\b", "N", msg.split(" | ")[0])
+        site = re.sub(r"(src/[\w/]+\.rs):N:N", lambda s: s.group(0), site)
+        loc = re.search(r"panicked at (\S+?):(\d+):(\d+)", msg)
+        return "panic %s:%s %s" % (loc.group(1), loc.group(2), site.split(": ", 1)[-1]) if loc else "panic " + site
+    if kind == "signal":
+        return "signal " + msg.split(" ")[1] if msg else "signal"
+    return kind
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("input")
+    ap.add_argument("-o", "--out")
+    ap.add_argument("--timeout", type=int, default=3)
+    ap.add_argument("--bin", default=os.path.join(ROOT, "target", "release", "crash_fuzz"))
+    a = ap.parse_args()
+    blob = open(a.input, "rb").read()
+    tmp = os.path.join(tempfile.gettempdir(), "crash-shrink-%d.bin" % os.getpid())
+    want = signature(a.bin, blob, a.timeout, tmp)
+    if want is None:
+        sys.exit("input does not fail")
+    print("signature:", want, file=sys.stderr)
+
+    def ok(b):
+        return signature(a.bin, b, a.timeout, tmp) == want
+
+    chunk = max(1, len(blob) // 2)
+    while chunk >= 1:
+        i = len(blob) - chunk
+        changed = False
+        while i >= 0:
+            cand = blob[:i] + blob[i + chunk:]
+            if ok(cand):
+                blob = cand
+                changed = True
+            i -= chunk
+        print("chunk %d -> %d bytes" % (chunk, len(blob)), file=sys.stderr)
+        if not changed:
+            chunk //= 2
+    for i in range(len(blob)):
+        for v in (0, 1, blob[i] // 2):
+            if v < blob[i]:
+                cand = blob[:i] + bytes([v]) + blob[i + 1:]
+                if ok(cand):
+                    blob = cand
+                    break
+    out = a.out or re.sub(r"(\.bin)?$", ".min.bin", a.input, count=1)
+    open(out, "wb").write(blob)
+    try:
+        os.unlink(tmp)
+    except OSError:
+        pass
+    print("%s: %d bytes, %s" % (out, len(blob), want))
+
+
+if __name__ == "__main__":
+    main()

differential/src/bin/afl_crash.rs

@@ -0,0 +1,26 @@
+//! Coverage-guided front end for the crash-only table in [`differential::crash`].
+//!
+//! ```text
+//! cargo afl build --release -p differential --features afl --bin afl_crash
+//! mkdir -p out/afl-crash-in && target/release/crash_fuzz --random 64 --dump 0 > out/afl-crash-in/0
+//! cargo afl fuzz -i out/afl-crash-in -o out/afl-crash-out -t 5000 target/release/afl_crash
+//! ```
+//!
+//! `cargo afl build` turns on debug assertions and overflow checks, so replay
+//! findings with a `crash_fuzz` built the same way (see its docs); a plain
+//! release `crash_fuzz` runs most of them clean.
+//!
+//! AFL runs each input in a forked child, so a panic, an abort and a hang each
+//! cost one child and are saved (`crashes/`, `hangs/`).  Replay them with
+//! `crash_fuzz <files>`, which names the panic site, and group them with
+//! `crash_fuzz --keep-going <files>`.  As with `afl_differential`, check
+//! `hangs/` as well as `crashes/`: with a piped `core_pattern`, AFL can file
+//! a crash as a hang.
+
+use differential::crash::run;
+
+fn main() {
+    afl::fuzz!(|data: &[u8]| {
+        run(data);
+    });
+}

differential/src/bin/afl_differential.rs

@@ -0,0 +1,110 @@
+//! Coverage-guided differential fuzzing: the Rust reference model against the
+//! real crate, driven by AFL++ instead of by a random byte generator.
+//!
+//! ```text
+//! cargo install cargo-afl                                  # once
+//! cargo afl build --release -p differential --features afl
+//! ./lean/afl-seed.sh out/afl-in                            # or any corpus
+//! cargo afl fuzz -i out/afl-in -o out/afl-out \
+//!     target/release/afl_differential
+//! ```
+//!
+//! # Why a second front end at all
+//!
+//! `in_process` generates uniformly random bytes.  That is the right shape for
+//! *measuring* — a rate over a known distribution, comparable with
+//! `differential.py`'s — and the wrong shape for *finding*: the divergence
+//! classes it turns up sit between 1 in 30,000 and 1 in 2,250,000 inputs, which
+//! is what a blind sampler costs when the interesting programs are a thin set.
+//! AFL keeps the inputs that reached new edges and mutates those, so a 40-op
+//! program that got a write zipper into an unusual node representation becomes
+//! the stem for the next thousand.  Same comparison, same two op tables, better
+//! search.
+//!
+//! The wire format suits it: every operand is a byte, reduced mod a small number
+//! at the point of use, so AFL's byte flips, arithmetic and splices all land on
+//! op selectors and path bytes rather than being rejected by a parser. There is
+//! no checksum, no length prefix over the whole input, and a truncated input is
+//! a valid shorter program.
+//!
+//! # Why this is safe where `in_process` has to be careful
+//!
+//! `in_process` runs every input in one long-lived process, so a panic out of
+//! the middle of a trie mutation cannot be caught and recovered from —
+//! `pathmap` is not unwind-safe, and dropping half-updated refcounted nodes
+//! while the stack unwinds corrupts the heap.  It therefore reports from a panic
+//! *hook* and exits.
+//!
+//! AFL removes the problem rather than working around it.  Each input runs in a
+//! child forked from the fork server, and `afl::fuzz!` installs a hook that
+//! **aborts** rather than unwinds.  So a panicking input kills one child, is
+//! written to `out/afl-out/default/crashes/`, and fuzzing continues from the
+//! next one.  Corruption cannot outlive the input that caused it.  That is the
+//! same property the subprocess design in `differential.py` bought, at a
+//! fraction of the cost, and it is why this file does not reproduce
+//! `in_process`'s panic-hook dance.
+//!
+//! A *divergence* is reported the same way a panic is — by panicking — so AFL
+//! saves the input.  Replay one with the plain comparator, which prints the
+//! differing line rather than a backtrace:
+//!
+//! ```text
+//! target/release/in_process out/afl-out/default/crashes/id:* out/afl-out/default/hangs/id:*
+//! ./lean/differential.py out/afl-out/default/crashes/* # KNOWN-table breakdown
+//! ```
+//!
+//! # Look in `hangs/` as well as `crashes/`
+//!
+//! Which of the two a divergence lands in is a property of the *machine*, not of
+//! the finding.  AFL decides "crashed" by reaping the child and reading its
+//! signal, and when `/proc/sys/kernel/core_pattern` is a pipe — apport, systemd
+//! -coredump, any distro default — the kernel hands the corpse to that helper
+//! first, so AFL's wait races the helper and times out instead.  It says so at
+//! startup ("To avoid having crashes misinterpreted as timeouts...") and
+//! `AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1` only silences the refusal to start.
+//!
+//! Measured here: a 180s run saved **0 crashes and 18 hangs**, and all 18 hangs
+//! replay through `in_process` as real divergences.  So always sweep both
+//! directories; a genuine timeout (an infinite loop in the crate, itself a
+//! finding) is then the input in `hangs/` that `in_process` does *not* flag.
+//!
+//! `echo core | sudo tee /proc/sys/kernel/core_pattern` (or `cargo afl
+//! system-config`) puts them back in `crashes/`, and needs root.
+//!
+//! # `crashes/` is not a list of new bugs
+//!
+//! It fills up with the *known* residual defects (`meet_keeps_dangling` and
+//! friends) within the first minute, because to this target they are
+//! indistinguishable from a new finding.  Triage is `differential.py`'s job: it
+//! owns the one `KNOWN` table.
+
+use differential::harness::run as crate_run;
+use differential::reference::fuzz::run as model_run;
+
+fn main() {
+    afl::fuzz!(|data: &[u8]| {
+        // An empty or near-empty input decodes to `EMPTY` on both sides; let AFL
+        // keep it as a seed anyway, it costs one comparison.
+        let model = model_run(data, false);
+        let real = crate_run(data, false);
+        if model == real {
+            return;
+        }
+        // Panicking is the reporting channel: `afl::fuzz!`'s hook turns it into
+        // an abort, which AFL records as a crash and saves the input for.
+        let first = model
+            .lines()
+            .zip(real.lines())
+            .enumerate()
+            .find(|(_, (a, b))| a != b)
+            .map(|(i, (a, b))| format!("line {i}\n  model: {a}\n  crate: {b}"))
+            .unwrap_or_else(|| {
+                format!(
+                    "length {} (model) vs {} (crate) lines",
+                    model.lines().count(),
+                    real.lines().count()
+                )
+            });
+        panic!("model/crate divergence:\n{first}");
+    });
+}