[libFuzzer] Fix minimize_crash issues.

[ochang]

Summary

• Make size limits in minimize_crash more consistent.
• Fix small enough units not being written to exact_artifact_path.

[ochang]

FuzzerDriver.cpp

349

The loop in MinimizeCrashInput has this check:

if (U.size() < 2) {
  ...
  Printf("CRASH_MIN: '%s' is small enough\n", CurrentFilePath.c_str());

So this assert gets hit when the current item is size 2.

[aizatsky]

Do you need help landing it?

FuzzerDriver.cpp

303

pls change the summary to say smth like "saving small enough units". As far as I can see the issue was bigger than just artifact_path thing.

[ochang]

Thanks for reviewing! Please help with landing this. I have no idea how to do so (or even if I can).

FuzzerDriver.cpp

if (Flags.runs <= 0 && Flags.max_total_time == 0) {
     BaseCmd += " -max_total_time=600";
   }
   // BaseCmd += " >  /dev/null 2>&1 ";
 
   std::string CurrentFilePath = InputFilePath;
   while (true) {
     Unit U = FileToVector(CurrentFilePath);
     if (U.size() < 2) {
+      if (Flags.exact_artifact_path) {
+        CurrentFilePath = Flags.exact_artifact_path;
+        WriteToFile(U, CurrentFilePath);
+      }
       Printf("CRASH_MIN: '%s' is small enough\n", CurrentFilePath.c_str());
       return 0;
     }
     Printf("CRASH_MIN: minimizing crash input: '%s' (%zd bytes)\n",
            CurrentFilePath.c_str(), U.size());
 
     auto Cmd = BaseCmd + " " + CurrentFilePath;
 
int MinimizeCrashInput(const std::vector<std::string> &Args) {
   }
   return 0;
 }
 
 int MinimizeCrashInputInternalStep(Fuzzer *F, InputCorpus *Corpus) {
   assert(Inputs->size() == 1);
   std::string InputFilePath = Inputs->at(0);
   Unit U = FileToVector(InputFilePath);
-  assert(U.size() > 2);
+  assert(U.size() >= 2);
   Printf("INFO: Starting MinimizeCrashInputInternalStep: %zd\n", U.size());
   Corpus->AddToCorpus(U, 0);
   F->SetMaxInputLen(U.size());
   F->SetMaxMutationLen(U.size() - 1);
   F->MinimizeCrashLoop(U);
   Printf("INFO: Done MinimizeCrashInputInternalStep, no crashes found\n");
   exit(0);
   return 0;

FuzzerLoop.cpp

while (true) {
     MutateAndTestOne();
   }
 
   PrintStats("DONE  ", "\n");
   MD.PrintRecommendedDictionary();
 }
 
 void Fuzzer::MinimizeCrashLoop(const Unit &U) {
-  if (U.size() <= 2) return;
+  if (U.size() < 2) return;
   while (!TimedOut() && TotalNumberOfRuns < Options.MaxNumberOfRuns) {
     MD.StartMutationSequence();
     memcpy(CurrentUnitData, U.data(), U.size());
     for (int i = 0; i < Options.MutateDepth; i++) {
       size_t NewSize = MD.Mutate(CurrentUnitData, U.size(), MaxMutationLen);
       assert(NewSize > 0 && NewSize <= MaxMutationLen);
       RunOne(CurrentUnitData, NewSize);
       TryDetectingAMemoryLeak(CurrentUnitData, NewSize,