Index: lib/fuzzer/FuzzerDriver.cpp =================================================================== --- lib/fuzzer/FuzzerDriver.cpp +++ lib/fuzzer/FuzzerDriver.cpp @@ -19,6 +19,7 @@ #include "FuzzerShmem.h" #include "FuzzerTracePC.h" #include +#include #include #include #include @@ -273,12 +274,31 @@ T.detach(); } +static size_t kMaxFeature = (1 << 17) + (1 << 15); + +static void DumpCoverageFeature( + const char *InputFilePath, + const std::array &Features) { + std::string FilePath(InputFilePath); + + FILE *Out = fopen(FilePath.c_str(), "w"); + if (!Out) return; + fwrite(Features.data(), sizeof(Features[0]), Features.size(), Out); +} + int RunOneTest(Fuzzer *F, const char *InputFilePath, size_t MaxLen) { Unit U = FileToVector(InputFilePath); if (MaxLen && MaxLen < U.size()) U.resize(MaxLen); F->ExecuteCallback(U.data(), U.size()); - F->TryDetectingAMemoryLeak(U.data(), U.size(), true); + // F->TryDetectingAMemoryLeak(U.data(), U.size(), true); + std::array Features; + TPC.CollectFeatures([&](size_t Feature) { + size_t position = Feature / 8; + size_t power = Feature % 8; + Features[position] |= 1 << power; + }); + DumpCoverageFeature(InputFilePath, Features); return 0; } Index: lib/fuzzer/FuzzerLoop.cpp =================================================================== --- lib/fuzzer/FuzzerLoop.cpp +++ lib/fuzzer/FuzzerLoop.cpp @@ -434,6 +434,8 @@ } } +// static size_t kMaxFeature = 0; + bool Fuzzer::RunOne(const uint8_t *Data, size_t Size, bool MayDeleteFile, InputInfo *II, bool *FoundUniqFeatures) { if (!Size) @@ -454,6 +456,12 @@ II->UniqFeatureSet.end(), Feature)) FoundUniqFeaturesOfII++; }); + // Vector Features; + // TPC.CollectFeatures([&](size_t Feature) { + // Features.push_back(Feature); + // }); + // if (Features.back() > kMaxFeature) + // kMaxFeature = Features.back(); if (FoundUniqFeatures) *FoundUniqFeatures = FoundUniqFeaturesOfII; PrintPulseAndReportSlowInput(Data, Size); @@ -751,8 +759,10 @@ RereadOutputCorpus(MaxInputLen); LastCorpusReload = system_clock::now(); } - if (TotalNumberOfRuns >= Options.MaxNumberOfRuns) + if (TotalNumberOfRuns >= Options.MaxNumberOfRuns) { +// Printf("Max feature: %zd\n", kMaxFeature); break; + } if (TimedOut()) break;