inprocessfork executor

[tokatoka]

#82

[tokatoka]

I had to change __sanitizer_cov_trace_pc_guard a bit to make it use a pointer instead of a static array, is this ok?
(
with this change, users can change the edges map later in the fuzzer like

+    let mut shmem;
+    unsafe{
+        shmem = StdShMemProvider::new().unwrap().new_map(MAX_EDGES_NUM).unwrap();
+    }
+    let shmem_map = shmem.map_mut();
+    unsafe{
+        EDGES_PTR = shmem_map.as_ptr();
+    }

)

[domenukk]

Anyway, looks good to me, thanks! :) @andreafioraldi any objections?

[andreafioraldi]

Anyway, looks good to me, thanks! :) @andreafioraldi any objections?

dunno, i'm sick today

[tokatoka]

now we check if the EDGES_MAP_PTR is null, and if so we set EDGES_MAP in libfuzzer_initialize()
what do you think?

[andreafioraldi]

now we check if the EDGES_MAP_PTR is null, and if so we set EDGES_MAP in libfuzzer_initialize()
what do you think?

No, edge coverage can be used even when there is no need to use the libfuzzer compatibility layer

[andreafioraldi]

IMO, here the solution is to use a feature flag in libafl_targets. in-process fuzzing does not need the double dereference of EDGES_PTR, it is just wasted cpu time. Do not use libfuzzer_initialize but instead lazy_static (assuming that we need std for our inprocessfork feature flag, that we does because of fork())

[domenukk]

Can't we just initialize the value when creating the Observer for the first time?

[andreafioraldi]

Can't we just initialize the value when creating the Observer for the first time?

No, because a MapObserver is independent from that. We can use __sanitizer_cov_trace_pc_guard_init

[tokatoka]

yes I can use __sanitizer_cov_trace_pc_guard_init instead of libfuzzer_initialize
(the rust compiler complains with lazy_static!)

[domenukk]

Should we add a #[test] doing a single exec to make sure this works?

[tokatoka]

Or maybe we just make it linux only for now?

sure :>

[domenukk]

Or maybe we just make it linux only for now?

sure :>

Don't think that's really needed, unless we find bugs :D

[tokatoka]

then I'll leave pre/post_fork as they are