LibAFL: scoped coverage experiment

fuzzers/libafl/builder.Dockerfile

@@ -15,30 +15,31 @@
 ARG parent_image
 FROM $parent_image
 
-# Uninstall old Rust & Install the latest one.
-RUN if which rustup; then rustup self uninstall -y; fi && \
-    curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs > /rustup.sh && \
-    sh /rustup.sh --default-toolchain nightly-2023-09-21 -y && \
-    rm /rustup.sh
-
 # Install dependencies.
 RUN apt-get update && \
     apt-get remove -y llvm-10 && \
     apt-get install -y \
         build-essential \
-        llvm-11 \
-        clang-12 \
-        cargo && \
+        lsb-release wget software-properties-common gnupg && \
     apt-get install -y wget libstdc++5 libtool-bin automake flex bison \
         libglib2.0-dev libpixman-1-dev python3-setuptools unzip \
         apt-utils apt-transport-https ca-certificates joe curl && \
+    wget https://apt.llvm.org/llvm.sh && chmod +x llvm.sh && ./llvm.sh 16
+
+RUN wget https://gist.githubusercontent.com/tokatoka/26f4ba95991c6e33139999976332aa8e/raw/698ac2087d58ce5c7a6ad59adce58dbfdc32bd46/createAliases.sh && chmod u+x ./createAliases.sh && ./createAliases.sh 
+
+# Uninstall old Rust & Install the latest one.
+RUN if which rustup; then rustup self uninstall -y; fi && \
+    curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs > /rustup.sh && \
+    sh /rustup.sh --default-toolchain nightly-2023-12-13 -y && \
+    rm /rustup.sh && \
     PATH="/root/.cargo/bin/:$PATH" cargo install cargo-make
 
 # Download libafl.
 RUN git clone https://github.com/AFLplusplus/LibAFL /libafl
 
 # Checkout a current commit
-RUN cd /libafl && git pull && git checkout b20fda2a4ada2a6462718dc661e139e6c7a29807 || true
+RUN cd /libafl && git pull && git checkout c5fe095a9c6e8b11e4962ea8247c98414be92e97
 # Note that due a nightly bug it is currently fixed to a known version on top!
 
 # Compile libafl.

fuzzers/libafl/fuzzer.py

@@ -49,8 +49,9 @@ def build():  # pylint: disable=too-many-branches,too-many-statements
     os.environ['UBSAN_OPTIONS'] = 'abort_on_error=0'
 
     cflags = ['--libafl']
+    cxxflags = ['--libafl', '--std=c++14']
     utils.append_flags('CFLAGS', cflags)
-    utils.append_flags('CXXFLAGS', cflags)
+    utils.append_flags('CXXFLAGS', cxxflags)
     utils.append_flags('LDFLAGS', cflags)
 
     os.environ['FUZZER_LIB'] = '/stub_rt.a'

fuzzers/libafl_27042023/builder.Dockerfile → fuzzers/libafl_scoped_cov/builder.Dockerfile

@@ -15,38 +15,39 @@
 ARG parent_image
 FROM $parent_image
 
-# Uninstall old Rust & Install the latest one.
-RUN if which rustup; then rustup self uninstall -y; fi && \
-    curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs > /rustup.sh && \
-    sh /rustup.sh --default-toolchain nightly-2023-03-29 -y && \
-    rm /rustup.sh
-
 # Install dependencies.
 RUN apt-get update && \
     apt-get remove -y llvm-10 && \
     apt-get install -y \
         build-essential \
-        llvm-11 \
-        clang-12 \
-        cargo && \
+        lsb-release wget software-properties-common gnupg && \
     apt-get install -y wget libstdc++5 libtool-bin automake flex bison \
         libglib2.0-dev libpixman-1-dev python3-setuptools unzip \
         apt-utils apt-transport-https ca-certificates joe curl && \
+    wget https://apt.llvm.org/llvm.sh && chmod +x llvm.sh && ./llvm.sh 16
+
+RUN wget https://gist.githubusercontent.com/tokatoka/26f4ba95991c6e33139999976332aa8e/raw/698ac2087d58ce5c7a6ad59adce58dbfdc32bd46/createAliases.sh && chmod u+x ./createAliases.sh && ./createAliases.sh 
+
+# Uninstall old Rust & Install the latest one.
+RUN if which rustup; then rustup self uninstall -y; fi && \
+    curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs > /rustup.sh && \
+    sh /rustup.sh --default-toolchain nightly-2023-12-13 -y && \
+    rm /rustup.sh && \
     PATH="/root/.cargo/bin/:$PATH" cargo install cargo-make
 
 # Download libafl.
 RUN git clone https://github.com/AFLplusplus/LibAFL /libafl
 
 # Checkout a current commit
-RUN cd /libafl && git checkout 3ce0c102affeace754072368013422e97b9dce9c || true
+RUN cd /libafl && git pull && git checkout c5fe095a9c6e8b11e4962ea8247c98414be92e97
 # Note that due a nightly bug it is currently fixed to a known version on top!
 
 # Compile libafl.
 RUN cd /libafl && \
     unset CFLAGS CXXFLAGS && \
     export LIBAFL_EDGES_MAP_SIZE=2621440 && \
     cd ./fuzzers/fuzzbench && \
-    PATH="/root/.cargo/bin/:$PATH" cargo build --release --features no_link_main
+    PATH="/root/.cargo/bin/:$PATH" cargo build --profile release-fuzzbench --features no_link_main,scoped_coverage
 
 # Auxiliary weak references.
 RUN cd /libafl/fuzzers/fuzzbench && \

fuzzers/libafl_27042023/fuzzer.py → fuzzers/libafl_scoped_cov/fuzzer.py

@@ -40,8 +40,10 @@ def prepare_fuzz_environment(input_corpus):
 
 def build():  # pylint: disable=too-many-branches,too-many-statements
     """Build benchmark."""
-    os.environ['CC'] = '/libafl/fuzzers/fuzzbench/target/release/libafl_cc'
-    os.environ['CXX'] = '/libafl/fuzzers/fuzzbench/target/release/libafl_cxx'
+    os.environ[
+        'CC'] = '/libafl/fuzzers/fuzzbench/target/release-fuzzbench/libafl_cc'
+    os.environ[
+        'CXX'] = '/libafl/fuzzers/fuzzbench/target/release-fuzzbench/libafl_cxx'
 
     os.environ['ASAN_OPTIONS'] = 'abort_on_error=0:allocator_may_return_null=1'
     os.environ['UBSAN_OPTIONS'] = 'abort_on_error=0'
@@ -63,5 +65,7 @@ def fuzz(input_corpus, output_corpus, target_binary):
     if dictionary_path:
         command += (['-x', dictionary_path])
     command += (['-o', output_corpus, '-i', input_corpus])
+    fuzzer_env = os.environ.copy()
+    fuzzer_env['LD_PRELOAD'] = '/usr/lib/x86_64-linux-gnu/libjemalloc.so.2'
     print(command)
-    subprocess.check_call(command, cwd=os.environ['OUT'])
+    subprocess.check_call(command, cwd=os.environ['OUT'], env=fuzzer_env)

fuzzers/libafl_27042023/runner.Dockerfile → fuzzers/libafl_scoped_cov/runner.Dockerfile

@@ -14,6 +14,8 @@
 
 FROM gcr.io/fuzzbench/base-image
 
+RUN apt install libjemalloc2
+
 # This makes interactive docker runs painless:
 ENV LD_LIBRARY_PATH="$LD_LIBRARY_PATH:/out"
 #ENV AFL_MAP_SIZE=2621440

requirements.txt

@@ -27,5 +27,5 @@ protobuf==3.20.3
 
 # Needed for development.
 pylint==2.15.4
-pytype==2022.10.13
+pytype==2023.10.31
 yapf==0.32.0

service/gcbrun_experiment.py

@@ -28,7 +28,6 @@
 TRIGGER_COMMAND = '/gcbrun'
 RUN_EXPERIMENT_COMMAND_STR = f'{TRIGGER_COMMAND} run_experiment.py '
 SKIP_COMMAND_STR = f'{TRIGGER_COMMAND} skip'
-# A DUMMY COMMENT
 
 
 def get_comments(pull_request_number):