test/fuzz: fix luaJIT fuzzer timeout
LuaJIT fuzzer used to stop due to timeout caused by infinite cycles and recursions. Counters were introduced for every cycle and function to address LuaJIT fuzzer timeouts. The idea is to add unique counters for every cycle and function to ensure finite code execution, if it wasn't already. For while, repeat, for cycles, local and global named, anonymous functions, counters will be initialized before the code generated from protobuf, and checked in the first body statement. An entry point for the serializer was created to count cycles and functions for counter initialization. The idea was taken from a paper "Program Reconditioning: Avoiding Undefined Behaviour When Finding and Reducing Compiler Bugs" [1]. Here is an example of a change in serialized code made by this commit. Before: ```lua while (true) do foo = 'bar' end function bar() bar() end ``` After: ```lua counter_0 = 0 counter_1 = 0 while (true) do if counter_0 > 5 then break end counter_0 = counter_0 + 1 foo = 'bar' end function bar() if counter_1 > 5 then return end counter_1 = counter_1 + 1 bar() end ``` Protobuf structures that reproduce the timeout problem were added to the LuaJIT fuzzer corpus. [1] https://www.doc.ic.ac.uk/~afd/homepages/papers/pdfs/2023/PLDI.pdf NO_CHANGELOG=internal NO_DOC=fuzzer fix (cherry picked from commit 4d004bbe)
Showing
- test/fuzz/luaL_loadbuffer/luaL_loadbuffer_fuzzer.cc 1 addition, 1 deletiontest/fuzz/luaL_loadbuffer/luaL_loadbuffer_fuzzer.cc
- test/fuzz/luaL_loadbuffer/serializer.cc 220 additions, 46 deletionstest/fuzz/luaL_loadbuffer/serializer.cc
- test/fuzz/luaL_loadbuffer/serializer.h 16 additions, 0 deletionstest/fuzz/luaL_loadbuffer/serializer.h
- test/static/corpus/luaL_loadbuffer/timeout-0952c452a9b293fbd1bb3ad989b4627976d27e97 485 additions, 0 deletions...adbuffer/timeout-0952c452a9b293fbd1bb3ad989b4627976d27e97
- test/static/corpus/luaL_loadbuffer/timeout-337b9efb6b00c9363e9ca290cd09e8d7caba54bb 398 additions, 0 deletions...adbuffer/timeout-337b9efb6b00c9363e9ca290cd09e8d7caba54bb
- test/static/corpus/luaL_loadbuffer/timeout-53c0a03d2fa042bda3c544569c387086295af2a5 863 additions, 0 deletions...adbuffer/timeout-53c0a03d2fa042bda3c544569c387086295af2a5
- test/static/corpus/luaL_loadbuffer/timeout-5fef580e9368ed8fc12db09db214241d3c353377 682 additions, 0 deletions...adbuffer/timeout-5fef580e9368ed8fc12db09db214241d3c353377
- test/static/corpus/luaL_loadbuffer/timeout-7fa44b92f42baec7b4d5029123d005bf8e6ece19 1024 additions, 0 deletions...adbuffer/timeout-7fa44b92f42baec7b4d5029123d005bf8e6ece19
- test/static/corpus/luaL_loadbuffer/timeout-81c222fd009c8604a860ab967143637f94276d68 859 additions, 0 deletions...adbuffer/timeout-81c222fd009c8604a860ab967143637f94276d68
- test/static/corpus/luaL_loadbuffer/timeout-8a7111c13961d300ba0d55fd9411e9a0f7b1b606 472 additions, 0 deletions...adbuffer/timeout-8a7111c13961d300ba0d55fd9411e9a0f7b1b606
- test/static/corpus/luaL_loadbuffer/timeout-a0aa27253eafb4ab8c975ad981bdc013d85b8c21 480 additions, 0 deletions...adbuffer/timeout-a0aa27253eafb4ab8c975ad981bdc013d85b8c21
- test/static/corpus/luaL_loadbuffer/timeout-a383120b323bf8da86fa78919f1f2999154c581e 978 additions, 0 deletions...adbuffer/timeout-a383120b323bf8da86fa78919f1f2999154c581e
- test/static/corpus/luaL_loadbuffer/timeout-b02e909f524a1990690994e84d6dbc93581c0557 999 additions, 0 deletions...adbuffer/timeout-b02e909f524a1990690994e84d6dbc93581c0557
- test/static/corpus/luaL_loadbuffer/timeout-b0e5846adaa872aedb8c142620b3a7775c785ea3 895 additions, 0 deletions...adbuffer/timeout-b0e5846adaa872aedb8c142620b3a7775c785ea3
- test/static/corpus/luaL_loadbuffer/timeout-c0e43bf73dbe687a743986309beb9683ccac018e 665 additions, 0 deletions...adbuffer/timeout-c0e43bf73dbe687a743986309beb9683ccac018e
- test/static/corpus/luaL_loadbuffer/timeout-c9a028495b4422da26c910b64f0249a69668de48 768 additions, 0 deletions...adbuffer/timeout-c9a028495b4422da26c910b64f0249a69668de48
Loading
Please register or sign in to comment