klauwier
authored
LuaJIT fuzzer used to stop due to timeout caused by infinite cycles and recursions. Counters were introduced for every cycle and function to address LuaJIT fuzzer timeouts. The idea is to add unique counters for every cycle and function to ensure finite code execution, if it wasn't already. For while, repeat, for cycles, local and global named, anonymous functions, counters will be initialized before the code generated from protobuf, and checked in the first body statement. An entry point for the serializer was created to count cycles and functions for counter initialization. The idea was taken from a paper "Program Reconditioning: Avoiding Undefined Behaviour When Finding and Reducing Compiler Bugs" [1]. Here is an example of a change in serialized code made by this commit. Before: ```lua while (true) do foo = 'bar' end function bar() bar() end ``` After: ```lua counter_0 = 0 counter_1 = 0 while (true) do if counter_0 > 5 then break end counter_0 = counter_0 + 1 foo = 'bar' end function bar() if counter_1 > 5 then return end counter_1 = counter_1 + 1 bar() end ``` Protobuf structures that reproduce the timeout problem were added to the LuaJIT fuzzer corpus. [1] https://www.doc.ic.ac.uk/~afd/homepages/papers/pdfs/2023/PLDI.pdf NO_CHANGELOG=internal NO_DOC=fuzzer fix (cherry picked from commit 4d004bbe)
Name | Last commit | Last update |
---|