diff options
| author | Dmitry Vyukov <dvyukov@google.com> | 2020-03-07 13:12:35 +0100 |
|---|---|---|
| committer | Dmitry Vyukov <dvyukov@google.com> | 2020-03-13 13:16:53 +0100 |
| commit | 9b1f3e665308ee2ddd5b3f35a078219b5c509cdb (patch) | |
| tree | 56e177dcb9b249381d27abacec5e59e9d2cf410f /tools/syz-mutate | |
| parent | 05359321bb37f035e55ccfad2cc36b0ea3b50998 (diff) | |
prog: control program length
We have _some_ limits on program length, but they are really soft.
When we ask to generate a program with 10 calls, sometimes we get
100-150 calls. There are also no checks when we accept external
programs from corpus/hub. Issue #1630 contains an example where
this crashes VM (executor limit on number of 1000 resources is
violated). Larger programs also harm the process overall (slower,
consume more memory, lead to monster reproducers, etc).
Add a set of measure for hard control over program length.
Ensure that generated/mutated programs are not too long;
drop too long programs coming from corpus/hub in manager;
drop too long programs in hub.
As a bonus ensure that mutation don't produce programs with
0 calls (which is currently possible and happens).
Fixes #1630
Diffstat (limited to 'tools/syz-mutate')
| -rw-r--r-- | tools/syz-mutate/mutate.go | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/tools/syz-mutate/mutate.go b/tools/syz-mutate/mutate.go index 1ed4704e2..3dcc446c6 100644 --- a/tools/syz-mutate/mutate.go +++ b/tools/syz-mutate/mutate.go @@ -24,7 +24,7 @@ var ( flagOS = flag.String("os", runtime.GOOS, "target os") flagArch = flag.String("arch", runtime.GOARCH, "target arch") flagSeed = flag.Int("seed", -1, "prng seed") - flagLen = flag.Int("len", 30, "number of calls in programs") + flagLen = flag.Int("len", prog.RecommendedCalls, "number of calls in programs") flagEnable = flag.String("enable", "", "comma-separated list of enabled syscalls") flagCorpus = flag.String("corpus", "", "name of the corpus file") ) |