From 7f07e9b0e2d1b715e875a446eea8399f9bb8a4b2 Mon Sep 17 00:00:00 2001
From: Aleksandr Nogikh <nogikh@google.com>
Date: Thu, 1 Feb 2024 18:26:06 +0100
Subject: syz-manager: prefer non-ANY progs in corpus minimization

In case of non-squashed programs we can leverage our descriptions in a
much better way than just blind mutations of binary blobs.
---
 prog/analysis.go | 9 +++++++++
 prog/any.go      | 4 ++--
 2 files changed, 11 insertions(+), 2 deletions(-)

(limited to 'prog')

diff --git a/prog/analysis.go b/prog/analysis.go
index 47c470926..600f9bee4 100644
--- a/prog/analysis.go
+++ b/prog/analysis.go
@@ -367,3 +367,12 @@ func (p *Prog) ForEachAsset(cb func(name string, typ AssetType, r io.Reader)) {
 		})
 	}
 }
+
+func (p *Prog) ContainsAny() bool {
+	for _, c := range p.Calls {
+		if p.Target.CallContainsAny(c) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/prog/any.go b/prog/any.go
index b99e64932..0a0fdddf5 100644
--- a/prog/any.go
+++ b/prog/any.go
@@ -126,7 +126,7 @@ func (target *Target) isAnyRes(name string) bool {
 
 func (target *Target) CallContainsAny(c *Call) (res bool) {
 	ForeachArg(c, func(arg Arg, ctx *ArgCtx) {
-		if target.isAnyPtr(arg.Type()) {
+		if target.isAnyPtr(arg.Type()) || res {
 			res = true
 			ctx.Stop = true
 		}
@@ -136,7 +136,7 @@ func (target *Target) CallContainsAny(c *Call) (res bool) {
 
 func (target *Target) ArgContainsAny(arg0 Arg) (res bool) {
 	ForeachSubArg(arg0, func(arg Arg, ctx *ArgCtx) {
-		if target.isAnyPtr(arg.Type()) {
+		if target.isAnyPtr(arg.Type()) || res {
 			res = true
 			ctx.Stop = true
 		}
-- 
cgit mrf-deployment