From 9b1f3e665308ee2ddd5b3f35a078219b5c509cdb Mon Sep 17 00:00:00 2001 From: Dmitry Vyukov Date: Sat, 7 Mar 2020 13:12:35 +0100 Subject: prog: control program length We have _some_ limits on program length, but they are really soft. When we ask to generate a program with 10 calls, sometimes we get 100-150 calls. There are also no checks when we accept external programs from corpus/hub. Issue #1630 contains an example where this crashes VM (executor limit on number of 1000 resources is violated). Larger programs also harm the process overall (slower, consume more memory, lead to monster reproducers, etc). Add a set of measure for hard control over program length. Ensure that generated/mutated programs are not too long; drop too long programs coming from corpus/hub in manager; drop too long programs in hub. As a bonus ensure that mutation don't produce programs with 0 calls (which is currently possible and happens). Fixes #1630 --- syz-manager/hub.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'syz-manager/hub.go') diff --git a/syz-manager/hub.go b/syz-manager/hub.go index ff0f26066..51937b536 100644 --- a/syz-manager/hub.go +++ b/syz-manager/hub.go @@ -171,7 +171,8 @@ func (hc *HubConnector) processProgs(progs [][]byte) int { dropped := 0 candidates := make([][]byte, 0, len(progs)) for _, inp := range progs { - if _, err := hc.target.Deserialize(inp, prog.NonStrict); err != nil { + p, err := hc.target.Deserialize(inp, prog.NonStrict) + if err != nil || len(p.Calls) > prog.MaxCalls { dropped++ continue } -- cgit mrf-deployment