Google Git
Sign in
llvm / libfuzzer / a9708648d1cc3971f00d17b723071cb8089f3941
commita9708648d1cc3971f00d17b723071cb8089f3941[log] [tgz]
authorDokyung Song <dokyungs@google.com>Mon Aug 17 16:59:59 2020 +0000
committerCopybara-Service <copybara-worker@google.com>Thu Mar 25 23:21:29 2021 -0700
treee3c0764372afe41a3d0f0394184e750f99a2dde2
parent5eeb08bc72ab455561968f6580220e15421cefc5 [diff]
[libFuzzer] Scale energy assigned to each input based on input execution time.

This patch scales the energy computed by the Entropic schedule based on the
execution time of each input. The input execution time is compared with the
average execution time of inputs in the corpus, and, based on the amount by
which they differ, the energy is scaled from 0.1x (for inputs executing slow) to
3x (for inputs executing fast). Note that the exact scaling criteria and formula
is borrowed from AFL.

On FuzzBench, this gives a sizeable throughput increase, which in turn leads to
more coverage on several benchmarks. For details, see the following report.

https://storage.googleapis.com/fuzzer-test-suite-public/exectime-report/index.html

Differential Revision: https://reviews.llvm.org/D86092

GitOrigin-RevId: 5cda4dc7b4d28fcd11307d4234c513ff779a1c6f
6 files changed
tree: e3c0764372afe41a3d0f0394184e750f99a2dde2
  1. afl/
  2. dataflow/
  3. scripts/
  4. standalone/
  5. tests/
  6. build.sh
  7. FuzzedDataProvider.h
  8. FuzzerBuiltins.h
  9. FuzzerBuiltinsMsvc.h
  10. FuzzerCommand.h
  11. FuzzerCorpus.h
  12. FuzzerCrossOver.cpp
  13. FuzzerDataFlowTrace.cpp
  14. FuzzerDataFlowTrace.h
  15. FuzzerDefs.h
  16. FuzzerDictionary.h
  17. FuzzerDriver.cpp
  18. FuzzerExtFunctions.def
  19. FuzzerExtFunctions.h
  20. FuzzerExtFunctionsDlsym.cpp
  21. FuzzerExtFunctionsWeak.cpp
  22. FuzzerExtFunctionsWindows.cpp
  23. FuzzerExtraCounters.cpp
  24. FuzzerFlags.def
  25. FuzzerFork.cpp
  26. FuzzerFork.h
  27. FuzzerInterceptors.cpp
  28. FuzzerInterface.h
  29. FuzzerInternal.h
  30. FuzzerIO.cpp
  31. FuzzerIO.h
  32. FuzzerIOPosix.cpp
  33. FuzzerIOWindows.cpp
  34. FuzzerLoop.cpp
  35. FuzzerMain.cpp
  36. FuzzerMerge.cpp
  37. FuzzerMerge.h
  38. FuzzerMutate.cpp
  39. FuzzerMutate.h
  40. FuzzerOptions.h
  41. FuzzerPlatform.h
  42. FuzzerRandom.h
  43. FuzzerSHA1.cpp
  44. FuzzerSHA1.h
  45. FuzzerTracePC.cpp
  46. FuzzerTracePC.h
  47. FuzzerUtil.cpp
  48. FuzzerUtil.h
  49. FuzzerUtilDarwin.cpp
  50. FuzzerUtilFuchsia.cpp
  51. FuzzerUtilLinux.cpp
  52. FuzzerUtilPosix.cpp
  53. FuzzerUtilWindows.cpp
  54. FuzzerValueBitMap.h
  55. LICENSE.TXT
  56. README.txt