[PATCH] D60571: [libFuzzer] Make MutateWithMask work when the Mask is shorter than the input.

[Max Moroz via Phabricator via llvm-commits]

Dor1s created this revision.
Dor1s added reviewers: kcc, morehouse.
Herald added subscribers: Sanitizers, delcypher.
Herald added projects: LLVM, Sanitizers.
Dor1s added a comment.

With this change my target is finally running! :)


Before this change, MutateWithMask used to assert that Mask should be
of sufficient length (>= Size of the input). However, in real cases we may have
inputs that are longer than the Mask they have inherited from the based inputs.


Repository:
  rCRT Compiler Runtime

https://reviews.llvm.org/D60571

Files:
  lib/fuzzer/FuzzerMutate.cpp


Index: lib/fuzzer/FuzzerMutate.cpp
===================================================================
--- lib/fuzzer/FuzzerMutate.cpp
+++ lib/fuzzer/FuzzerMutate.cpp
@@ -529,7 +529,7 @@
 size_t MutationDispatcher::MutateWithMask(uint8_t *Data, size_t Size,
                                           size_t MaxSize,
                                           const Vector<uint8_t> &Mask) {
-  assert(Size <= Mask.size());
+  size_t MaskedSize = std::min(Size, Mask.size());
   // * Copy the worthy bytes into a temporary array T
   // * Mutate T
   // * Copy T back.
@@ -538,7 +538,7 @@
   if (T.size() < Size)
     T.resize(Size);
   size_t OneBits = 0;
-  for (size_t I = 0; I < Size; I++)
+  for (size_t I = 0; I < MaskedSize; I++)
     if (Mask[I])
       T[OneBits++] = Data[I];
 
@@ -548,7 +548,7 @@
   assert(NewSize <= OneBits);
   (void)NewSize;
   // Even if NewSize < OneBits we still use all OneBits bytes.
-  for (size_t I = 0, J = 0; I < Size; I++)
+  for (size_t I = 0, J = 0; I < MaskedSize; I++)
     if (Mask[I])
       Data[I] = T[J++];
   return Size;


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D60571.194720.patch
Type: text/x-patch
Size: 1073 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20190411/065ecff2/attachment.bin>