Integrated replaying fuzzer

libafl/src/executors/mod.rs

@@ -42,7 +42,7 @@ pub mod with_observers;
 pub mod hooks;
 
 /// How an execution finished.
-#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, Hash)]
 #[cfg_attr(
     any(not(feature = "serdeany_autoreg"), miri),
     expect(clippy::unsafe_derive_deserialize)
@@ -56,6 +56,8 @@ pub enum ExitKind {
     Oom,
     /// The run timed out
     Timeout,
+    /// The run reports inconsistent results, this means the input is not added to the corpus nor the solutions
+    Inconsistent,
     /// Special case for [`DiffExecutor`] when both exitkinds don't match
     Diff {
         /// The exitkind of the primary executor
@@ -68,7 +70,7 @@ pub enum ExitKind {
 }
 
 /// How one of the diffing executions finished.
-#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, Hash)]
 #[cfg_attr(
     any(not(feature = "serdeany_autoreg"), miri),
     expect(clippy::unsafe_derive_deserialize)
@@ -82,6 +84,8 @@ pub enum DiffExitKind {
     Oom,
     /// The run timed out
     Timeout,
+    /// The run reports inconsistent results
+    Inconsistent,
     /// One of the executors itelf repots a differential, we can't go into further details.
     Diff,
     // The run resulted in a custom `ExitKind`.
@@ -97,6 +101,7 @@ impl From<ExitKind> for DiffExitKind {
             ExitKind::Crash => DiffExitKind::Crash,
             ExitKind::Oom => DiffExitKind::Oom,
             ExitKind::Timeout => DiffExitKind::Timeout,
+            ExitKind::Inconsistent => DiffExitKind::Inconsistent,
             ExitKind::Diff { .. } => DiffExitKind::Diff,
         }
     }

libafl/src/fuzzer/filter.rs

@@ -0,0 +1,48 @@
+//! Input filter implementations
+#[cfg(feature = "std")]
+use core::hash::Hash;
+#[cfg(feature = "std")]
+use fastbloom::BloomFilter;
+
+/// Filtering input execution in the fuzzer
+pub trait InputFilter<I> {
+    /// Check if the input should be executed
+    fn should_execute(&mut self, input: &I) -> bool;
+}
+
+/// A pseudo-filter that will execute each input.
+#[derive(Debug)]
+pub struct NopInputFilter;
+impl<I> InputFilter<I> for NopInputFilter {
+    #[inline]
+    #[must_use]
+    fn should_execute(&mut self, _input: &I) -> bool {
+        true
+    }
+}
+
+/// A filter that probabilistically prevents duplicate execution of the same input based on a bloom filter.
+#[cfg(feature = "std")]
+#[derive(Debug)]
+pub struct BloomInputFilter {
+    bloom: BloomFilter,
+}
+
+#[cfg(feature = "std")]
+impl BloomInputFilter {
+    #[must_use]
+    /// Create a new [`BloomInputFilter`]
+    pub fn new(items_count: usize, fp_p: f64) -> Self {
+        let bloom = BloomFilter::with_false_pos(fp_p).expected_items(items_count);
+        Self { bloom }
+    }
+}
+
+#[cfg(feature = "std")]
+impl<I: Hash> InputFilter<I> for BloomInputFilter {
+    #[inline]
+    #[must_use]
+    fn should_execute(&mut self, input: &I) -> bool {
+        !self.bloom.insert(input)
+    }
+}