some fixes and updates

Author: baflor

Cargo.lock

@@ -4,11 +4,11 @@ version = "0.1.0"
 authors = []
 license = "Apache-2.0 OR MIT"
 edition = "2024"
-rust-version = "1.90"
+rust-version = "1.92"
 
 [dependencies]
 wat = "1.0"
-wasmparser = "0.244"
+wasmparser = "0.247"
 rustc-demangle = "0.1"
 clap = { version = "4.4", features = ["derive", "env"] }
 md5 = "0.8"
@@ -23,19 +23,19 @@ anyhow = "1.0"
 dirs = "6.0"
 serde = "1.0"
 serde_json = { version = "1.0", features = ["arbitrary_precision"] }
-gimli = "0.32"
+gimli = "0.33"
 # We pin symbolic since DWARFv5 embedded source code support was removed >.>
 symbolic = { version = "12.11.1", features = ["demangle", "symcache"] }
 symbolic-debuginfo = "=12.11.1"
 rustc-hash = "2.0.0"
-hexyl = "0.16"
+hexyl = "0.17"
 humantime = "2.1"
 humansize = "2.1"
 crossbeam-channel = "0.5"
 ordered-float = { version = "5.0", features = ["speedy"] }
 decurse = "0.0.4"
 rustix = { version = "1.0", features = ["mm", "param", "fs"] }
-object = { version = "0.38", default-features = false, features = [
+object = { version = "0.39", default-features = false, features = [
     "read_core",
     "compression",
     "wasm",
@@ -51,7 +51,7 @@ libafl_bolts = { version = "0.15", default-features = false, features = [
     "derive",
     "serdeany_autoreg",
 ] }
-cranelift = { version = "0.127", features = [
+cranelift = { version = "0.131", features = [
     "jit",
     "module",
     "native",
@@ -62,7 +62,7 @@ libc = "0.2.158"
 # feat:concolic
 # Note: waiting for 0.3.1 upstream
 smtlib = { git = "https://github.com/oeb25/smtlib-rs.git", rev = "4f0fad92289ba02931276cbe2bbe45f87f7a6f3e", optional = true }
-z3 = { version = "0.19", optional = true }
+z3 = { version = "0.20", optional = true }
 bitwuzla = { git = "https://github.com/Mrmaxmeier/bitwuzla-rs.git", optional = true }
 
 # feat:with_mimalloc
@@ -117,3 +117,6 @@ opt-level = 3
 opt-level = 3
 [profile.dev.package."libafl"]
 opt-level = 3
+
+[profile.release]
+debug = true

Cargo.toml

@@ -1,7 +1,7 @@
 # Build with `podman build . -t wasm-fuzzers-wasmfuzz`
 FROM ubuntu:24.04
 RUN apt-get update && apt-get install -y rustup git clang
-RUN rustup toolchain add --no-self-update 1.90
+RUN rustup toolchain add --no-self-update 1.92
 RUN mkdir /wasmfuzz
 COPY Cargo.toml Cargo.lock wasmfuzz/
 COPY src wasmfuzz/src/

Dockerfile

@@ -109,7 +109,7 @@ def time_as_seconds(v: str):
 parser.add_argument('--tag', action='append', help="Only run targets with this tag")
 parser.add_argument('--skip-tag', action='append', help="Don't run targets with this tag")
 parser.add_argument('--fuzzer', action='append', help="Run with this fuzzer")
-parser.add_argument('--keep-corpora', action='store_true', help="Copy resulting corpora to this path")
+parser.add_argument('--copy-corpora-to', default=None, help="Copy resulting corpora to this path")
 
 args = parser.parse_args()
 fuzzers: list[str] = args.fuzzer or [
@@ -418,8 +418,8 @@ async def run_target(target, fuzzer, config=None, num_cores=1):
                     core_ids=core_ids if args.pin_cores else None
                 )
                 await wasm_job.run(fuzzer=fuzzer, env=config_env)
-                if args.keep_corpora:
-                    t_dir = Path(args.keep_corpora) / slug
+                if args.copy_corpora_to:
+                    t_dir = Path(args.copy_corpora_to) / slug
                     t_dir.mkdir(parents=True, exist_ok=True)
                     shutil.copytree(corpus_dir, t_dir, dirs_exist_ok=True)
         except Exception as e:

eval/container-runner.py

@@ -1,7 +1,7 @@
 #!/bin/bash
 set -e +x
 
-WASI_VERSION=29
+WASI_VERSION=32
 WASI_VERSION_FULL=${WASI_VERSION}.0
 WASI_DIR="wasi-sdk-${WASI_VERSION_FULL}-$(uname -m)-linux"
 wget -q "https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${WASI_VERSION}/${WASI_DIR}.tar.gz"

harness-suite/scripts/prepare-toolchain.sh

@@ -57,6 +57,8 @@ pub(crate) enum Subcommand {
         run_from_snapshot: FlagBool,
         #[clap(long)]
         input_size_limit: Option<usize>,
+        #[clap(long)]
+        memory_limit_pages: Option<u32>,
     },
     /// Check the system configuration and WebAssembly module for potential issues.
     Doctor {
@@ -238,6 +240,7 @@ pub(crate) fn main() {
             print_stdout,
             run_from_snapshot,
             input_size_limit,
+            memory_limit_pages,
         } => {
             let inputs = gather_inputs_paths(&None, &inputs, true);
             let mod_spec = parse_program(&program);
@@ -253,6 +256,7 @@ pub(crate) fn main() {
                 .instruction_limit(Some(2_000_000_000))
                 .optimize_for_compilation_time(inputs.len() <= 10)
                 .run_from_snapshot(*run_from_snapshot)
+                .memory_limit_pages(memory_limit_pages)
                 .build();
             if inputs.is_empty() {
                 println!("No input specified. Exiting.")

src/cli/mod.rs

@@ -416,9 +416,17 @@ impl Orchestrator {
             swarm.input_size_limit = Some(1024 * self.config_epoch as u32);
             // First config: no additional feedback guidance.
             let mut opts = FeedbackOptions::minimal_code_coverage();
-            opts.cmpcov_hamming = true;
-            if self.config_epoch > 0 {
-                opts.edge_shortest_trace = true;
+            if self.opts.experiment == Some(Experiment::PassAblation) {
+                let pass = std::env::var("FUZZER_PASS_ABLATION")
+                    .expect("FUZZER_PASS_ABLATION must be set");
+                if pass != "baseline" {
+                    opts.activate_from_str(&pass);
+                }
+            } else {
+                opts.cmpcov_hamming = true;
+                if self.config_epoch > 0 {
+                    opts.edge_shortest_trace = true;
+                }
             }
             return Config {
                 passes: OrcPassesGen {
@@ -523,11 +531,15 @@ impl Orchestrator {
             swarm.discard_short_circuit_coverage = true;
         }
 
-        let mut opts = FeedbackOptions::nothing();
+        let mut opts = FeedbackOptions::minimal_code_coverage();
+        // We always enable edge coverage, and edge coverage subsumes function and bb coverage.
+        // Function coverage is enabled for the CLI status line.
+        opts.live_bbs = false;
+
         let FeedbackOptions {
-            live_funcs,
-            live_bbs,
-            live_edges,
+            live_funcs: _,
+            live_bbs: _,
+            live_edges: _,
             cmpcov_hamming,
             cmpcov_absdist,
             cmpcov_u16dist,
@@ -550,12 +562,6 @@ impl Orchestrator {
             func_longest_trace,
         } = &mut opts;
 
-        // We always enable edge coverage, and edge coverage subsumes function and bb coverage.
-        // Function coverage is enabled for the CLI status line.
-        *live_funcs = true;
-        *live_bbs = false;
-        *live_edges = true;
-
         if self.opts.experiment == Some(Experiment::PassAblation) {
             let pass =
                 std::env::var("FUZZER_PASS_ABLATION").expect("FUZZER_PASS_ABLATION must be set");
@@ -611,7 +617,7 @@ impl Orchestrator {
 
         if matches!(self.opts.experiment, Some(Experiment::OnlyEdgeCoverage)) {
             opts = FeedbackOptions::minimal_code_coverage();
-            opts.live_edges = false;
+            opts.live_bbs = false;
         }
 
         Config {

src/fuzzer/orc.rs

@@ -182,10 +182,8 @@ impl FuncCFG {
                 Operator::If { .. } | Operator::BrIf { .. } | Operator::Else => {
                     bb_starts.insert(InsnIdx(ip as u32 + 1));
                 }
-                Operator::End | Operator::Return => {
-                    if ip != end_idx.i() {
-                        bb_starts.insert(InsnIdx(ip as u32 + 1));
-                    }
+                Operator::End | Operator::Return if ip != end_idx.i() => {
+                    bb_starts.insert(InsnIdx(ip as u32 + 1));
                 }
                 _ => {}
             }

src/ir/parse_cfg.rs

@@ -37,7 +37,7 @@ impl ModuleInstance {
         *self
             .export_func_ptrs
             .get(export)
-            .unwrap_or_else(|| panic!("export {export:?} not found"))
+            .unwrap_or_else(|| panic!("export {export:?} not found: can't continue"))
     }
 
     // TODO: Verify that ABI matches? ABI mismatches can be hard to track down!

src/jit/instance.rs

@@ -56,9 +56,10 @@ pub(crate) fn instrument_func(
             trace_strcmp(state, bcx, location, a, b)
         }
         if let Some(libfunc) = state.fspec().known_libfunc
-            && state.options.is_concolic() {
-                super::concolic::translate_concolic_trace_libcall(libfunc, state, bcx);
-            }
+            && state.options.is_concolic()
+        {
+            super::concolic::translate_concolic_trace_libcall(libfunc, state, bcx);
+        }
     }
 }