Skip to content

Commit f2eba9e

Browse files
oleglazarioleglazari
committed
Add multiple worker configurations in docker-compose; update sync interval to 300 seconds; enhance scripts to filter FUZZILLI_CRASH test cases and dynamically handle multiple postgres-local containers.
1 parent a8aef7c commit f2eba9e

5 files changed

Lines changed: 466 additions & 34 deletions

File tree

‎Scripts/show-crash-javascript.sh‎

Lines changed: 69 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
# Script to show JavaScript code from crash programs
44
# Usage: ./Scripts/show-crash-javascript.sh [worker_num]
5+
# If no worker_num is specified, shows crashes for all postgres-local-* containers
56

67
set -e
78

@@ -14,20 +15,51 @@ cd "$PROJECT_DIR"
1415
CYAN='\033[0;36m'
1516
YELLOW='\033[1;33m'
1617
GREEN='\033[0;32m'
18+
RED='\033[0;31m'
1719
NC='\033[0m' # No Color
1820

21+
# Get all postgres-local-* containers
22+
get_local_postgres_containers() {
23+
docker ps --format '{{.Names}}' | grep '^postgres-local-' | sort
24+
}
25+
26+
# Get worker number from container name
27+
get_worker_num() {
28+
local container=$1
29+
echo "$container" | sed 's/.*-\([0-9]*\)$/\1/'
30+
}
31+
32+
# Check if a container is running
33+
check_container() {
34+
local container=$1
35+
if docker ps --format '{{.Names}}' | grep -q "^${container}$"; then
36+
return 0
37+
else
38+
return 1
39+
fi
40+
}
41+
1942
show_crash_javascript() {
2043
local worker_num=$1
2144
local container="postgres-local-${worker_num}"
2245
local database="fuzzilli_local"
2346

47+
if ! check_container "$container"; then
48+
echo -e "${RED}Worker ${worker_num}: Container ${container} not running${NC}"
49+
echo ""
50+
return
51+
fi
52+
2453
echo -e "${CYAN}========================================${NC}"
2554
echo -e "${CYAN} Worker ${worker_num} Crash Programs${NC}"
55+
echo -e "${CYAN} (Excluding FUZZILLI_CRASH test cases - signal 3)${NC}"
2656
echo -e "${CYAN}========================================${NC}"
2757
echo ""
2858

2959
# Get all crash program hashes (one per line)
30-
local crash_hashes=$(docker exec "$container" psql -U fuzzilli -d "$database" -t -c "SELECT DISTINCT e.program_hash FROM execution e JOIN execution_outcome eo ON e.execution_outcome_id = eo.id WHERE eo.outcome = 'Crashed' ORDER BY e.program_hash;" 2>/dev/null | grep -v '^$' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
60+
# Exclude only signal_code = 3 (FUZZILLI_CRASH test cases)
61+
# Show all other crashes including signal 11 and all other signals
62+
local crash_hashes=$(docker exec "$container" psql -U fuzzilli -d "$database" -t -c "SELECT DISTINCT e.program_hash FROM execution e JOIN execution_outcome eo ON e.execution_outcome_id = eo.id WHERE eo.outcome = 'Crashed' AND (e.signal_code IS NULL OR e.signal_code != 3) ORDER BY e.program_hash;" 2>/dev/null | grep -v '^$' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
3163

3264
if [ -z "$crash_hashes" ]; then
3365
echo -e "${YELLOW}No crashes found for Worker ${worker_num}${NC}"
@@ -41,10 +73,28 @@ show_crash_javascript() {
4173
continue
4274
fi
4375

44-
echo -e "${GREEN}--- Crash Program: ${hash} ---${NC}"
76+
# Get execution details first to check signal code
77+
# Exclude only signal 3 (FUZZILLI_CRASH test cases), show all others including signal 11
78+
local exec_details=$(docker exec "$container" psql -U fuzzilli -d "$database" -t -c "SELECT e.execution_id, e.signal_code, e.exit_code, eo.description, e.created_at FROM execution e JOIN execution_outcome eo ON e.execution_outcome_id = eo.id WHERE e.program_hash = '${hash}' AND eo.outcome = 'Crashed' AND (e.signal_code IS NULL OR e.signal_code != 3) ORDER BY e.created_at DESC LIMIT 1;" 2>/dev/null)
4579

46-
# Get execution details
47-
local exec_details=$(docker exec "$container" psql -U fuzzilli -d "$database" -t -c "SELECT e.execution_id, e.signal_code, e.exit_code, eo.description, e.created_at FROM execution e JOIN execution_outcome eo ON e.execution_outcome_id = eo.id WHERE e.program_hash = '${hash}' AND eo.outcome = 'Crashed' ORDER BY e.created_at DESC LIMIT 1;" 2>/dev/null)
80+
# Skip if no execution details found (shouldn't happen, but safety check)
81+
if [ -z "$exec_details" ]; then
82+
continue
83+
fi
84+
85+
# Get and decode the JavaScript to check for FUZZILLI_CRASH
86+
local base64_program=$(docker exec "$container" psql -U fuzzilli -d "$database" -t -c "SELECT program_base64 FROM program WHERE program_hash = '${hash}';" 2>/dev/null | tr -d ' \n\r')
87+
88+
# Check if program contains FUZZILLI_CRASH pattern
89+
if [ -n "$base64_program" ]; then
90+
local decoded_program=$(echo "$base64_program" | base64 -d 2>/dev/null)
91+
if echo "$decoded_program" | grep -q "FUZZILLI_CRASH"; then
92+
# Skip this crash - it's a test case
93+
continue
94+
fi
95+
fi
96+
97+
echo -e "${GREEN}--- Crash Program: ${hash} ---${NC}"
4898

4999
if [ -n "$exec_details" ]; then
50100
echo -e "${YELLOW}Execution Details:${NC}"
@@ -54,17 +104,17 @@ show_crash_javascript() {
54104

55105
# Get and decode the JavaScript
56106
echo -e "${YELLOW}JavaScript Code:${NC}"
57-
local base64_program=$(docker exec "$container" psql -U fuzzilli -d "$database" -t -c "SELECT program_base64 FROM program WHERE program_hash = '${hash}';" 2>/dev/null | tr -d ' \n\r')
58107

59108
if [ -n "$base64_program" ]; then
60109
# Decode base64 and extract JavaScript strings
61-
local javascript=$(echo "$base64_program" | base64 -d 2>/dev/null | strings | grep -E "(fuzzilli|function|var|let|const|if|for|while|return)" | head -10)
110+
# Using awk to limit output without head/tail
111+
local javascript=$(echo "$base64_program" | base64 -d 2>/dev/null | strings | grep -E "(fuzzilli|function|var|let|const|if|for|while|return)" | awk 'NR <= 10 { print; if (NR == 10) exit }')
62112

63113
if [ -n "$javascript" ]; then
64114
echo "$javascript" | sed 's/^/ /'
65115
else
66-
# Try to get any readable strings
67-
local all_strings=$(echo "$base64_program" | base64 -d 2>/dev/null | strings | grep -v "^$" | tail -5)
116+
# Try to get any readable strings without tail
117+
local all_strings=$(echo "$base64_program" | base64 -d 2>/dev/null | strings | grep -v "^$" | awk '{ lines[NR] = $0 } END { start = (NR > 5) ? NR - 4 : 1; for (i = start; i <= NR; i++) print lines[i] }')
68118
if [ -n "$all_strings" ]; then
69119
echo "$all_strings" | sed 's/^/ /'
70120
else
@@ -83,8 +133,16 @@ show_crash_javascript() {
83133
if [ -n "$1" ]; then
84134
show_crash_javascript "$1"
85135
else
86-
# Show both workers
87-
show_crash_javascript 1
88-
show_crash_javascript 2
136+
# Dynamically discover and show crashes for all postgres-local-* containers
137+
local_postgres_containers=($(get_local_postgres_containers))
138+
if [ ${#local_postgres_containers[@]} -eq 0 ]; then
139+
echo -e "${YELLOW}No postgres-local-* containers found${NC}"
140+
echo ""
141+
else
142+
for postgres_container in "${local_postgres_containers[@]}"; do
143+
worker_num=$(get_worker_num "$postgres_container")
144+
show_crash_javascript "$worker_num"
145+
done
146+
fi
89147
fi
90148

‎Scripts/show-stats.sh‎

Lines changed: 47 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -58,36 +58,54 @@ get_db_stats() {
5858
local execution_count=$(docker exec "$container" psql -U fuzzilli -d "$database" -t -c "SELECT COUNT(*) FROM execution;" 2>/dev/null | tr -d ' ' || echo "0")
5959
local program_table_count=$(docker exec "$container" psql -U fuzzilli -d "$database" -t -c "SELECT COUNT(*) FROM program;" 2>/dev/null | tr -d ' ' || echo "0")
6060

61-
# Crash count
62-
local crash_count=$(docker exec "$container" psql -U fuzzilli -d "$database" -t -c "SELECT COUNT(*) FROM execution e JOIN execution_outcome eo ON e.execution_outcome_id = eo.id WHERE eo.outcome = 'Crashed';" 2>/dev/null | tr -d ' ' || echo "0")
61+
# Crash count (excluding only FUZZILLI_CRASH test cases with signal 3)
62+
# Show all other crashes including signal 11 and all other signals
63+
local crash_count=$(docker exec "$container" psql -U fuzzilli -d "$database" -t -c "SELECT COUNT(*) FROM execution e JOIN execution_outcome eo ON e.execution_outcome_id = eo.id WHERE eo.outcome = 'Crashed' AND (e.signal_code IS NULL OR e.signal_code != 3);" 2>/dev/null | tr -d ' ' || echo "0")
6364

6465
echo -e "${YELLOW}Statistics:${NC}"
6566
echo " Programs (corpus): $program_count"
6667
echo " Programs (executed): $program_table_count"
6768
echo " Executions: $execution_count"
68-
echo " Crashes: $crash_count"
69+
echo " Crashes (excluding test cases - signal 3): $crash_count"
6970

7071
# Recent activity (last 5 programs)
7172
echo -e "${YELLOW}Recent Programs (last 5):${NC}"
7273
docker exec "$container" psql -U fuzzilli -d "$database" -c "SELECT program_hash, program_size, created_at FROM fuzzer ORDER BY created_at DESC LIMIT 5;" 2>/dev/null || echo " No programs found"
7374

74-
# Crash details
75+
# Crash details (excluding only FUZZILLI_CRASH test cases - signal 3)
76+
# Show all other crashes including signal 11 and all other signals
7577
if [ "$crash_count" != "0" ] && [ "$crash_count" != "" ]; then
76-
echo -e "${YELLOW}Crashes (last 3):${NC}"
77-
docker exec "$container" psql -U fuzzilli -d "$database" -c "SELECT e.execution_id, e.program_hash, e.execution_time_ms, e.signal_code, e.exit_code, eo.description, e.created_at FROM execution e JOIN execution_outcome eo ON e.execution_outcome_id = eo.id WHERE eo.outcome = 'Crashed' ORDER BY e.created_at DESC LIMIT 3;" 2>/dev/null || echo " No crash details available"
78+
echo -e "${YELLOW}Crashes (last 3, excluding test cases - signal 3):${NC}"
79+
docker exec "$container" psql -U fuzzilli -d "$database" -c "SELECT e.execution_id, e.program_hash, e.execution_time_ms, e.signal_code, e.exit_code, eo.description, e.created_at FROM execution e JOIN execution_outcome eo ON e.execution_outcome_id = eo.id WHERE eo.outcome = 'Crashed' AND (e.signal_code IS NULL OR e.signal_code != 3) ORDER BY e.created_at DESC LIMIT 3;" 2>/dev/null || echo " No crash details available"
7880
fi
7981

8082
echo ""
8183
}
8284

85+
# Get all postgres-local-* containers
86+
get_local_postgres_containers() {
87+
docker ps --format '{{.Names}}' | grep '^postgres-local-' | sort
88+
}
89+
90+
# Get all fuzzer-worker-* containers
91+
get_worker_containers() {
92+
docker ps --format '{{.Names}}' | grep '^fuzzer-worker-' | sort
93+
}
94+
95+
# Get worker number from container name
96+
get_worker_num() {
97+
local container=$1
98+
echo "$container" | sed 's/.*-\([0-9]*\)$/\1/'
99+
}
100+
83101
# Get worker container stats
84102
get_worker_stats() {
85103
local worker_num=$1
86104
local container="fuzzer-worker-${worker_num}"
87105
local postgres_container="postgres-local-${worker_num}"
88106

89107
if ! check_container "$container"; then
90-
echo -e "${RED}Worker ${worker_num}: Container not running${NC}"
108+
echo -e "${RED}Worker ${worker_num}: Fuzzer container not running${NC}"
91109
echo ""
92110
return
93111
fi
@@ -121,9 +139,17 @@ else
121139
echo ""
122140
fi
123141

124-
# Worker stats
125-
get_worker_stats 1
126-
get_worker_stats 2
142+
# Worker stats - dynamically discover all workers
143+
local_postgres_containers=($(get_local_postgres_containers))
144+
if [ ${#local_postgres_containers[@]} -eq 0 ]; then
145+
echo -e "${YELLOW}No postgres-local-* containers found${NC}"
146+
echo ""
147+
else
148+
for postgres_container in "${local_postgres_containers[@]}"; do
149+
worker_num=$(get_worker_num "$postgres_container")
150+
get_worker_stats "$worker_num"
151+
done
152+
fi
127153

128154
# Summary
129155
echo -e "${CYAN}========================================${NC}"
@@ -136,16 +162,17 @@ if check_container "fuzzilli-postgres-master"; then
136162
echo -e "Master: ${GREEN}${master_programs}${NC} programs, ${GREEN}${master_executions}${NC} executions"
137163
fi
138164

139-
if check_container "postgres-local-1"; then
140-
w1_programs=$(docker exec postgres-local-1 psql -U fuzzilli -d fuzzilli_local -t -c "SELECT COUNT(*) FROM fuzzer;" 2>/dev/null | tr -d ' ' || echo "0")
141-
w1_executions=$(docker exec postgres-local-1 psql -U fuzzilli -d fuzzilli_local -t -c "SELECT COUNT(*) FROM execution;" 2>/dev/null | tr -d ' ' || echo "0")
142-
echo -e "Worker 1: ${GREEN}${w1_programs}${NC} programs, ${GREEN}${w1_executions}${NC} executions"
143-
fi
144-
145-
if check_container "postgres-local-2"; then
146-
w2_programs=$(docker exec postgres-local-2 psql -U fuzzilli -d fuzzilli_local -t -c "SELECT COUNT(*) FROM fuzzer;" 2>/dev/null | tr -d ' ' || echo "0")
147-
w2_executions=$(docker exec postgres-local-2 psql -U fuzzilli -d fuzzilli_local -t -c "SELECT COUNT(*) FROM execution;" 2>/dev/null | tr -d ' ' || echo "0")
148-
echo -e "Worker 2: ${GREEN}${w2_programs}${NC} programs, ${GREEN}${w2_executions}${NC} executions"
165+
# Dynamically get stats for all local postgres containers
166+
local_postgres_containers=($(get_local_postgres_containers))
167+
if [ ${#local_postgres_containers[@]} -gt 0 ]; then
168+
for postgres_container in "${local_postgres_containers[@]}"; do
169+
worker_num=$(get_worker_num "$postgres_container")
170+
if check_container "$postgres_container"; then
171+
worker_programs=$(docker exec "$postgres_container" psql -U fuzzilli -d fuzzilli_local -t -c "SELECT COUNT(*) FROM fuzzer;" 2>/dev/null | tr -d ' ' || echo "0")
172+
worker_executions=$(docker exec "$postgres_container" psql -U fuzzilli -d fuzzilli_local -t -c "SELECT COUNT(*) FROM execution;" 2>/dev/null | tr -d ' ' || echo "0")
173+
echo -e "Worker ${worker_num}: ${GREEN}${worker_programs}${NC} programs, ${GREEN}${worker_executions}${NC} executions"
174+
fi
175+
done
149176
fi
150177

151178
echo ""

‎Sources/Fuzzilli/Corpus/PostgreSQLCorpus.swift‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -417,6 +417,14 @@ public class PostgreSQLCorpus: ComponentBase, Corpus {
417417
var executionBatchData: [ExecutionBatchData] = []
418418

419419
for (program, aspects, executionType) in batch {
420+
// Filter out test programs with FUZZILLI_CRASH (false positive crashes)
421+
if DatabaseUtils.containsFuzzilliCrash(program: program) {
422+
if enableLogging {
423+
logger.info("Skipping execution with FUZZILLI_CRASH (test case) in batch processing")
424+
}
425+
continue
426+
}
427+
420428
let programHash = DatabaseUtils.calculateProgramHash(program: program)
421429

422430
// Only store unique programs
@@ -936,6 +944,14 @@ public class PostgreSQLCorpus: ComponentBase, Corpus {
936944

937945
/// Store execution with cached data to avoid REPRL context issues
938946
private func storeExecutionWithCachedData(_ program: Program, _ executionData: ExecutionData, _ executionType: DatabaseExecutionPurpose, _ aspects: ProgramAspects) async {
947+
// Filter out test programs with FUZZILLI_CRASH (false positive crashes)
948+
if DatabaseUtils.containsFuzzilliCrash(program: program) {
949+
if enableLogging {
950+
logger.info("Skipping execution storage for program with FUZZILLI_CRASH (test case)")
951+
}
952+
return
953+
}
954+
939955
do {
940956
// Use the registered fuzzer ID
941957
guard let fuzzerId = fuzzerId else {

‎Sources/Fuzzilli/Database/DatabaseUtils.swift‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,10 +103,14 @@ public class DatabaseUtils {
103103
let jsCode = jsLifter.lift(program, withOptions: [])
104104

105105
// Check for patterns like fuzzilli('FUZZILLI_CRASH', ...) or fuzzilli("FUZZILLI_CRASH", ...)
106+
// Specifically check for fuzzilli('FUZZILLI_CRASH', 3) which is a test case
106107
let patterns = [
107108
"fuzzilli('FUZZILLI_CRASH'",
108109
"fuzzilli(\"FUZZILLI_CRASH\"",
109-
"fuzzilli(`FUZZILLI_CRASH`"
110+
"fuzzilli(`FUZZILLI_CRASH`",
111+
"fuzzilli('FUZZILLI_CRASH', 3)",
112+
"fuzzilli(\"FUZZILLI_CRASH\", 3)",
113+
"fuzzilli(`FUZZILLI_CRASH`, 3)"
110114
]
111115

112116
for pattern in patterns {
@@ -115,6 +119,18 @@ public class DatabaseUtils {
115119
}
116120
}
117121

122+
// Also check for the pattern with any whitespace variations
123+
let regexPatterns = [
124+
"fuzzilli\\s*\\(\\s*['\"`]FUZZILLI_CRASH['\"`]\\s*,\\s*3\\s*\\)",
125+
"fuzzilli\\s*\\(\\s*['\"`]FUZZILLI_CRASH['\"`]"
126+
]
127+
128+
for pattern in regexPatterns {
129+
if jsCode.range(of: pattern, options: .regularExpression) != nil {
130+
return true
131+
}
132+
}
133+
118134
return false
119135
}
120136

0 commit comments

Comments
 (0)