Edge Sync File Id Strategy

packages/core/cli.ts

@@ -74,6 +74,16 @@ yargs(process.argv.slice(2))
 				})
 				.hide("fuzzFunction")
 
+				.option("id_sync_file", {
+					describe:
+						"File used to sync edge ID generation. " +
+						"Needed when fuzzing in multi-process modes",
+					type: "string",
+					default: undefined,
+					group: "Fuzzer:",
+				})
+				.hide("id_sync_file")
+
 				.option("sync", {
 					describe: "Run the fuzz target synchronously.",
 					type: "boolean",
@@ -167,6 +177,7 @@ yargs(process.argv.slice(2))
 				fuzzerOptions: args.corpus.concat(args._),
 				customHooks: args.custom_hooks.map(ensureFilepath),
 				expectedErrors: args.expected_errors,
+				idSyncFile: args.id_sync_file,
 			});
 		}
 	)

packages/core/core.ts

@@ -15,14 +15,20 @@
  */
 
 import path from "path";
-import * as fuzzer from "@jazzer.js/fuzzer";
-import * as hooking from "@jazzer.js/hooking";
-import { registerInstrumentor } from "@jazzer.js/instrumentor";
-import { trackedHooks } from "@jazzer.js/hooking";
 import * as process from "process";
 import * as tmp from "tmp";
 import * as fs from "fs";
 
+import * as fuzzer from "@jazzer.js/fuzzer";
+import * as hooking from "@jazzer.js/hooking";
+import { trackedHooks } from "@jazzer.js/hooking";
+import {
+	registerInstrumentor,
+	Instrumentor,
+	FileSyncIdStrategy,
+	MemorySyncIdStrategy,
+} from "@jazzer.js/instrumentor";
+
 // Remove temporary files on exit
 tmp.setGracefulCleanup();
 
@@ -44,6 +50,7 @@ export interface Options {
 	customHooks: string[];
 	expectedErrors: string[];
 	timeout?: number;
+	idSyncFile?: string;
 }
 
 interface FuzzModule {
@@ -60,7 +67,16 @@ export async function initFuzzing(options: Options) {
 	registerGlobals();
 	await Promise.all(options.customHooks.map(importModule));
 	if (!options.dryRun) {
-		registerInstrumentor(options.includes, options.excludes);
+		registerInstrumentor(
+			new Instrumentor(
+				options.includes,
+				options.excludes,
+
+				options.idSyncFile !== undefined
+					? new FileSyncIdStrategy(options.idSyncFile)
+					: new MemorySyncIdStrategy()
+			)
+		);
 	}
 }
 
@@ -121,6 +137,16 @@ function createWrapperScript(fuzzerOptions: string[]) {
 		(arg) => arg !== "--" && fuzzerOptions.indexOf(arg) === -1
 	);
 
+	if (jazzerArgs.indexOf("--id_sync_file") === -1) {
+		const idSyncFile = tmp.fileSync({
+			mode: 0o600,
+			prefix: "jazzer.js",
+			postfix: "idSync",
+		});
+		jazzerArgs.push("--id_sync_file", idSyncFile.name);
+		fs.closeSync(idSyncFile.fd);
+	}
+
 	const isWindows = process.platform === "win32";
 
 	const scriptContent = `${isWindows ? "@echo off" : "#!/usr/bin/env sh"}

packages/core/jazzer.ts

@@ -15,7 +15,7 @@
  * limitations under the License.
  */
 
-import { addon } from "@jazzer.js/fuzzer";
+import { fuzzer } from "@jazzer.js/fuzzer";
 
 /**
  * Instructs the fuzzer to guide its mutations towards making `current` equal to `target`
@@ -29,7 +29,7 @@ import { addon } from "@jazzer.js/fuzzer";
  * @param id a (probabilistically) unique identifier for this particular compare hint
  */
 function guideTowardsEquality(current: string, target: string, id: number) {
-	addon.traceUnequalStrings(id, current, target);
+	fuzzer.tracer.traceUnequalStrings(id, current, target);
 }
 
 /**
@@ -45,7 +45,7 @@ function guideTowardsEquality(current: string, target: string, id: number) {
  * @param id a (probabilistically) unique identifier for this particular compare hint
  */
 function guideTowardsContainment(needle: string, haystack: string, id: number) {
-	addon.traceStringContainment(id, needle, haystack);
+	fuzzer.tracer.traceStringContainment(id, needle, haystack);
 }
 
 /**
@@ -63,7 +63,7 @@ function guideTowardsContainment(needle: string, haystack: string, id: number) {
  * @param id a (probabilistically) unique identifier for this particular state hint
  */
 function exploreState(state: number, id: number) {
-	addon.tracePcIndir(id, state);
+	fuzzer.tracer.tracePcIndir(id, state);
 }
 
 export interface Jazzer {

packages/fuzzer/addon.ts

@@ -0,0 +1,65 @@
+/*
+ * Copyright 2023 Code Intelligence GmbH
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { default as bind } from "bindings";
+
+export type FuzzTargetAsyncOrValue = (data: Buffer) => void | Promise<void>;
+export type FuzzTargetCallback = (
+	data: Buffer,
+	done: (e?: Error) => void
+) => void;
+export type FuzzTarget = FuzzTargetAsyncOrValue | FuzzTargetCallback;
+export type FuzzOpts = string[];
+
+export type StartFuzzingSyncFn = (
+	fuzzFn: FuzzTarget,
+	fuzzOpts: FuzzOpts
+) => void;
+export type StartFuzzingAsyncFn = (
+	fuzzFn: FuzzTarget,
+	fuzzOpts: FuzzOpts
+) => Promise<void>;
+
+type NativeAddon = {
+	registerCoverageMap: (buffer: Buffer) => void;
+	registerNewCounters: (oldNumCounters: number, newNumCounters: number) => void;
+
+	traceUnequalStrings: (
+		hookId: number,
+		current: string,
+		target: string
+	) => void;
+
+	traceStringContainment: (
+		hookId: number,
+		needle: string,
+		haystack: string
+	) => void;
+	traceIntegerCompare: (
+		hookId: number,
+		current: number,
+		target: number
+	) => void;
+
+	tracePcIndir: (hookId: number, state: number) => void;
+
+	printVersion: () => void;
+	startFuzzing: StartFuzzingSyncFn;
+	startFuzzingAsync: StartFuzzingAsyncFn;
+	stopFuzzingAsync: (status?: number) => void;
+};
+
+export const addon: NativeAddon = bind("jazzerjs");

packages/fuzzer/coverage.ts

@@ -0,0 +1,70 @@
+/*
+ * Copyright 2023 Code Intelligence GmbH
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { addon } from "./addon";
+
+export class CoverageTracker {
+	private static readonly MAX_NUM_COUNTERS: number = 1 << 20;
+	private static readonly INITIAL_NUM_COUNTERS: number = 1 << 9;
+	private readonly coverageMap: Buffer;
+	private currentNumCounters: number;
+
+	constructor() {
+		this.coverageMap = Buffer.alloc(CoverageTracker.MAX_NUM_COUNTERS, 0);
+		this.currentNumCounters = CoverageTracker.INITIAL_NUM_COUNTERS;
+		addon.registerCoverageMap(this.coverageMap);
+		addon.registerNewCounters(0, this.currentNumCounters);
+	}
+
+	enlargeCountersBufferIfNeeded(nextEdgeId: number) {
+		// Enlarge registered counters if needed
+		let newNumCounters = this.currentNumCounters;
+		while (nextEdgeId >= newNumCounters) {
+			newNumCounters = 2 * newNumCounters;
+			if (newNumCounters > CoverageTracker.MAX_NUM_COUNTERS) {
+				throw new Error(
+					`Maximum number (${CoverageTracker.MAX_NUM_COUNTERS}) of coverage counts exceeded.`
+				);
+			}
+		}
+
+		// Register new counters if enlarged
+		if (newNumCounters > this.currentNumCounters) {
+			addon.registerNewCounters(this.currentNumCounters, newNumCounters);
+			this.currentNumCounters = newNumCounters;
+			console.log(
+				`INFO: New number of coverage counters ${this.currentNumCounters}`
+			);
+		}
+	}
+
+	/**
+	 * Increments the coverage counter for a given ID.
+	 * This function implements the NeverZero policy from AFL++.
+	 * See https://aflplus.plus//papers/aflpp-woot2020.pdf
+	 * @param edgeId the edge ID of the coverage counter to increment
+	 */
+	incrementCounter(edgeId: number) {
+		const counter = this.coverageMap.readUint8(edgeId);
+		this.coverageMap.writeUint8(counter == 255 ? 1 : counter + 1, edgeId);
+	}
+
+	readCounter(edgeId: number): number {
+		return this.coverageMap.readUint8(edgeId);
+	}
+}
+
+export const coverageTracker = new CoverageTracker();