tools/insn-fuzz: Fix a stability bug in afl-clang-fast mode
authorAndrew Cooper <andrew.cooper3@citrix.com>
Mon, 20 Mar 2017 19:17:33 +0000 (19:17 +0000)
committerAndrew Cooper <andrew.cooper3@citrix.com>
Thu, 6 Apr 2017 17:42:49 +0000 (18:42 +0100)
commit8ba7b845c2a68f9d025710a57c87870b3ad19ac8
tree375472eb71978a8cdb02e32d1fa21a2333d6b833
parentb163e550df2127b2bd1fbce682bed87e8d18d0dc
tools/insn-fuzz: Fix a stability bug in afl-clang-fast mode

The fuzzing harness conditionally disables hooks to test error paths in the
emulator.  However, fuzz_emulops is a static structure.

c/s 69f4633 "tools/insn-fuzz: Support AFL's afl-clang-fast mode" introduced
persistent mode, but because fuzz_emulops is static, the clobbering of hooks
accumulates over repeated input, meaning that previous corpora influence the
execution over the current corpus.

Move the partially clobbered struct x86_emulate_ops into struct fuzz_state,
which is re-initialised from full on each call to LLVMFuzzerTestOneInput()

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
tools/fuzz/x86_instruction_emulator/fuzz-emul.c