Don't confuse corpus and solutions (#3397)

* don't confuse corpus and solutions

* fix import

* fix test

* ver

Author: tokatoka

crates/libafl/src/fuzzer/mod.rs

@@ -217,7 +217,7 @@ pub trait Evaluator<E, EM, I, S> {
         executor: &mut E,
         manager: &mut EM,
         input: I,
-    ) -> Result<(CorpusId, ExecuteInputResult), Error>;
+    ) -> Result<CorpusId, Error>;
 
     /// Adds the input to the corpus as a disabled input.
     /// Used during initial corpus loading.
@@ -273,45 +273,15 @@ pub trait Fuzzer<E, EM, I, S, ST> {
         iters: u64,
     ) -> Result<CorpusId, Error>;
 }
-
-/// The corpus this input should be added to
-#[derive(Debug, PartialEq, Eq, Default)]
-pub struct ExecuteInputResult {
-    is_corpus: bool,
-    is_solution: bool,
-}
-
-impl ExecuteInputResult {
-    /// Constructor
-    #[must_use]
-    pub fn new(is_corpus: bool, is_solution: bool) -> Self {
-        Self {
-            is_corpus,
-            is_solution,
-        }
-    }
-
-    /// if this is corpus worthy
-    #[must_use]
-    pub fn is_corpus(&self) -> bool {
-        self.is_corpus
-    }
-
-    /// if this is solution worthy
-    #[must_use]
-    pub fn is_solution(&self) -> bool {
-        self.is_solution
-    }
-
-    /// tell that this is corpus
-    pub fn set_is_corpus(&mut self, v: bool) {
-        self.is_corpus = v;
-    }
-
-    /// tell that this is solution
-    pub fn set_is_solution(&mut self, v: bool) {
-        self.is_solution = v;
-    }
+/// The result of harness execution
+#[derive(Debug, PartialEq, Eq)]
+pub enum ExecuteInputResult {
+    /// No special input
+    None,
+    /// This input should be stored in the corpus
+    Corpus,
+    /// This input leads to a solution
+    Solution,
 }
 
 /// Your default fuzzer instance, for everyday use.
@@ -403,7 +373,7 @@ where
         observers: &OT,
         exit_kind: &ExitKind,
     ) -> Result<ExecuteInputResult, Error> {
-        let mut res = ExecuteInputResult::default();
+        let mut res = ExecuteInputResult::None;
 
         #[cfg(not(feature = "introspection"))]
         let is_solution = self
@@ -416,22 +386,21 @@ where
             .is_interesting_introspection(state, manager, input, observers, exit_kind)?;
 
         if is_solution {
-            res.set_is_solution(true);
-        }
-
-        #[cfg(not(feature = "introspection"))]
-        let corpus_worthy = self
-            .feedback_mut()
-            .is_interesting(state, manager, input, observers, exit_kind)?;
-        #[cfg(feature = "introspection")]
-        let corpus_worthy = self
-            .feedback_mut()
-            .is_interesting_introspection(state, manager, input, observers, exit_kind)?;
-
-        if corpus_worthy {
-            res.set_is_corpus(true);
+            res = ExecuteInputResult::Solution;
+        } else {
+            #[cfg(not(feature = "introspection"))]
+            let corpus_worthy = self
+                .feedback_mut()
+                .is_interesting(state, manager, input, observers, exit_kind)?;
+            #[cfg(feature = "introspection")]
+            let corpus_worthy = self
+                .feedback_mut()
+                .is_interesting_introspection(state, manager, input, observers, exit_kind)?;
+
+            if corpus_worthy {
+                res = ExecuteInputResult::Corpus;
+            }
         }
-
         Ok(res)
     }
 
@@ -444,42 +413,42 @@ where
         manager: &mut EM,
         input: &I,
         exec_res: &ExecuteInputResult,
-        exit_kind: &ExitKind,
+        _exit_kind: &ExitKind,
         observers: &OT,
     ) -> Result<Option<CorpusId>, Error> {
-        let corpus = if exec_res.is_corpus() {
-            // Add the input to the main corpus
-            let mut testcase = Testcase::from(input.clone());
-            testcase.set_executions(*state.executions());
-            #[cfg(feature = "track_hit_feedbacks")]
-            self.feedback_mut()
-                .append_hit_feedbacks(testcase.hit_feedbacks_mut())?;
-            self.feedback_mut()
-                .append_metadata(state, manager, observers, &mut testcase)?;
-            let id = state.corpus_mut().add(testcase)?;
-            self.scheduler_mut().on_add(state, id)?;
-            Ok(Some(id))
-        } else {
-            Ok(None)
-        };
-
-        if exec_res.is_solution() {
-            // The input is a solution, add it to the respective corpus
-            let mut testcase = Testcase::from(input.clone());
-            testcase.set_executions(*state.executions());
-            testcase.add_metadata(*exit_kind);
-            testcase.set_parent_id_optional(*state.corpus().current());
-            if let Ok(mut tc) = state.current_testcase_mut() {
-                tc.found_objective();
+        match exec_res {
+            ExecuteInputResult::None => Ok(None),
+            ExecuteInputResult::Corpus => {
+                // Not a solution
+                // Add the input to the main corpus
+                let mut testcase = Testcase::from(input.clone());
+                #[cfg(feature = "track_hit_feedbacks")]
+                self.feedback_mut()
+                    .append_hit_feedbacks(testcase.hit_feedbacks_mut())?;
+                self.feedback_mut()
+                    .append_metadata(state, manager, observers, &mut testcase)?;
+                let id = state.corpus_mut().add(testcase)?;
+                self.scheduler_mut().on_add(state, id)?;
+
+                Ok(Some(id))
+            }
+            ExecuteInputResult::Solution => {
+                // The input is a solution, add it to the respective corpus
+                let mut testcase = Testcase::from(input.clone());
+                testcase.set_parent_id_optional(*state.corpus().current());
+                if let Ok(mut tc) = state.current_testcase_mut() {
+                    tc.found_objective();
+                }
+                #[cfg(feature = "track_hit_feedbacks")]
+                self.objective_mut()
+                    .append_hit_feedbacks(testcase.hit_objectives_mut())?;
+                self.objective_mut()
+                    .append_metadata(state, manager, observers, &mut testcase)?;
+                state.solutions_mut().add(testcase)?;
+
+                Ok(None)
             }
-            #[cfg(feature = "track_hit_feedbacks")]
-            self.objective_mut()
-                .append_hit_feedbacks(testcase.hit_objectives_mut())?;
-            self.objective_mut()
-                .append_metadata(state, manager, observers, &mut testcase)?;
-            state.solutions_mut().add(testcase)?;
         }
-        corpus
     }
 
     fn serialize_and_dispatch(
@@ -492,14 +461,20 @@ where
         exit_kind: &ExitKind,
     ) -> Result<(), Error> {
         // Now send off the event
-        let observers_buf = if exec_res.is_corpus()
-            && manager.should_send()
-            && manager.configuration() != EventConfig::AlwaysUnique
-        {
-            // TODO set None for fast targets
-            Some(postcard::to_allocvec(observers)?)
-        } else {
-            None
+        let observers_buf = match exec_res {
+            ExecuteInputResult::Corpus => {
+                if manager.should_send() {
+                    // TODO set None for fast targets
+                    if manager.configuration() == EventConfig::AlwaysUnique {
+                        None
+                    } else {
+                        Some(postcard::to_allocvec(observers)?)
+                    }
+                } else {
+                    None
+                }
+            }
+            _ => None,
         };
 
         self.dispatch_event(state, manager, input, exec_res, observers_buf, exit_kind)?;
@@ -516,38 +491,42 @@ where
         exit_kind: &ExitKind,
     ) -> Result<(), Error> {
         // Now send off the event
-        if manager.should_send() {
-            if exec_res.is_corpus() {
-                manager.fire(
-                    state,
-                    EventWithStats::with_current_time(
-                        Event::NewTestcase {
-                            input: input.clone(),
-                            observers_buf,
-                            exit_kind: *exit_kind,
-                            corpus_size: state.corpus().count(),
-                            client_config: manager.configuration(),
-                            forward_id: None,
-                            #[cfg(all(unix, feature = "std", feature = "multi_machine"))]
-                            node_id: None,
-                        },
-                        *state.executions(),
-                    ),
-                )?;
+        match exec_res {
+            ExecuteInputResult::Corpus => {
+                if manager.should_send() {
+                    manager.fire(
+                        state,
+                        EventWithStats::with_current_time(
+                            Event::NewTestcase {
+                                input: input.clone(),
+                                observers_buf,
+                                exit_kind: *exit_kind,
+                                corpus_size: state.corpus().count(),
+                                client_config: manager.configuration(),
+                                forward_id: None,
+                                #[cfg(all(unix, feature = "std", feature = "multi_machine"))]
+                                node_id: None,
+                            },
+                            *state.executions(),
+                        ),
+                    )?;
+                }
             }
-
-            if exec_res.is_solution() {
-                manager.fire(
-                    state,
-                    EventWithStats::with_current_time(
-                        Event::Objective {
-                            input: self.share_objectives.then_some(input.clone()),
-                            objective_size: state.solutions().count(),
-                        },
-                        *state.executions(),
-                    ),
-                )?;
+            ExecuteInputResult::Solution => {
+                if manager.should_send() {
+                    manager.fire(
+                        state,
+                        EventWithStats::with_current_time(
+                            Event::Objective {
+                                input: self.share_objectives.then_some(input.clone()),
+                                objective_size: state.solutions().count(),
+                            },
+                            *state.executions(),
+                        ),
+                    )?;
+                }
             }
+            ExecuteInputResult::None => (),
         }
 
         Ok(())
@@ -568,7 +547,7 @@ where
         if send_events {
             self.serialize_and_dispatch(state, manager, input, &exec_res, observers, exit_kind)?;
         }
-        if exec_res.is_corpus() || exec_res.is_solution() {
+        if exec_res != ExecuteInputResult::None {
             *state.last_found_time_mut() = current_time();
         }
         Ok((exec_res, corpus_id))
@@ -687,7 +666,7 @@ where
         if self.input_filter.should_execute(input) {
             self.evaluate_input(state, executor, manager, input)
         } else {
-            Ok((ExecuteInputResult::default(), None))
+            Ok((ExecuteInputResult::None, None))
         }
     }
 
@@ -712,7 +691,7 @@ where
         executor: &mut E,
         manager: &mut EM,
         input: I,
-    ) -> Result<(CorpusId, ExecuteInputResult), Error> {
+    ) -> Result<CorpusId, Error> {
         *state.last_found_time_mut() = current_time();
 
         let exit_kind = self.execute_input(state, executor, manager, &input)?;
@@ -743,7 +722,7 @@ where
             self.objective_mut()
                 .append_metadata(state, manager, &*observers, &mut testcase)?;
             // we don't care about solution id
-            let _ = state.solutions_mut().add(testcase.clone())?;
+            let id = state.solutions_mut().add(testcase)?;
 
             manager.fire(
                 state,
@@ -755,17 +734,19 @@ where
                     *state.executions(),
                 ),
             )?;
+
+            return Ok(id);
         }
 
         // several is_interesting implementations collect some data about the run, later used in
         // append_metadata; we *must* invoke is_interesting here to collect it
         #[cfg(not(feature = "introspection"))]
-        let corpus_worthy =
+        let _corpus_worthy =
             self.feedback_mut()
                 .is_interesting(state, manager, &input, &*observers, &exit_kind)?;
 
         #[cfg(feature = "introspection")]
-        let corpus_worthy = self.feedback_mut().is_interesting_introspection(
+        let _corpus_worthy = self.feedback_mut().is_interesting_introspection(
             state,
             manager,
             &input,
@@ -803,7 +784,7 @@ where
                 *state.executions(),
             ),
         )?;
-        Ok((id, ExecuteInputResult::new(corpus_worthy, is_solution)))
+        Ok(id)
     }
 
     fn add_disabled_input(&mut self, state: &mut S, input: I) -> Result<CorpusId, Error> {

crates/libafl/src/inputs/encoded.rs

@@ -320,9 +320,9 @@ mod tests {
     fn test_targetbytes_fuzzer_builds() {
         const TRUE_VAL: bool = true;
 
-        let observer = ValueObserver::new("test_value", OwnedRef::Ref(&TRUE_VAL));
-        let mut true_feedback = BoolValueFeedback::new(&observer.handle());
-        let mut true_objective = BoolValueFeedback::new(&observer.handle());
+        let true_observer = ValueObserver::new("test_value", OwnedRef::Ref(&TRUE_VAL));
+        let mut feedback = BoolValueFeedback::new(&true_observer.handle());
+        let mut objective = tuple_list!();
 
         let (bytes_converter, input) = setup_encoder_decoder();
         let input_clone = input.clone();
@@ -332,8 +332,8 @@ mod tests {
             StdRand::new(),
             InMemoryCorpus::new(),
             InMemoryCorpus::new(),
-            &mut true_feedback,
-            &mut true_objective,
+            &mut feedback,
+            &mut objective,
         )
         .unwrap();
 
@@ -345,13 +345,13 @@ mod tests {
         let mut fuzzer = StdFuzzer::builder()
             .target_bytes_converter(bytes_converter)
             .scheduler(QueueScheduler::new())
-            .feedback(true_feedback)
-            .objective(true_objective)
+            .feedback(feedback)
+            .objective(objective)
             .build();
 
         let mut executor = InProcessExecutor::new(
             &mut harness_fn,
-            tuple_list!(observer),
+            tuple_list!(true_observer),
             &mut fuzzer,
             &mut state,
             &mut event_mgr,