Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

GeneralizationStage takes an unreasonably long time #1545

Closed
2 tasks
addisoncrump opened this issue Sep 22, 2023 · 6 comments
Closed
2 tasks

GeneralizationStage takes an unreasonably long time #1545

addisoncrump opened this issue Sep 22, 2023 · 6 comments
Assignees
Labels
enhancement New feature or request help wanted Extra attention is needed libafl_libfuzzer Bugs or features relating to libafl_libfuzzer

Comments

@addisoncrump
Copy link
Collaborator

addisoncrump commented Sep 22, 2023

While testing GeneralizationStage in libafl_libfuzzer, we observed that some inputs may take exceedingly long amounts of time to be generalized. This is due to two issues:

  • GeneralizationStage cannot recover if a solution causes a crash or timeout, meaning that the fuzzer may never be able to complete a stage tuple execution for an input which has this behaviour (related: Refactor stages to allow for continuation after crashes #1341)
  • GeneralizationStage attempts to execute the input between every gap discovered in the input for whether it removes the most-recently-novel edges. This can mean tens of thousands of executions spent on generalization, only to squeeze out a few more inputs that might trigger new edges.

We should investigate if we can improve its performance or switch to other strategies (see: #1542).

@addisoncrump addisoncrump added enhancement New feature or request help wanted Extra attention is needed libafl_libfuzzer Bugs or features relating to libafl_libfuzzer labels Sep 22, 2023
@s1341
Copy link
Collaborator

s1341 commented Jan 7, 2024

I can confirm that this is still an issue!

@tokatoka
Copy link
Member

tokatoka commented Nov 8, 2024

there's no real solution to this problem

@tokatoka tokatoka closed this as completed Nov 8, 2024
@domenukk
Copy link
Member

domenukk commented Nov 8, 2024

Can't we simply do a timeout and if it takes too long, skip it?

@tokatoka
Copy link
Member

tokatoka commented Nov 8, 2024

not a time out but i already have the upper bound on how many times it does this stage
but it's not a solution

@domenukk
Copy link
Member

domenukk commented Nov 9, 2024

Why is a timeout not a solution, it keeps it from getting locked up

@tokatoka
Copy link
Member

tokatoka commented Nov 9, 2024

longer inputs will have timeout. so by having a timeout you can't do this stage properly with long inputs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request help wanted Extra attention is needed libafl_libfuzzer Bugs or features relating to libafl_libfuzzer
Projects
None yet
Development

No branches or pull requests

4 participants