trvon
|
93eb1f09b2
|
feat(fuzz): M31 Phase 2 — closed-loop fuzz-run promotes to ConcreteWitness
End-to-end: fold scan → fuzz-prep emits Z3-derived seed → fuzz-run
compiles + libFuzzer + ASan → crash ingested → predicted Finding
promoted from Proved to ConcreteWitness in ~1s wall-clock.
P2.1 — Confidence::ConcreteWitness tier
* Strictly stronger than Proved: SMT-feasibility + observed runtime
failure. confidenceRank() gives explicit numeric ordering so the
enum integer values stay incidental.
* FindingKind::FuzzCrash for surprise crashes the SymEx side didn't
predict.
* FuzzWitness evidence sub-struct (seed_path, asan_kind, asan_file,
asan_line) + JSON round-trip.
P2.2 — ASan stderr parser
* include/fold/fuzz/asan_parser.{hpp,cpp} (~150 LOC)
* Parses the canonical SUMMARY tail line — stable across LLVM 15–22
for both ASan (heap-buffer-overflow, SEGV, …) and UBSan
(signed-integer-overflow, …)
* test_asan_parser.cpp: 6 cases / 27 assertions
P2.3 — FuzzRunner
* include/fold/fuzz/runner.{hpp,cpp}
* Synchronous: compile + posix_spawn + waitpid-with-deadline +
artifact-scan. SIGTERM + 1s grace + SIGKILL on parent timeout.
* Per-source `-x c` / `-x c++` pinning so C targets keep their
C linkage and the harness's extern "C" decl resolves.
* Drops -std= entirely — generated harnesses are pre-C++17.
P2.4 + P2.5 — fuzz-run CLI + crash ingestion
* src/cli/fuzz_run_runner.cpp: load findings.predicted.json, group
by function, runFuzzCampaign per harness, replay each crash under
ASan, parse SUMMARY, match (file, line) to predicted Finding.id.
* Matched crashes → augmented Finding with Confidence::ConcreteWitness
+ evidence.fuzz_witness. Unmatched → FindingKind::FuzzCrash.
* Subcommand: --prep-dir, --target-source (rep), --time-budget,
--compiler, --report, --clang-flag.
P2.6 — integration test
* tests/integration/test_fuzz_run.cpp: probes for a clang++ that can
link -fsanitize=fuzzer, builds the null-deref-behind-guard fixture,
chains runFuzzPrep + runFuzzRun, asserts at least one
concrete-witness Finding whose id matches a predicted Finding.id.
* WARN+SUCCEED when no libFuzzer-capable compiler is found so CI
on stripped clang installs stays green.
Tests: 39 → 40 green.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
2026-05-21 15:21:05 -04:00 |
|
