Reachability example

[tokatoka]

An example fuzzer for Other objectives examples.
The fuzzer checks if the fuzzer has reached a given program point (like in directed greybox fuzzing).

use diff.patch to patch libpng-1.6.37/png.c and insert instrumentation.

TODO:

• Bring hook_func deeper inside the libpng into a decent position
• Maybe ReachbilityFeedback/Observer should maintain a vector of targets instead of a single target? (so that we can check multiple program points at the same time)

[tokatoka]

So, currently I am directly inserting code(hook_func) into libpng's source code.
Would this be a good way for checking reachability?
and is there some better solution than this (like dlsym in case of a dynamic lib)
png.c line 384

#include <stdint.h>
size_t libafl_target_ctr = 0;
void hook_func(){
   //uintptr_t k = (uintptr_t)__builtin_return_address(0);
   libafl_target_ctr += 1;
}

void PNGAPI
png_destroy_info_struct(png_const_structrp png_ptr, png_infopp info_ptr_ptr)
{
   png_inforp info_ptr = NULL;

   png_debug(1, "in png_destroy_info_struct");
   hook_func();

   if (png_ptr == NULL)
      return;

   if (info_ptr_ptr != NULL)
      info_ptr = *info_ptr_ptr;

[andreafioraldi]

For multiple program point you can use a MapFeedback maybe, but then you need to know the number of points in advance

[tokatoka]

alright, I've decided to use StdMapObserver instead.

[andreafioraldi]

@tokatoka lgtm, can you format and rebase on #85 ?

[tokatoka]

libfuzzer_libpng crashes at this line.
https://github.com/AFLplusplus/LibAFL/blob/dev/libafl/src/corpus/minimizer.rs#L167
which is called here in state/mod.rs

            self.feedback_mut().append_metadata(&mut testcase)?;
            let idx = self.corpus.add(testcase)?;
            scheduler.on_add(self, idx)?;

I guess, we might be missing append/discard_metadata for {and, or, not} feedback, maybe? 💭
(I mean not the default Ok(()) but we should append metadata from each feedback instance if the final result (the top-level boolean value) is evaluated as True, I guess)

[tokatoka]

Now that it works