Completely rewrite AFL integration using modern AFL.rs; boosts fuzzin…

…g speed ~10x, among other things.

png-afl/Cargo.toml

@@ -1,14 +1,10 @@
 [package]
 name = "png-afl"
-version = "0.1.0"
-authors = ["nwin <nwin@users.noreply.github.com>"]
+version = "0.2.0"
+authors = ["Sergey Davidoff <shnatsel@gmail.com>", "Paul Grandperrin <paul.grandperrin@gmail.com>"]
 
-[dependencies.png]
-version = "*"
-path = "../"
+[dependencies]
+afl = "0.4.0"
+png = {path = "../"}
 
-[dependencies.afl-plugin]
-git = "https://github.com/kmcallister/afl.rs"
 
-[dependencies.afl]
-git = "https://github.com/kmcallister/afl.rs"

png-afl/src/main.rs

@@ -1,34 +1,31 @@
-#![feature(test)]
-#![feature(plugin)]
-#![plugin(afl_coverage_plugin)]
-
-extern crate afl_coverage;
-extern crate test;
+extern crate afl;
 extern crate png;
 
-use png::HasParameters;
-use std::io::{self, Read};
+const ASAN_DEFAULT_OPTIONS: &'static [u8] = b"detect_odr_violation=1\0";
 
-fn main() {
-    let mut input = Vec::new();
-    io::stdin().read_to_end(&mut input).unwrap();
-    let mut decoder = png::Decoder::new(&*input);
-    /*let file = ::std::fs::File::open(
-        "fuzzer_out/crashes/id:000002,sig:04,src:000005,op:flip1,pos:43"
-    ).unwrap();
-    let mut decoder = png::Decoder::new(file);*/
-    match (|| -> Result<(), png::DecodingError> {
-        let (info, mut reader) = try!(decoder.read_info());
-        println!("width = {}, height = {}", info.width, info.height);
-        if info.buffer_size() > 50_000_000 {
-            return Ok(())
-        }
-        let mut img_data = vec![0; info.buffer_size()];
-        let frame = try!(reader.next_frame(&mut img_data));
-        println!("frame 1: {:?}", frame);
-        Ok(())
-    })() {
-        Ok(_) => (),
-        Err(err) => println!("{:?}", err)
+#[no_mangle]
+pub extern "C" fn __asan_default_options() -> *const u8 {
+    ASAN_DEFAULT_OPTIONS as *const [u8] as *const u8
+}
+
+#[inline(always)]
+fn png_decode(data: &[u8]) -> Result<(png::OutputInfo, Vec<u8>), ()> {
+    let decoder = png::Decoder::new(data);
+    let (info, mut reader) = decoder.read_info().map_err(|_| ())?;
+
+    if info.buffer_size() > 5_000_000 {
+        return Err(());
     }
-}
+
+    let mut img_data = Vec::with_capacity(info.buffer_size());
+    reader.next_frame(&mut img_data).map_err(|_| ())?;
+
+    Ok((info, img_data))
+}
+
+fn main() {
+    afl::fuzz(|data| {
+    //afl::read_stdio_bytes(|data| {
+        png_decode(&data);
+    });
+}