carolemieux/afl-rb

Relax exclude list condition

Opened this issue · 0 comments

Currently a branch is added to the exclude list (blacklist) if the branch mask marks it as completely unmodifiable. Fuzzing continues since we allow insertion at the end of the input regardless. This is contrary to what was documented in the paper.

In a toy program I was testing on this meant that some branches were incorrectly added to the exclude list (say none of the points of the input could be modified without changing the branch, i.e. if delta-debugging was done successfully), when they were in fact hittable by modification.

Consider changing this to be what was described in the paper: add to exclude list only if NONE of the mutated inputs hit the branch in question.