[libFuzzer] add a symbolic execution puzzle (difficult for today's libFuzzer).
Summary: This can be solved just in seconds with KLEE. Current libFuzzer is able to satistfy 101 constraints out of 410 constraints presented during the first hour of running with -use_value_profile=1 and -max_len=20. During the next 3 hours, libFuzzer is able to generate ~50 NEW inputs, bot none of those solve any new constraint. During the next 20 hours, it didn't find any NEW inputs. This test might be interesting for experimenting with the data flow tracing approach started in https://reviews.llvm.org/D46666. For the solution with KLEE and other information, see https://github.com/Dor1s/codegate2017-quals-angrybird Reviewers: kcc Reviewed By: kcc Subscribers: delcypher, llvm-commits, #sanitizers Differential Revision: https://reviews.llvm.org/D46924 llvm-svn: 332507
Loading
Please sign in to comment