Support mutation depth during minimization

Multiple mutations may be necessary to achieve a shorter crashing input.
nikic · Feb 27, 2023 · adf4068 · adf4068
1 parent ed86f3c
commit adf4068
Showing 1 changed file with 15 additions and 13 deletions.
diff --git a/src/Fuzzer.php b/src/Fuzzer.php
@@ -333,22 +333,24 @@ private function minimizeCrash(string $path) {
         }
 
         while ($this->runs < $this->maxRuns) {
-            // TODO: Mutation depth, etc.
-            $newInput = $this->mutator->mutate($input, $this->maxLen, null);
-            if (\strlen($newInput) >= \strlen($input)) {
-                continue;
-            }
+            $newInput = $input;
+            for ($m = 0; $m < $this->mutationDepthLimit; $m++) {
+                $newInput = $this->mutator->mutate($newInput, $this->maxLen, null);
+                if (\strlen($newInput) >= \strlen($input)) {
+                    continue;
+                }
 
-            $newEntry = $this->runInput($newInput);
-            if (!$newEntry->crashInfo) {
-                continue;
-            }
+                $newEntry = $this->runInput($newInput);
+                if (!$newEntry->crashInfo) {
+                    continue;
+                }
 
-            $newEntry->storeAtPath(getcwd() . '/minimized-' . md5($newInput) . '.txt');
+                $newEntry->storeAtPath(getcwd() . '/minimized-' . md5($newInput) . '.txt');
 
-            $len = \strlen($newInput);
-            $this->printCrash("CRASH with length $len", $newEntry);
-            $input = $newInput;
+                $len = \strlen($newInput);
+                $this->printCrash("CRASH with length $len", $newEntry);
+                $input = $newInput;
+            }
         }
     }