Saturating version of InRange, new variable UsingSymExec

src/include/deepstate/DeepState.h

@@ -230,17 +230,41 @@ DEEPSTATE_INLINE static void DeepState_Check(int expr) {
   }
 }
 
-/* Return a symbolic value in a the range `[low_inc, high_inc]`. */
+/* Return a symbolic value in a the range `[low_inc, high_inc]`.
+ *
+ * Current implementation saturates values. An alternative implementation
+ * worth exploring, and perhaps supporting in addition to saturation, is
+ * something like:
+ *
+ *    x = symbolic_value;
+ *    size = (high - low) + 1
+ *    if (symbolic mode) {
+ *      assume 0 <= x and x < size
+ *      return x
+ *    } else {
+ *      return low + (x % size)
+ *    }
+ *
+ * This type of version lets a reducer drive toward zero.
+ */
 #define DEEPSTATE_MAKE_SYMBOLIC_RANGE(Tname, tname) \
     DEEPSTATE_INLINE static tname DeepState_ ## Tname ## InRange( \
         tname low, tname high) { \
-      tname x = DeepState_ ## Tname(); \
-      if (!(DeepState_UsingLibFuzzer || HAS_FLAG_input_test_file \
-            || HAS_FLAG_input_test_dir || HAS_FLAG_input_test_files_dir)) \
+      if (low > high) { \
+        return DeepState_ ## Tname ## InRange(high, low); \
+      } \
+      const tname x = DeepState_ ## Tname(); \
+      if (DeepState_UsingSymExec) { \
         (void) DeepState_Assume(low <= x && x <= high); \
-      else \
-        x = low + (x%((high+1)-low)); \
-      return x; \
+        return x; \
+      } \
+      if (x < low) { \
+        return low; \
+      } else if (x > high) { \
+        return high; \
+      } else { \
+        return x; \
+      } \
     }
 
 DEEPSTATE_MAKE_SYMBOLIC_RANGE(Size, size_t)

src/include/deepstate/Log.h

@@ -24,6 +24,7 @@
 DEEPSTATE_BEGIN_EXTERN_C
 
 extern int DeepState_UsingLibFuzzer;
+extern int DeepState_UsingSymExec;
 
 struct DeepState_Stream;
 

src/lib/DeepState.c

@@ -38,6 +38,12 @@ DEFINE_bool(take_over, false, "Replay test cases in take-over mode.");
 DEFINE_bool(abort_on_fail, false, "Abort on file replay failure (useful in file fuzzing).");
 DEFINE_bool(verbose_reads, false, "Report on bytes being read during execution of test.");
 
+/* Set to 1 by Manticore/Angr/etc. when we're running symbolically. */
+int DeepState_UsingSymExec = 0;
+
+/* Set to 1 when we're using libFuzzer. */
+int DeepState_UsingLibFuzzer = 0;
+
 /* Pointer to the last registers DeepState_TestInfo data structure */
 struct DeepState_TestInfo *DeepState_LastTestInfo = NULL;
 
@@ -366,6 +372,9 @@ const struct DeepState_IndexEntry DeepState_API[] = {
   {"StreamFloat",     (void *) _DeepState_StreamFloat},
   {"StreamString",    (void *) _DeepState_StreamString},
 
+  {"UsingLibFuzzer", (void *) &DeepState_UsingLibFuzzer},
+  {"UsingSymExec", (void *) &DeepState_UsingSymExec},
+
   {NULL, NULL},
 };
 

src/lib/Log.c

@@ -66,7 +66,7 @@ enum {
   DeepState_LogBufSize = 4096
 };
 
-int DeepState_UsingLibFuzzer = 0;
+extern int DeepState_UsingLibFuzzer;
 
 char DeepState_LogBuf[DeepState_LogBufSize + 1] = {};