benchmark mode: until first bug or until timeout

src/Fuzz/Fuzz.fs

@@ -118,17 +118,21 @@ let rec private fuzzLoop opt contSpec concQ randQ =
   let concQ, randQ = repeatGreyConcolic opt concQ randQ concolicBudget
   // Perform random fuzzing
   let concQ, randQ = repeatRandFuzz opt contSpec concQ randQ randFuzzBudget
-  fuzzLoop opt contSpec concQ randQ
+  if not (TCManage.shallStop opt) then
+      fuzzLoop opt contSpec concQ randQ
 
-let private fuzzingTimer opt = async {
-  let timespan = System.TimeSpan (0, 0, 0, opt.Timelimit)
-  System.Threading.Thread.Sleep (timespan)
-  printLine "Fuzzing timeout expired."
+let private exitWith opt msg = 
+  printLine msg
   if opt.CheckOptionalBugs then TCManage.checkFreezingEtherBug ()
   log "===== Statistics ====="
   TCManage.printStatistics ()
   log "Done, clean up and exit..."
   exit (0)
+
+let private fuzzingTimer opt = async {
+  let timespan = System.TimeSpan (0, 0, 0, opt.Timelimit)
+  System.Threading.Thread.Sleep (timespan)
+  exitWith opt "Fuzzing timeout expired."
 }
 
 let run args =
@@ -147,3 +151,4 @@ let run args =
   let randQ = List.fold RandFuzzQueue.enqueue (RandFuzzQueue.init ()) initSeeds
   log "Start main fuzzing phase"
   fuzzLoop opt contSpec concQ randQ
+  exitWith opt "Fuzzing Stopped"

src/Fuzz/Options.fs

@@ -13,6 +13,7 @@ type FuzzerCLI =
   | [<Unique>] NoDDFA
   | [<Unique>] CheckOptionalBugs
   | [<Unique>] UseOthersOracle
+  | [<Unique>] BenchToBug
 with
   interface IArgParserTemplate with
     member s.Usage =
@@ -29,6 +30,7 @@ with
       | UseOthersOracle ->
         "Report bugs using other tools' oracles as well.\n\
         Currently we support (BD/IB/ME/RE) X (sFuzz/ILF/Mythril/MANTICORE)."
+      | BenchToBug -> "stop analysis after first bug found"
 
 type FuzzOption = {
   Verbosity         : int
@@ -40,6 +42,7 @@ type FuzzOption = {
   DynamicDFA        : bool
   CheckOptionalBugs : bool
   UseOthersOracle   : bool
+  BenchToBug        : bool
 }
 
 let parseFuzzOption (args: string array) =
@@ -55,4 +58,6 @@ let parseFuzzOption (args: string array) =
     StaticDFA = not (r.Contains(<@ NoSDFA @>))  // Enabled by default.
     DynamicDFA = not (r.Contains(<@ NoDDFA @>)) // Enabled by default.
     CheckOptionalBugs = r.Contains(<@ CheckOptionalBugs @>)
-    UseOthersOracle = r.Contains(<@ UseOthersOracle @>) }
+    UseOthersOracle = r.Contains(<@ UseOthersOracle @>) 
+    BenchToBug = r.Contains(<@ BenchToBug @>)
+   }

src/Fuzz/TCManage.fs

@@ -126,3 +126,5 @@ let evalAndSave opt seed =
   if not covGain && duGain && opt.Verbosity >= 2 then
     log "[*] Internal new seed: %s" (Seed.toString seed)
   covGain || duGain // Returns whether this seed is meaningful.
+
+let shallStop opt = (opt.BenchToBug && totalBug > 0)