diff options
Diffstat (limited to 'gnu/llvm/lib/Fuzzer')
93 files changed, 3587 insertions, 946 deletions
diff --git a/gnu/llvm/lib/Fuzzer/CMakeLists.txt b/gnu/llvm/lib/Fuzzer/CMakeLists.txt index d4d85041d21..16a769fafb9 100644 --- a/gnu/llvm/lib/Fuzzer/CMakeLists.txt +++ b/gnu/llvm/lib/Fuzzer/CMakeLists.txt @@ -1,32 +1,35 @@ -set(LIBFUZZER_FLAGS_BASE "${CMAKE_CXX_FLAGS_RELEASE}") +set(LIBFUZZER_FLAGS_BASE "${CMAKE_CXX_FLAGS}") # Disable the coverage and sanitizer instrumentation for the fuzzer itself. -set(CMAKE_CXX_FLAGS_RELEASE "${LIBFUZZER_FLAGS_BASE} -O2 -fno-sanitize=all") +set(CMAKE_CXX_FLAGS "${LIBFUZZER_FLAGS_BASE} -fno-sanitize=all -fno-sanitize-coverage=edge,trace-cmp,indirect-calls,8bit-counters -Werror") if( LLVM_USE_SANITIZE_COVERAGE ) + if(NOT "${LLVM_USE_SANITIZER}" STREQUAL "Address") + message(FATAL_ERROR + "LibFuzzer and its tests require LLVM_USE_SANITIZER=Address and " + "LLVM_USE_SANITIZE_COVERAGE=YES to be set." + ) + endif() add_library(LLVMFuzzerNoMainObjects OBJECT FuzzerCrossOver.cpp - FuzzerInterface.cpp FuzzerTraceState.cpp FuzzerDriver.cpp + FuzzerExtFunctionsDlsym.cpp + FuzzerExtFunctionsWeak.cpp FuzzerIO.cpp FuzzerLoop.cpp FuzzerMutate.cpp - FuzzerSanitizerOptions.cpp FuzzerSHA1.cpp + FuzzerTracePC.cpp FuzzerUtil.cpp ) add_library(LLVMFuzzerNoMain STATIC $<TARGET_OBJECTS:LLVMFuzzerNoMainObjects> ) - if( HAVE_LIBPTHREAD ) - target_link_libraries(LLVMFuzzerNoMain pthread) - endif() + target_link_libraries(LLVMFuzzerNoMain ${PTHREAD_LIB}) add_library(LLVMFuzzer STATIC FuzzerMain.cpp $<TARGET_OBJECTS:LLVMFuzzerNoMainObjects> ) - if( HAVE_LIBPTHREAD ) - target_link_libraries(LLVMFuzzer pthread) - endif() + target_link_libraries(LLVMFuzzer ${PTHREAD_LIB}) if( LLVM_INCLUDE_TESTS ) add_subdirectory(test) diff --git a/gnu/llvm/lib/Fuzzer/FuzzerDriver.cpp b/gnu/llvm/lib/Fuzzer/FuzzerDriver.cpp index 66e46dbf3aa..f520a5cfdc4 100644 --- a/gnu/llvm/lib/Fuzzer/FuzzerDriver.cpp +++ b/gnu/llvm/lib/Fuzzer/FuzzerDriver.cpp @@ -12,16 +12,18 @@ #include "FuzzerInterface.h" #include "FuzzerInternal.h" -#include <cstring> -#include <chrono> -#include <unistd.h> -#include <thread> +#include <algorithm> #include <atomic> +#include <chrono> +#include <cstring> #include <mutex> #include <string> -#include <sstream> -#include <algorithm> -#include <iterator> +#include <thread> +#include <unistd.h> + +// This function should be present in the libFuzzer so that the client +// binary can test for its existence. +extern "C" __attribute__((used)) void __libfuzzer_is_present() {} namespace fuzzer { @@ -36,16 +38,20 @@ struct FlagDescription { }; struct { +#define FUZZER_DEPRECATED_FLAG(Name) #define FUZZER_FLAG_INT(Name, Default, Description) int Name; #define FUZZER_FLAG_UNSIGNED(Name, Default, Description) unsigned int Name; #define FUZZER_FLAG_STRING(Name, Description) const char *Name; #include "FuzzerFlags.def" +#undef FUZZER_DEPRECATED_FLAG #undef FUZZER_FLAG_INT #undef FUZZER_FLAG_UNSIGNED #undef FUZZER_FLAG_STRING } Flags; static const FlagDescription FlagDescriptions [] { +#define FUZZER_DEPRECATED_FLAG(Name) \ + {#Name, "Deprecated; don't use", 0, nullptr, nullptr, nullptr}, #define FUZZER_FLAG_INT(Name, Default, Description) \ {#Name, Description, Default, &Flags.Name, nullptr, nullptr}, #define FUZZER_FLAG_UNSIGNED(Name, Default, Description) \ @@ -54,6 +60,7 @@ static const FlagDescription FlagDescriptions [] { #define FUZZER_FLAG_STRING(Name, Description) \ {#Name, Description, 0, nullptr, &Flags.Name, nullptr}, #include "FuzzerFlags.def" +#undef FUZZER_DEPRECATED_FLAG #undef FUZZER_FLAG_INT #undef FUZZER_FLAG_UNSIGNED #undef FUZZER_FLAG_STRING @@ -66,8 +73,14 @@ static std::vector<std::string> *Inputs; static std::string *ProgName; static void PrintHelp() { - Printf("Usage: %s [-flag1=val1 [-flag2=val2 ...] ] [dir1 [dir2 ...] ]\n", - ProgName->c_str()); + Printf("Usage:\n"); + auto Prog = ProgName->c_str(); + Printf("\nTo run fuzzing pass 0 or more directories.\n"); + Printf("%s [-flag1=val1 [-flag2=val2 ...] ] [dir1 [dir2 ...] ]\n", Prog); + + Printf("\nTo run individual tests without fuzzing pass 1 or more files:\n"); + Printf("%s [-flag1=val1 [-flag2=val2 ...] ] file1 [file2 ...]\n", Prog); + Printf("\nFlags: (strictly in form -flag=value)\n"); size_t MaxFlagLen = 0; for (size_t F = 0; F < kNumFlags; F++) @@ -93,14 +106,34 @@ static const char *FlagValue(const char *Param, const char *Name) { return nullptr; } +// Avoid calling stol as it triggers a bug in clang/glibc build. +static long MyStol(const char *Str) { + long Res = 0; + long Sign = 1; + if (*Str == '-') { + Str++; + Sign = -1; + } + for (size_t i = 0; Str[i]; i++) { + char Ch = Str[i]; + if (Ch < '0' || Ch > '9') + return Res; + Res = Res * 10 + (Ch - '0'); + } + return Res * Sign; +} + static bool ParseOneFlag(const char *Param) { if (Param[0] != '-') return false; if (Param[1] == '-') { static bool PrintedWarning = false; if (!PrintedWarning) { PrintedWarning = true; - Printf("WARNING: libFuzzer ignores flags that start with '--'\n"); + Printf("INFO: libFuzzer ignores flags that start with '--'\n"); } + for (size_t F = 0; F < kNumFlags; F++) + if (FlagValue(Param + 1, FlagDescriptions[F].Name)) + Printf("WARNING: did you mean '%s' (single dash)?\n", Param + 1); return true; } for (size_t F = 0; F < kNumFlags; F++) { @@ -108,7 +141,7 @@ static bool ParseOneFlag(const char *Param) { const char *Str = FlagValue(Param, Name); if (Str) { if (FlagDescriptions[F].IntFlag) { - int Val = std::stol(Str); + int Val = MyStol(Str); *FlagDescriptions[F].IntFlag = Val; if (Flags.verbosity >= 2) Printf("Flag: %s %d\n", Name, Val);; @@ -124,11 +157,15 @@ static bool ParseOneFlag(const char *Param) { if (Flags.verbosity >= 2) Printf("Flag: %s %s\n", Name, Str); return true; + } else { // Deprecated flag. + Printf("Flag: %s: deprecated, don't use\n", Name); + return true; } } } - PrintHelp(); - exit(1); + Printf("\n\nWARNING: unrecognized flag '%s'; " + "use -help=1 to list all flags\n\n", Param); + return true; } // We don't use any library to minimize dependencies. @@ -153,7 +190,7 @@ static std::mutex Mu; static void PulseThread() { while (true) { - std::this_thread::sleep_for(std::chrono::seconds(600)); + SleepSeconds(600); std::lock_guard<std::mutex> Lock(Mu); Printf("pulse...\n"); } @@ -168,7 +205,7 @@ static void WorkerThread(const std::string &Cmd, std::atomic<int> *Counter, std::string ToRun = Cmd + " > " + Log + " 2>&1\n"; if (Flags.verbosity) Printf("%s", ToRun.c_str()); - int ExitCode = ExecuteCommand(ToRun.c_str()); + int ExitCode = ExecuteCommand(ToRun); if (ExitCode != 0) *HasErrors = true; std::lock_guard<std::mutex> Lock(Mu); @@ -198,34 +235,44 @@ static int RunInMultipleProcesses(const std::vector<std::string> &Args, return HasErrors ? 1 : 0; } +static void RssThread(Fuzzer *F, size_t RssLimitMb) { + while (true) { + SleepSeconds(1); + size_t Peak = GetPeakRSSMb(); + if (Peak > RssLimitMb) + F->RssLimitCallback(); + } +} + +static void StartRssThread(Fuzzer *F, size_t RssLimitMb) { + if (!RssLimitMb) return; + std::thread T(RssThread, F, RssLimitMb); + T.detach(); +} + int RunOneTest(Fuzzer *F, const char *InputFilePath) { Unit U = FileToVector(InputFilePath); Unit PreciseSizedU(U); assert(PreciseSizedU.size() == PreciseSizedU.capacity()); - F->ExecuteCallback(PreciseSizedU); + F->RunOne(PreciseSizedU.data(), PreciseSizedU.size()); return 0; } -int FuzzerDriver(int argc, char **argv, UserCallback Callback) { - FuzzerRandomLibc Rand(0); - SimpleUserSuppliedFuzzer SUSF(&Rand, Callback); - return FuzzerDriver(argc, argv, SUSF); -} - -int FuzzerDriver(int argc, char **argv, UserSuppliedFuzzer &USF) { - std::vector<std::string> Args(argv, argv + argc); - return FuzzerDriver(Args, USF); +static bool AllInputsAreFiles() { + if (Inputs->empty()) return false; + for (auto &Path : *Inputs) + if (!IsFile(Path)) + return false; + return true; } -int FuzzerDriver(const std::vector<std::string> &Args, UserCallback Callback) { - FuzzerRandomLibc Rand(0); - SimpleUserSuppliedFuzzer SUSF(&Rand, Callback); - return FuzzerDriver(Args, SUSF); -} - -int FuzzerDriver(const std::vector<std::string> &Args, - UserSuppliedFuzzer &USF) { +int FuzzerDriver(int *argc, char ***argv, UserCallback Callback) { using namespace fuzzer; + assert(argc && argv && "Argument pointers cannot be nullptr"); + EF = new ExternalFunctions(); + if (EF->LLVMFuzzerInitialize) + EF->LLVMFuzzerInitialize(argc, argv); + const std::vector<std::string> Args(*argv, *argv + *argc); assert(!Args.empty()); ProgName = new std::string(Args[0]); ParseFlags(Args); @@ -234,6 +281,11 @@ int FuzzerDriver(const std::vector<std::string> &Args, return 0; } + if (Flags.close_fd_mask & 2) + DupAndCloseStderr(); + if (Flags.close_fd_mask & 1) + CloseStdout(); + if (Flags.jobs > 0 && Flags.workers == 0) { Flags.workers = std::min(NumberOfCpuCores() / 2, Flags.jobs); if (Flags.workers > 1) @@ -243,30 +295,32 @@ int FuzzerDriver(const std::vector<std::string> &Args, if (Flags.workers > 0 && Flags.jobs > 0) return RunInMultipleProcesses(Args, Flags.workers, Flags.jobs); - Fuzzer::FuzzingOptions Options; + const size_t kMaxSaneLen = 1 << 20; + const size_t kMinDefaultLen = 64; + FuzzingOptions Options; Options.Verbosity = Flags.verbosity; Options.MaxLen = Flags.max_len; Options.UnitTimeoutSec = Flags.timeout; + Options.TimeoutExitCode = Flags.timeout_exitcode; Options.MaxTotalTimeSec = Flags.max_total_time; Options.DoCrossOver = Flags.cross_over; Options.MutateDepth = Flags.mutate_depth; - Options.ExitOnFirst = Flags.exit_on_first; Options.UseCounters = Flags.use_counters; Options.UseIndirCalls = Flags.use_indir_calls; Options.UseTraces = Flags.use_traces; + Options.UseMemcmp = Flags.use_memcmp; + Options.UseMemmem = Flags.use_memmem; Options.ShuffleAtStartUp = Flags.shuffle; - Options.PreferSmallDuringInitialShuffle = - Flags.prefer_small_during_initial_shuffle; + Options.PreferSmall = Flags.prefer_small; Options.Reload = Flags.reload; Options.OnlyASCII = Flags.only_ascii; Options.OutputCSV = Flags.output_csv; + Options.DetectLeaks = Flags.detect_leaks; + Options.RssLimitMb = Flags.rss_limit_mb; if (Flags.runs >= 0) Options.MaxNumberOfRuns = Flags.runs; if (!Inputs->empty()) Options.OutputCorpus = (*Inputs)[0]; - if (Flags.sync_command) - Options.SyncCommand = Flags.sync_command; - Options.SyncTimeout = Flags.sync_timeout; Options.ReportSlowUnits = Flags.report_slow_units; if (Flags.artifact_prefix) Options.ArtifactPrefix = Flags.artifact_prefix; @@ -278,48 +332,84 @@ int FuzzerDriver(const std::vector<std::string> &Args, return 1; if (Flags.verbosity > 0 && !Dictionary.empty()) Printf("Dictionary: %zd entries\n", Dictionary.size()); - Options.SaveArtifacts = !Flags.test_single_input; + bool DoPlainRun = AllInputsAreFiles(); + Options.SaveArtifacts = !DoPlainRun; Options.PrintNewCovPcs = Flags.print_new_cov_pcs; + Options.PrintFinalStats = Flags.print_final_stats; + Options.TruncateUnits = Flags.truncate_units; + Options.PruneCorpus = Flags.prune_corpus; + + unsigned Seed = Flags.seed; + // Initialize Seed. + if (Seed == 0) + Seed = (std::chrono::system_clock::now().time_since_epoch().count() << 10) + + getpid(); + if (Flags.verbosity) + Printf("INFO: Seed: %u\n", Seed); - Fuzzer F(USF, Options); + Random Rand(Seed); + MutationDispatcher MD(Rand, Options); + Fuzzer F(Callback, MD, Options); for (auto &U: Dictionary) - USF.GetMD().AddWordToManualDictionary(U); + if (U.size() <= Word::GetMaxSize()) + MD.AddWordToManualDictionary(Word(U.data(), U.size())); + + StartRssThread(&F, Flags.rss_limit_mb); // Timer if (Flags.timeout > 0) SetTimer(Flags.timeout / 2 + 1); - - if (Flags.test_single_input) { - RunOneTest(&F, Flags.test_single_input); + if (Flags.handle_segv) SetSigSegvHandler(); + if (Flags.handle_bus) SetSigBusHandler(); + if (Flags.handle_abrt) SetSigAbrtHandler(); + if (Flags.handle_ill) SetSigIllHandler(); + if (Flags.handle_fpe) SetSigFpeHandler(); + if (Flags.handle_int) SetSigIntHandler(); + if (Flags.handle_term) SetSigTermHandler(); + + if (DoPlainRun) { + Options.SaveArtifacts = false; + int Runs = std::max(1, Flags.runs); + Printf("%s: Running %zd inputs %d time(s) each.\n", ProgName->c_str(), + Inputs->size(), Runs); + for (auto &Path : *Inputs) { + auto StartTime = system_clock::now(); + Printf("Running: %s\n", Path.c_str()); + for (int Iter = 0; Iter < Runs; Iter++) + RunOneTest(&F, Path.c_str()); + auto StopTime = system_clock::now(); + auto MS = duration_cast<milliseconds>(StopTime - StartTime).count(); + Printf("Executed %s in %zd ms\n", Path.c_str(), (long)MS); + } + F.PrintFinalStats(); exit(0); } - if (Flags.save_minimized_corpus) { - Printf("The flag -save_minimized_corpus is deprecated; use -merge=1\n"); - exit(1); - } if (Flags.merge) { + if (Options.MaxLen == 0) + F.SetMaxLen(kMaxSaneLen); F.Merge(*Inputs); exit(0); } - unsigned Seed = Flags.seed; - // Initialize Seed. - if (Seed == 0) - Seed = time(0) * 10000 + getpid(); - if (Flags.verbosity) - Printf("Seed: %u\n", Seed); - USF.GetRand().ResetSeed(Seed); + size_t TemporaryMaxLen = Options.MaxLen ? Options.MaxLen : kMaxSaneLen; - F.RereadOutputCorpus(); + F.RereadOutputCorpus(TemporaryMaxLen); for (auto &inp : *Inputs) if (inp != Options.OutputCorpus) - F.ReadDir(inp, nullptr); + F.ReadDir(inp, nullptr, TemporaryMaxLen); + + if (Options.MaxLen == 0) + F.SetMaxLen( + std::min(std::max(kMinDefaultLen, F.MaxUnitSizeInCorpus()), kMaxSaneLen)); - if (F.CorpusSize() == 0) + if (F.CorpusSize() == 0) { F.AddToCorpus(Unit()); // Can't fuzz empty corpus, so add an empty input. + if (Options.Verbosity) + Printf("INFO: A corpus is not provided, starting from an empty corpus\n"); + } F.ShuffleAndMinimize(); if (Flags.drill) F.Drill(); @@ -329,8 +419,12 @@ int FuzzerDriver(const std::vector<std::string> &Args, if (Flags.verbosity) Printf("Done %d runs in %zd second(s)\n", F.getTotalNumberOfRuns(), F.secondsSinceProcessStartUp()); + F.PrintFinalStats(); exit(0); // Don't let F destroy itself. } +// Storage for global ExternalFunctions object. +ExternalFunctions *EF = nullptr; + } // namespace fuzzer diff --git a/gnu/llvm/lib/Fuzzer/FuzzerExtFunctions.def b/gnu/llvm/lib/Fuzzer/FuzzerExtFunctions.def new file mode 100644 index 00000000000..f7dcf9b54fb --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/FuzzerExtFunctions.def @@ -0,0 +1,46 @@ +//===- FuzzerExtFunctions.def - External functions --------------*- C++ -* ===// +// +// The LLVM Compiler Infrastructure +// +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. +// +//===----------------------------------------------------------------------===// +// This defines the external function pointers that +// ``fuzzer::ExternalFunctions`` should contain and try to initialize. The +// EXT_FUNC macro must be defined at the point of inclusion. The signature of +// the macro is: +// +// EXT_FUNC(<name>, <return_type>, <function_signature>, <warn_if_missing>) +//===----------------------------------------------------------------------===// + +// Optional user functions +EXT_FUNC(LLVMFuzzerInitialize, int, (int *argc, char ***argv), false); +EXT_FUNC(LLVMFuzzerCustomMutator, size_t, + (uint8_t * Data, size_t Size, size_t MaxSize, unsigned int Seed), + false); +EXT_FUNC(LLVMFuzzerCustomCrossOver, size_t, + (const uint8_t * Data1, size_t Size1, + const uint8_t * Data2, size_t Size2, + uint8_t * Out, size_t MaxOutSize, unsigned int Seed), + false); + +// Sanitizer functions +EXT_FUNC(__lsan_enable, void, (), false); +EXT_FUNC(__lsan_disable, void, (), false); +EXT_FUNC(__lsan_do_recoverable_leak_check, int, (), false); +EXT_FUNC(__sanitizer_get_coverage_pc_buffer, uintptr_t, (uintptr_t**), true); +EXT_FUNC(__sanitizer_get_number_of_counters, size_t, (), false); +EXT_FUNC(__sanitizer_install_malloc_and_free_hooks, int, + (void (*malloc_hook)(const volatile void *, size_t), + void (*free_hook)(const volatile void *)), + false); +EXT_FUNC(__sanitizer_get_total_unique_caller_callee_pairs, size_t, (), false); +EXT_FUNC(__sanitizer_get_total_unique_coverage, size_t, (), true); +EXT_FUNC(__sanitizer_print_memory_profile, int, (size_t), false); +EXT_FUNC(__sanitizer_print_stack_trace, void, (), true); +EXT_FUNC(__sanitizer_reset_coverage, void, (), true); +EXT_FUNC(__sanitizer_set_death_callback, void, (void (*)(void)), true); +EXT_FUNC(__sanitizer_set_report_fd, void, (void*), false); +EXT_FUNC(__sanitizer_update_counter_bitset_and_clear_counters, uintptr_t, + (uint8_t*), false); diff --git a/gnu/llvm/lib/Fuzzer/FuzzerExtFunctions.h b/gnu/llvm/lib/Fuzzer/FuzzerExtFunctions.h new file mode 100644 index 00000000000..2ec86cb9231 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/FuzzerExtFunctions.h @@ -0,0 +1,33 @@ +//===- FuzzerExtFunctions.h - Interface to external functions ---*- C++ -* ===// +// +// The LLVM Compiler Infrastructure +// +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. +// +//===----------------------------------------------------------------------===// +// Defines an interface to (possibly optional) functions. +//===----------------------------------------------------------------------===// +#ifndef LLVM_FUZZER_EXT_FUNCTIONS_H +#define LLVM_FUZZER_EXT_FUNCTIONS_H + +#include <stddef.h> +#include <stdint.h> + +namespace fuzzer { + +struct ExternalFunctions { + // Initialize function pointers. Functions that are not available will be set + // to nullptr. Do not call this constructor before ``main()`` has been + // entered. + ExternalFunctions(); + +#define EXT_FUNC(NAME, RETURN_TYPE, FUNC_SIG, WARN) \ + RETURN_TYPE(*NAME) FUNC_SIG = nullptr + +#include "FuzzerExtFunctions.def" + +#undef EXT_FUNC +}; +} // namespace fuzzer +#endif diff --git a/gnu/llvm/lib/Fuzzer/FuzzerExtFunctionsDlsym.cpp b/gnu/llvm/lib/Fuzzer/FuzzerExtFunctionsDlsym.cpp new file mode 100644 index 00000000000..7b9681a6193 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/FuzzerExtFunctionsDlsym.cpp @@ -0,0 +1,49 @@ +//===- FuzzerExtFunctionsDlsym.cpp - Interface to external functions ------===// +// +// The LLVM Compiler Infrastructure +// +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. +// +//===----------------------------------------------------------------------===// +// Implementation for operating systems that support dlsym(). We only use it on +// Apple platforms for now. We don't use this approach on Linux because it +// requires that clients of LibFuzzer pass ``--export-dynamic`` to the linker. +// That is a complication we don't wish to expose to clients right now. +//===----------------------------------------------------------------------===// +#include "FuzzerInternal.h" +#if LIBFUZZER_APPLE + +#include "FuzzerExtFunctions.h" +#include <dlfcn.h> + +using namespace fuzzer; + +template <typename T> +static T GetFnPtr(const char *FnName, bool WarnIfMissing) { + dlerror(); // Clear any previous errors. + void *Fn = dlsym(RTLD_DEFAULT, FnName); + if (Fn == nullptr) { + if (WarnIfMissing) { + const char *ErrorMsg = dlerror(); + Printf("WARNING: Failed to find function \"%s\".", FnName); + if (ErrorMsg) + Printf(" Reason %s.", ErrorMsg); + Printf("\n"); + } + } + return reinterpret_cast<T>(Fn); +} + +namespace fuzzer { + +ExternalFunctions::ExternalFunctions() { +#define EXT_FUNC(NAME, RETURN_TYPE, FUNC_SIG, WARN) \ + this->NAME = GetFnPtr<decltype(ExternalFunctions::NAME)>(#NAME, WARN) + +#include "FuzzerExtFunctions.def" + +#undef EXT_FUNC +} +} // namespace fuzzer +#endif // LIBFUZZER_APPLE diff --git a/gnu/llvm/lib/Fuzzer/FuzzerExtFunctionsWeak.cpp b/gnu/llvm/lib/Fuzzer/FuzzerExtFunctionsWeak.cpp new file mode 100644 index 00000000000..75c0ed9f830 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/FuzzerExtFunctionsWeak.cpp @@ -0,0 +1,50 @@ +//===- FuzzerExtFunctionsWeak.cpp - Interface to external functions -------===// +// +// The LLVM Compiler Infrastructure +// +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. +// +//===----------------------------------------------------------------------===// +// Implementation for Linux. This relies on the linker's support for weak +// symbols. We don't use this approach on Apple platforms because it requires +// clients of LibFuzzer to pass ``-U _<symbol_name>`` to the linker to allow +// weak symbols to be undefined. That is a complication we don't want to expose +// to clients right now. +//===----------------------------------------------------------------------===// +#include "FuzzerInternal.h" +#if LIBFUZZER_LINUX + +#include "FuzzerExtFunctions.h" + +extern "C" { +// Declare these symbols as weak to allow them to be optionally defined. +#define EXT_FUNC(NAME, RETURN_TYPE, FUNC_SIG, WARN) \ + __attribute__((weak)) RETURN_TYPE NAME FUNC_SIG + +#include "FuzzerExtFunctions.def" + +#undef EXT_FUNC +} + +using namespace fuzzer; + +static void CheckFnPtr(void *FnPtr, const char *FnName, bool WarnIfMissing) { + if (FnPtr == nullptr && WarnIfMissing) { + Printf("WARNING: Failed to find function \"%s\".\n", FnName); + } +} + +namespace fuzzer { + +ExternalFunctions::ExternalFunctions() { +#define EXT_FUNC(NAME, RETURN_TYPE, FUNC_SIG, WARN) \ + this->NAME = ::NAME; \ + CheckFnPtr((void *)::NAME, #NAME, WARN); + +#include "FuzzerExtFunctions.def" + +#undef EXT_FUNC +} +} // namespace fuzzer +#endif // LIBFUZZER_LINUX diff --git a/gnu/llvm/lib/Fuzzer/FuzzerFlags.def b/gnu/llvm/lib/Fuzzer/FuzzerFlags.def index 977efb76922..599ac368634 100644 --- a/gnu/llvm/lib/Fuzzer/FuzzerFlags.def +++ b/gnu/llvm/lib/Fuzzer/FuzzerFlags.def @@ -14,30 +14,36 @@ FUZZER_FLAG_INT(verbosity, 1, "Verbosity level.") FUZZER_FLAG_UNSIGNED(seed, 0, "Random seed. If 0, seed is generated.") FUZZER_FLAG_INT(runs, -1, "Number of individual test runs (-1 for infinite runs).") -FUZZER_FLAG_INT(max_len, 64, "Maximum length of the test input.") +FUZZER_FLAG_INT(max_len, 0, "Maximum length of the test input. " + "If 0, libFuzzer tries to guess a good value based on the corpus " + "and reports it. ") FUZZER_FLAG_INT(cross_over, 1, "If 1, cross over inputs.") FUZZER_FLAG_INT(mutate_depth, 5, "Apply this number of consecutive mutations to each input.") FUZZER_FLAG_INT(shuffle, 1, "Shuffle inputs at startup") -FUZZER_FLAG_INT( - prefer_small_during_initial_shuffle, -1, - "If 1, always prefer smaller inputs during the initial corpus shuffle." - " If 0, never do that. If -1, do it sometimes.") -FUZZER_FLAG_INT(exit_on_first, 0, - "If 1, exit after the first new interesting input is found.") +FUZZER_FLAG_INT(prefer_small, 1, + "If 1, always prefer smaller inputs during the corpus shuffle.") FUZZER_FLAG_INT( timeout, 1200, "Timeout in seconds (if positive). " "If one unit runs more than this number of seconds the process will abort.") +FUZZER_FLAG_INT(timeout_exitcode, 77, + "Unless abort_on_timeout is set, use this exitcode on timeout.") +FUZZER_FLAG_INT(error_exit_code, 77, "When libFuzzer's signal handlers are in " + "use exit with this exitcode after catching a deadly signal.") FUZZER_FLAG_INT(max_total_time, 0, "If positive, indicates the maximal total " "time in seconds to run the fuzzer.") FUZZER_FLAG_INT(help, 0, "Print help.") -FUZZER_FLAG_INT(save_minimized_corpus, 0, "Deprecated. Use -merge=1") FUZZER_FLAG_INT(merge, 0, "If 1, the 2-nd, 3-rd, etc corpora will be " - "merged into the 1-st corpus. Only interesting units will be taken.") + "merged into the 1-st corpus. Only interesting units will be taken. " + "This flag can be used to minimize a corpus.") FUZZER_FLAG_INT(use_counters, 1, "Use coverage counters") FUZZER_FLAG_INT(use_indir_calls, 1, "Use indirect caller-callee counters") FUZZER_FLAG_INT(use_traces, 0, "Experimental: use instruction traces") +FUZZER_FLAG_INT(use_memcmp, 1, + "Use hints from intercepting memcmp, strcmp, etc") +FUZZER_FLAG_INT(use_memmem, 1, + "Use hints from intercepting memmem, strstr, etc") FUZZER_FLAG_INT(jobs, 0, "Number of jobs to run. If jobs >= 1 we spawn" " this number of jobs in separate worker processes" " with stdout/stderr redirected to fuzz-JOB.log.") @@ -47,16 +53,11 @@ FUZZER_FLAG_INT(workers, 0, FUZZER_FLAG_INT(reload, 1, "Reload the main corpus periodically to get new units" " discovered by other processes.") -FUZZER_FLAG_STRING(sync_command, "Execute an external command " - "\"<sync_command> <test_corpus>\" " - "to synchronize the test corpus.") -FUZZER_FLAG_INT(sync_timeout, 600, "Minimum timeout between syncs.") FUZZER_FLAG_INT(report_slow_units, 10, "Report slowest units if they run for more than this number of seconds.") FUZZER_FLAG_INT(only_ascii, 0, "If 1, generate only ASCII (isprint+isspace) inputs.") FUZZER_FLAG_STRING(dict, "Experimental. Use the dictionary file.") -FUZZER_FLAG_STRING(test_single_input, "Use specified file as test input.") FUZZER_FLAG_STRING(artifact_prefix, "Write fuzzing artifacts (crash, " "timeout, or slow inputs) as " "$(artifact_prefix)file") @@ -69,4 +70,28 @@ FUZZER_FLAG_INT(drill, 0, "Experimental: fuzz using a single unit as the seed " "corpus, then merge with the initial corpus") FUZZER_FLAG_INT(output_csv, 0, "Enable pulse output in CSV format.") FUZZER_FLAG_INT(print_new_cov_pcs, 0, "If 1, print out new covered pcs.") +FUZZER_FLAG_INT(print_final_stats, 0, "If 1, print statistics at exit.") + +FUZZER_FLAG_INT(handle_segv, 1, "If 1, try to intercept SIGSEGV.") +FUZZER_FLAG_INT(handle_bus, 1, "If 1, try to intercept SIGSEGV.") +FUZZER_FLAG_INT(handle_abrt, 1, "If 1, try to intercept SIGABRT.") +FUZZER_FLAG_INT(handle_ill, 1, "If 1, try to intercept SIGILL.") +FUZZER_FLAG_INT(handle_fpe, 1, "If 1, try to intercept SIGFPE.") +FUZZER_FLAG_INT(handle_int, 1, "If 1, try to intercept SIGINT.") +FUZZER_FLAG_INT(handle_term, 1, "If 1, try to intercept SIGTERM.") +FUZZER_FLAG_INT(close_fd_mask, 0, "If 1, close stdout at startup; " + "if 2, close stderr; if 3, close both. " + "Be careful, this will also close e.g. asan's stderr/stdout.") +FUZZER_FLAG_INT(detect_leaks, 1, "If 1, and if LeakSanitizer is enabled " + "try to detect memory leaks during fuzzing (i.e. not only at shut down).") +FUZZER_FLAG_INT(rss_limit_mb, 2048, "If non-zero, the fuzzer will exit upon" + "reaching this limit of RSS memory usage.") +FUZZER_FLAG_INT(truncate_units, 0, "Try truncated units when loading corpus.") +FUZZER_FLAG_INT(prune_corpus, 1, "Prune corpus items without new coverage when " + "loading corpus.") +FUZZER_DEPRECATED_FLAG(exit_on_first) +FUZZER_DEPRECATED_FLAG(save_minimized_corpus) +FUZZER_DEPRECATED_FLAG(sync_command) +FUZZER_DEPRECATED_FLAG(sync_timeout) +FUZZER_DEPRECATED_FLAG(test_single_input) diff --git a/gnu/llvm/lib/Fuzzer/FuzzerFnAdapter.h b/gnu/llvm/lib/Fuzzer/FuzzerFnAdapter.h new file mode 100644 index 00000000000..eb2c219b870 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/FuzzerFnAdapter.h @@ -0,0 +1,187 @@ +//===- FuzzerAdapter.h - Arbitrary function Fuzzer adapter -------*- C++ -*===// +// +// The LLVM Compiler Infrastructure +// +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. +// +//===----------------------------------------------------------------------===// +// +// W A R N I N G : E X P E R I M E N T A L. +// +// Defines an adapter to fuzz functions with (almost) arbitrary signatures. +//===----------------------------------------------------------------------===// + +#ifndef LLVM_FUZZER_ADAPTER_H +#define LLVM_FUZZER_ADAPTER_H + +#include <stddef.h> +#include <stdint.h> + +#include <algorithm> +#include <string> +#include <tuple> +#include <vector> + +namespace fuzzer { + +/// Unpacks bytes from \p Data according to \p F argument types +/// and calls the function. +/// Use to automatically adapt LLVMFuzzerTestOneInput interface to +/// a specific function. +/// Supported argument types: primitive types, std::vector<uint8_t>. +template <typename Fn> bool Adapt(Fn F, const uint8_t *Data, size_t Size); + +// The implementation performs several steps: +// - function argument types are obtained (Args...) +// - data is unpacked into std::tuple<Args...> one by one +// - function is called with std::tuple<Args...> containing arguments. +namespace impl { + +// Single argument unpacking. + +template <typename T> +size_t UnpackPrimitive(const uint8_t *Data, size_t Size, T *Value) { + if (Size < sizeof(T)) + return Size; + *Value = *reinterpret_cast<const T *>(Data); + return Size - sizeof(T); +} + +/// Unpacks into a given Value and returns the Size - num_consumed_bytes. +/// Return value equal to Size signals inability to unpack the data (typically +/// because there are not enough bytes). +template <typename T> +size_t UnpackSingle(const uint8_t *Data, size_t Size, T *Value); + +#define UNPACK_SINGLE_PRIMITIVE(Type) \ + template <> \ + size_t UnpackSingle<Type>(const uint8_t *Data, size_t Size, Type *Value) { \ + return UnpackPrimitive(Data, Size, Value); \ + } + +UNPACK_SINGLE_PRIMITIVE(char) +UNPACK_SINGLE_PRIMITIVE(signed char) +UNPACK_SINGLE_PRIMITIVE(unsigned char) + +UNPACK_SINGLE_PRIMITIVE(short int) +UNPACK_SINGLE_PRIMITIVE(unsigned short int) + +UNPACK_SINGLE_PRIMITIVE(int) +UNPACK_SINGLE_PRIMITIVE(unsigned int) + +UNPACK_SINGLE_PRIMITIVE(long int) +UNPACK_SINGLE_PRIMITIVE(unsigned long int) + +UNPACK_SINGLE_PRIMITIVE(bool) +UNPACK_SINGLE_PRIMITIVE(wchar_t) + +UNPACK_SINGLE_PRIMITIVE(float) +UNPACK_SINGLE_PRIMITIVE(double) +UNPACK_SINGLE_PRIMITIVE(long double) + +#undef UNPACK_SINGLE_PRIMITIVE + +template <> +size_t UnpackSingle<std::vector<uint8_t>>(const uint8_t *Data, size_t Size, + std::vector<uint8_t> *Value) { + if (Size < 1) + return Size; + size_t Len = std::min(static_cast<size_t>(*Data), Size - 1); + std::vector<uint8_t> V(Data + 1, Data + 1 + Len); + Value->swap(V); + return Size - Len - 1; +} + +template <> +size_t UnpackSingle<std::string>(const uint8_t *Data, size_t Size, + std::string *Value) { + if (Size < 1) + return Size; + size_t Len = std::min(static_cast<size_t>(*Data), Size - 1); + std::string S(Data + 1, Data + 1 + Len); + Value->swap(S); + return Size - Len - 1; +} + +// Unpacking into arbitrary tuple. + +// Recursion guard. +template <int N, typename TupleT> +typename std::enable_if<N == std::tuple_size<TupleT>::value, bool>::type +UnpackImpl(const uint8_t *Data, size_t Size, TupleT *Tuple) { + return true; +} + +// Unpack tuple elements starting from Nth. +template <int N, typename TupleT> +typename std::enable_if<N < std::tuple_size<TupleT>::value, bool>::type +UnpackImpl(const uint8_t *Data, size_t Size, TupleT *Tuple) { + size_t NewSize = UnpackSingle(Data, Size, &std::get<N>(*Tuple)); + if (NewSize == Size) { + return false; + } + + return UnpackImpl<N + 1, TupleT>(Data + (Size - NewSize), NewSize, Tuple); +} + +// Unpacks into arbitrary tuple and returns true if successful. +template <typename... Args> +bool Unpack(const uint8_t *Data, size_t Size, std::tuple<Args...> *Tuple) { + return UnpackImpl<0, std::tuple<Args...>>(Data, Size, Tuple); +} + +// Helper integer sequence templates. + +template <int...> struct Seq {}; + +template <int N, int... S> struct GenSeq : GenSeq<N - 1, N - 1, S...> {}; + +// GenSeq<N>::type is Seq<0, 1, ..., N-1> +template <int... S> struct GenSeq<0, S...> { typedef Seq<S...> type; }; + +// Function signature introspection. + +template <typename T> struct FnTraits {}; + +template <typename ReturnType, typename... Args> +struct FnTraits<ReturnType (*)(Args...)> { + enum { Arity = sizeof...(Args) }; + typedef std::tuple<Args...> ArgsTupleT; +}; + +// Calling a function with arguments in a tuple. + +template <typename Fn, int... S> +void ApplyImpl(Fn F, const typename FnTraits<Fn>::ArgsTupleT &Params, + Seq<S...>) { + F(std::get<S>(Params)...); +} + +template <typename Fn> +void Apply(Fn F, const typename FnTraits<Fn>::ArgsTupleT &Params) { + // S is Seq<0, ..., Arity-1> + auto S = typename GenSeq<FnTraits<Fn>::Arity>::type(); + ApplyImpl(F, Params, S); +} + +// Unpacking data into arguments tuple of correct type and calling the function. +template <typename Fn> +bool UnpackAndApply(Fn F, const uint8_t *Data, size_t Size) { + typename FnTraits<Fn>::ArgsTupleT Tuple; + if (!Unpack(Data, Size, &Tuple)) + return false; + + Apply(F, Tuple); + return true; +} + +} // namespace impl + +template <typename Fn> bool Adapt(Fn F, const uint8_t *Data, size_t Size) { + return impl::UnpackAndApply(F, Data, Size); +} + +} // namespace fuzzer + +#endif diff --git a/gnu/llvm/lib/Fuzzer/FuzzerIO.cpp b/gnu/llvm/lib/Fuzzer/FuzzerIO.cpp index 043fad396d5..0e0c4e989cc 100644 --- a/gnu/llvm/lib/Fuzzer/FuzzerIO.cpp +++ b/gnu/llvm/lib/Fuzzer/FuzzerIO.cpp @@ -8,6 +8,7 @@ //===----------------------------------------------------------------------===// // IO functions. //===----------------------------------------------------------------------===// +#include "FuzzerExtFunctions.h" #include "FuzzerInternal.h" #include <iterator> #include <fstream> @@ -20,6 +21,15 @@ namespace fuzzer { +static FILE *OutputFile = stderr; + +bool IsFile(const std::string &Path) { + struct stat St; + if (stat(Path.c_str(), &St)) + return false; + return S_ISREG(St.st_mode); +} + static long GetEpoch(const std::string &Path) { struct stat St; if (stat(Path.c_str(), &St)) @@ -27,35 +37,45 @@ static long GetEpoch(const std::string &Path) { return St.st_mtime; } -static std::vector<std::string> ListFilesInDir(const std::string &Dir, - long *Epoch) { - std::vector<std::string> V; - if (Epoch) { - auto E = GetEpoch(Dir); - if (*Epoch >= E) return V; - *Epoch = E; - } +static void ListFilesInDirRecursive(const std::string &Dir, long *Epoch, + std::vector<std::string> *V, bool TopDir) { + auto E = GetEpoch(Dir); + if (Epoch) + if (E && *Epoch >= E) return; + DIR *D = opendir(Dir.c_str()); if (!D) { Printf("No such directory: %s; exiting\n", Dir.c_str()); exit(1); } while (auto E = readdir(D)) { + std::string Path = DirPlusFile(Dir, E->d_name); if (E->d_type == DT_REG || E->d_type == DT_LNK) - V.push_back(E->d_name); + V->push_back(Path); + else if (E->d_type == DT_DIR && *E->d_name != '.') + ListFilesInDirRecursive(Path, Epoch, V, false); } closedir(D); - return V; + if (Epoch && TopDir) + *Epoch = E; } -Unit FileToVector(const std::string &Path) { +Unit FileToVector(const std::string &Path, size_t MaxSize) { std::ifstream T(Path); if (!T) { Printf("No such directory: %s; exiting\n", Path.c_str()); exit(1); } - return Unit((std::istreambuf_iterator<char>(T)), - std::istreambuf_iterator<char>()); + + T.seekg(0, T.end); + size_t FileLen = T.tellg(); + if (MaxSize) + FileLen = std::min(FileLen, MaxSize); + + T.seekg(0, T.beg); + Unit Res(FileLen); + T.read(reinterpret_cast<char *>(Res.data()), FileLen); + return Res; } std::string FileToString(const std::string &Path) { @@ -77,12 +97,18 @@ void WriteToFile(const Unit &U, const std::string &Path) { } void ReadDirToVectorOfUnits(const char *Path, std::vector<Unit> *V, - long *Epoch) { + long *Epoch, size_t MaxSize) { long E = Epoch ? *Epoch : 0; - for (auto &X : ListFilesInDir(Path, Epoch)) { - auto FilePath = DirPlusFile(Path, X); - if (Epoch && GetEpoch(FilePath) < E) continue; - V->push_back(FileToVector(FilePath)); + std::vector<std::string> Files; + ListFilesInDirRecursive(Path, Epoch, &Files, /*TopDir*/true); + size_t NumLoaded = 0; + for (size_t i = 0; i < Files.size(); i++) { + auto &X = Files[i]; + if (Epoch && GetEpoch(X) < E) continue; + NumLoaded++; + if ((NumLoaded & (NumLoaded - 1)) == 0 && NumLoaded >= 1024) + Printf("Loaded %zd/%zd files from %s\n", NumLoaded, Files.size(), Path); + V->push_back(FileToVector(X, MaxSize)); } } @@ -91,11 +117,27 @@ std::string DirPlusFile(const std::string &DirPath, return DirPath + "/" + FileName; } +void DupAndCloseStderr() { + int OutputFd = dup(2); + if (OutputFd > 0) { + FILE *NewOutputFile = fdopen(OutputFd, "w"); + if (NewOutputFile) { + OutputFile = NewOutputFile; + if (EF->__sanitizer_set_report_fd) + EF->__sanitizer_set_report_fd(reinterpret_cast<void *>(OutputFd)); + close(2); + } + } +} + +void CloseStdout() { close(1); } + void Printf(const char *Fmt, ...) { va_list ap; va_start(ap, Fmt); - vfprintf(stderr, Fmt, ap); + vfprintf(OutputFile, Fmt, ap); va_end(ap); + fflush(OutputFile); } } // namespace fuzzer diff --git a/gnu/llvm/lib/Fuzzer/FuzzerInterface.h b/gnu/llvm/lib/Fuzzer/FuzzerInterface.h index e22b27a3dd2..d47e20e3a2b 100644 --- a/gnu/llvm/lib/Fuzzer/FuzzerInterface.h +++ b/gnu/llvm/lib/Fuzzer/FuzzerInterface.h @@ -6,193 +6,62 @@ // License. See LICENSE.TXT for details. // //===----------------------------------------------------------------------===// -// Define the interface between the Fuzzer and the library being tested. +// Define the interface between libFuzzer and the library being tested. //===----------------------------------------------------------------------===// -// WARNING: keep the interface free of STL or any other header-based C++ lib, -// to avoid bad interactions between the code used in the fuzzer and -// the code used in the target function. +// NOTE: the libFuzzer interface is thin and in the majority of cases +// you should not include this file into your target. In 95% of cases +// all you need is to define the following function in your file: +// extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size); + +// WARNING: keep the interface in C. #ifndef LLVM_FUZZER_INTERFACE_H #define LLVM_FUZZER_INTERFACE_H -#include <limits> -#include <cstddef> -#include <cstdint> -#include <vector> -#include <string> - -namespace fuzzer { -typedef std::vector<uint8_t> Unit; - -/// Returns an int 0. Values other than zero are reserved for future. -typedef int (*UserCallback)(const uint8_t *Data, size_t Size); -/** Simple C-like interface with a single user-supplied callback. - -Usage: - -#\code -#include "FuzzerInterface.h" - -int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { - DoStuffWithData(Data, Size); - return 0; -} - -// Implement your own main() or use the one from FuzzerMain.cpp. -int main(int argc, char **argv) { - InitializeMeIfNeeded(); - return fuzzer::FuzzerDriver(argc, argv, LLVMFuzzerTestOneInput); -} -#\endcode -*/ -int FuzzerDriver(int argc, char **argv, UserCallback Callback); - -class FuzzerRandomBase { - public: - FuzzerRandomBase(){} - virtual ~FuzzerRandomBase(){}; - virtual void ResetSeed(unsigned int seed) = 0; - // Return a random number. - virtual size_t Rand() = 0; - // Return a random number in range [0,n). - size_t operator()(size_t n) { return n ? Rand() % n : 0; } - bool RandBool() { return Rand() % 2; } -}; - -class FuzzerRandomLibc : public FuzzerRandomBase { - public: - FuzzerRandomLibc(unsigned int seed) { ResetSeed(seed); } - void ResetSeed(unsigned int seed) override; - ~FuzzerRandomLibc() override {} - size_t Rand() override; -}; - -class MutationDispatcher { - public: - MutationDispatcher(FuzzerRandomBase &Rand); - ~MutationDispatcher(); - /// Indicate that we are about to start a new sequence of mutations. - void StartMutationSequence(); - /// Print the current sequence of mutations. - void PrintMutationSequence(); - /// Mutates data by shuffling bytes. - size_t Mutate_ShuffleBytes(uint8_t *Data, size_t Size, size_t MaxSize); - /// Mutates data by erasing a byte. - size_t Mutate_EraseByte(uint8_t *Data, size_t Size, size_t MaxSize); - /// Mutates data by inserting a byte. - size_t Mutate_InsertByte(uint8_t *Data, size_t Size, size_t MaxSize); - /// Mutates data by chanding one byte. - size_t Mutate_ChangeByte(uint8_t *Data, size_t Size, size_t MaxSize); - /// Mutates data by chanding one bit. - size_t Mutate_ChangeBit(uint8_t *Data, size_t Size, size_t MaxSize); - - /// Mutates data by adding a word from the manual dictionary. - size_t Mutate_AddWordFromManualDictionary(uint8_t *Data, size_t Size, - size_t MaxSize); - - /// Mutates data by adding a word from the automatic dictionary. - size_t Mutate_AddWordFromAutoDictionary(uint8_t *Data, size_t Size, - size_t MaxSize); - - /// Tries to find an ASCII integer in Data, changes it to another ASCII int. - size_t Mutate_ChangeASCIIInteger(uint8_t *Data, size_t Size, size_t MaxSize); - - /// CrossOver Data with some other element of the corpus. - size_t Mutate_CrossOver(uint8_t *Data, size_t Size, size_t MaxSize); - - /// Applies one of the above mutations. - /// Returns the new size of data which could be up to MaxSize. - size_t Mutate(uint8_t *Data, size_t Size, size_t MaxSize); - - /// Creates a cross-over of two pieces of Data, returns its size. - size_t CrossOver(const uint8_t *Data1, size_t Size1, const uint8_t *Data2, - size_t Size2, uint8_t *Out, size_t MaxOutSize); - - void AddWordToManualDictionary(const Unit &Word); - - void AddWordToAutoDictionary(const Unit &Word, size_t PositionHint); - void ClearAutoDictionary(); - - void SetCorpus(const std::vector<Unit> *Corpus); - - private: - FuzzerRandomBase &Rand; - struct Impl; - Impl *MDImpl; -}; - -// For backward compatibility only, deprecated. -static inline size_t Mutate(uint8_t *Data, size_t Size, size_t MaxSize, - FuzzerRandomBase &Rand) { - MutationDispatcher MD(Rand); - return MD.Mutate(Data, Size, MaxSize); -} - -/** An abstract class that allows to use user-supplied mutators with libFuzzer. - -Usage: - -#\code -#include "FuzzerInterface.h" -class MyFuzzer : public fuzzer::UserSuppliedFuzzer { - public: - MyFuzzer(fuzzer::FuzzerRandomBase *Rand); - // Must define the target function. - int TargetFunction(...) { ...; return 0; } - // Optionally define the mutator. - size_t Mutate(...) { ... } - // Optionally define the CrossOver method. - size_t CrossOver(...) { ... } -}; - -int main(int argc, char **argv) { - MyFuzzer F; - fuzzer::FuzzerDriver(argc, argv, F); -} -#\endcode -*/ -class UserSuppliedFuzzer { - public: - UserSuppliedFuzzer(FuzzerRandomBase *Rand); - /// Executes the target function on 'Size' bytes of 'Data'. - virtual int TargetFunction(const uint8_t *Data, size_t Size) = 0; - virtual void StartMutationSequence() { MD.StartMutationSequence(); } - virtual void PrintMutationSequence() { MD.PrintMutationSequence(); } - virtual void SetCorpus(const std::vector<Unit> *Corpus) { - MD.SetCorpus(Corpus); - } - /// Mutates 'Size' bytes of data in 'Data' inplace into up to 'MaxSize' bytes, - /// returns the new size of the data, which should be positive. - virtual size_t Mutate(uint8_t *Data, size_t Size, size_t MaxSize) { - return MD.Mutate(Data, Size, MaxSize); - } - /// Crosses 'Data1' and 'Data2', writes up to 'MaxOutSize' bytes into Out, - /// returns the number of bytes written, which should be positive. - virtual size_t CrossOver(const uint8_t *Data1, size_t Size1, - const uint8_t *Data2, size_t Size2, - uint8_t *Out, size_t MaxOutSize) { - return MD.CrossOver(Data1, Size1, Data2, Size2, Out, MaxOutSize); - } - virtual ~UserSuppliedFuzzer(); - - FuzzerRandomBase &GetRand() { return *Rand; } - - MutationDispatcher &GetMD() { return MD; } - - private: - bool OwnRand = false; - FuzzerRandomBase *Rand; - MutationDispatcher MD; -}; - -/// Runs the fuzzing with the UserSuppliedFuzzer. -int FuzzerDriver(int argc, char **argv, UserSuppliedFuzzer &USF); - -/// More C++-ish interface. -int FuzzerDriver(const std::vector<std::string> &Args, UserSuppliedFuzzer &USF); -int FuzzerDriver(const std::vector<std::string> &Args, UserCallback Callback); - -} // namespace fuzzer +#include <stddef.h> +#include <stdint.h> + +#ifdef __cplusplus +extern "C" { +#endif // __cplusplus + +// Mandatory user-provided target function. +// Executes the code under test with [Data, Data+Size) as the input. +// libFuzzer will invoke this function *many* times with different inputs. +// Must return 0. +int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size); + +// Optional user-provided initialization function. +// If provided, this function will be called by libFuzzer once at startup. +// It may read and modify argc/argv. +// Must return 0. +int LLVMFuzzerInitialize(int *argc, char ***argv); + +// Optional user-provided custom mutator. +// Mutates raw data in [Data, Data+Size) inplace. +// Returns the new size, which is not greater than MaxSize. +// Given the same Seed produces the same mutation. +size_t LLVMFuzzerCustomMutator(uint8_t *Data, size_t Size, size_t MaxSize, + unsigned int Seed); + +// Optional user-provided custom cross-over function. +// Combines pieces of Data1 & Data2 together into Out. +// Returns the new size, which is not greater than MaxOutSize. +// Should produce the same mutation given the same Seed. +size_t LLVMFuzzerCustomCrossOver(const uint8_t *Data1, size_t Size1, + const uint8_t *Data2, size_t Size2, + uint8_t *Out, size_t MaxOutSize, + unsigned int Seed); + +// Experimental, may go away in future. +// libFuzzer-provided function to be used inside LLVMFuzzerTestOneInput. +// Mutates raw data in [Data, Data+Size) inplace. +// Returns the new size, which is not greater than MaxSize. +size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize); + +#ifdef __cplusplus +} // extern "C" +#endif // __cplusplus #endif // LLVM_FUZZER_INTERFACE_H diff --git a/gnu/llvm/lib/Fuzzer/FuzzerInternal.h b/gnu/llvm/lib/Fuzzer/FuzzerInternal.h index c1e9daac980..08f8801ac5f 100644 --- a/gnu/llvm/lib/Fuzzer/FuzzerInternal.h +++ b/gnu/llvm/lib/Fuzzer/FuzzerInternal.h @@ -12,38 +12,108 @@ #ifndef LLVM_FUZZER_INTERNAL_H #define LLVM_FUZZER_INTERNAL_H +#include <algorithm> +#include <atomic> #include <cassert> -#include <climits> #include <chrono> +#include <climits> #include <cstddef> #include <cstdlib> +#include <random> +#include <string.h> #include <string> -#include <vector> #include <unordered_set> +#include <vector> +#include "FuzzerExtFunctions.h" #include "FuzzerInterface.h" +#include "FuzzerTracePC.h" + +// Platform detection. +#ifdef __linux__ +#define LIBFUZZER_LINUX 1 +#define LIBFUZZER_APPLE 0 +#elif __APPLE__ +#define LIBFUZZER_LINUX 0 +#define LIBFUZZER_APPLE 1 +#else +#error "Support for your platform has not been implemented" +#endif namespace fuzzer { + +typedef int (*UserCallback)(const uint8_t *Data, size_t Size); +int FuzzerDriver(int *argc, char ***argv, UserCallback Callback); + using namespace std::chrono; +typedef std::vector<uint8_t> Unit; +typedef std::vector<Unit> UnitVector; + +// A simple POD sized array of bytes. +template <size_t kMaxSize> class FixedWord { +public: + FixedWord() {} + FixedWord(const uint8_t *B, uint8_t S) { Set(B, S); } + + void Set(const uint8_t *B, uint8_t S) { + assert(S <= kMaxSize); + memcpy(Data, B, S); + Size = S; + } + + bool operator==(const FixedWord<kMaxSize> &w) const { + return Size == w.Size && 0 == memcmp(Data, w.Data, Size); + } + + bool operator<(const FixedWord<kMaxSize> &w) const { + if (Size != w.Size) + return Size < w.Size; + return memcmp(Data, w.Data, Size) < 0; + } + + static size_t GetMaxSize() { return kMaxSize; } + const uint8_t *data() const { return Data; } + uint8_t size() const { return Size; } + +private: + uint8_t Size = 0; + uint8_t Data[kMaxSize]; +}; +typedef FixedWord<27> Word; // 28 bytes. + +bool IsFile(const std::string &Path); std::string FileToString(const std::string &Path); -Unit FileToVector(const std::string &Path); +Unit FileToVector(const std::string &Path, size_t MaxSize = 0); void ReadDirToVectorOfUnits(const char *Path, std::vector<Unit> *V, - long *Epoch); + long *Epoch, size_t MaxSize); void WriteToFile(const Unit &U, const std::string &Path); void CopyFileToErr(const std::string &Path); // Returns "Dir/FileName" or equivalent for the current OS. std::string DirPlusFile(const std::string &DirPath, const std::string &FileName); +void DupAndCloseStderr(); +void CloseStdout(); void Printf(const char *Fmt, ...); -void Print(const Unit &U, const char *PrintAfter = ""); +void PrintHexArray(const Unit &U, const char *PrintAfter = ""); +void PrintHexArray(const uint8_t *Data, size_t Size, + const char *PrintAfter = ""); void PrintASCII(const uint8_t *Data, size_t Size, const char *PrintAfter = ""); void PrintASCII(const Unit &U, const char *PrintAfter = ""); +void PrintASCII(const Word &W, const char *PrintAfter = ""); std::string Hash(const Unit &U); void SetTimer(int Seconds); +void SetSigSegvHandler(); +void SetSigBusHandler(); +void SetSigAbrtHandler(); +void SetSigIllHandler(); +void SetSigFpeHandler(); +void SetSigIntHandler(); +void SetSigTermHandler(); std::string Base64(const Unit &U); int ExecuteCommand(const std::string &Command); +size_t GetPeakRSSMb(); // Private copy of SHA1 implementation. static const int kSHA1NumBytes = 20; @@ -52,11 +122,24 @@ void ComputeSHA1(const uint8_t *Data, size_t Len, uint8_t *Out); // Changes U to contain only ASCII (isprint+isspace) characters. // Returns true iff U has been changed. -bool ToASCII(Unit &U); +bool ToASCII(uint8_t *Data, size_t Size); bool IsASCII(const Unit &U); +bool IsASCII(const uint8_t *Data, size_t Size); int NumberOfCpuCores(); int GetPid(); +void SleepSeconds(int Seconds); + +class Random { + public: + Random(unsigned int seed) : R(seed) {} + size_t Rand() { return R(); } + size_t RandBool() { return Rand() % 2; } + size_t operator()(size_t n) { return n ? Rand() % n : 0; } + std::mt19937 &Get_mt19937() { return R; } + private: + std::mt19937 R; +}; // Dictionary. @@ -68,50 +151,240 @@ bool ParseOneDictionaryEntry(const std::string &Str, Unit *U); // were parsed succesfully. bool ParseDictionaryFile(const std::string &Text, std::vector<Unit> *Units); -class Fuzzer { +class DictionaryEntry { + public: + DictionaryEntry() {} + DictionaryEntry(Word W) : W(W) {} + DictionaryEntry(Word W, size_t PositionHint) : W(W), PositionHint(PositionHint) {} + const Word &GetW() const { return W; } + + bool HasPositionHint() const { return PositionHint != std::numeric_limits<size_t>::max(); } + size_t GetPositionHint() const { + assert(HasPositionHint()); + return PositionHint; + } + void IncUseCount() { UseCount++; } + void IncSuccessCount() { SuccessCount++; } + size_t GetUseCount() const { return UseCount; } + size_t GetSuccessCount() const {return SuccessCount; } + +private: + Word W; + size_t PositionHint = std::numeric_limits<size_t>::max(); + size_t UseCount = 0; + size_t SuccessCount = 0; +}; + +class Dictionary { public: - struct FuzzingOptions { - int Verbosity = 1; - int MaxLen = 0; - int UnitTimeoutSec = 300; - int MaxTotalTimeSec = 0; - bool DoCrossOver = true; - int MutateDepth = 5; - bool ExitOnFirst = false; - bool UseCounters = false; - bool UseIndirCalls = true; - bool UseTraces = false; - bool UseFullCoverageSet = false; - bool Reload = true; - bool ShuffleAtStartUp = true; - int PreferSmallDuringInitialShuffle = -1; - size_t MaxNumberOfRuns = ULONG_MAX; - int SyncTimeout = 600; - int ReportSlowUnits = 10; - bool OnlyASCII = false; - std::string OutputCorpus; - std::string SyncCommand; - std::string ArtifactPrefix = "./"; - std::string ExactArtifactPath; - bool SaveArtifacts = true; - bool PrintNEW = true; // Print a status line when new units are found; - bool OutputCSV = false; - bool PrintNewCovPcs = false; + static const size_t kMaxDictSize = 1 << 14; + + bool ContainsWord(const Word &W) const { + return std::any_of(begin(), end(), [&](const DictionaryEntry &DE) { + return DE.GetW() == W; + }); + } + const DictionaryEntry *begin() const { return &DE[0]; } + const DictionaryEntry *end() const { return begin() + Size; } + DictionaryEntry & operator[] (size_t Idx) { + assert(Idx < Size); + return DE[Idx]; + } + void push_back(DictionaryEntry DE) { + if (Size < kMaxDictSize) + this->DE[Size++] = DE; + } + void clear() { Size = 0; } + bool empty() const { return Size == 0; } + size_t size() const { return Size; } + +private: + DictionaryEntry DE[kMaxDictSize]; + size_t Size = 0; +}; + +struct FuzzingOptions { + int Verbosity = 1; + size_t MaxLen = 0; + int UnitTimeoutSec = 300; + int TimeoutExitCode = 77; + int ErrorExitCode = 77; + int MaxTotalTimeSec = 0; + int RssLimitMb = 0; + bool DoCrossOver = true; + int MutateDepth = 5; + bool UseCounters = false; + bool UseIndirCalls = true; + bool UseTraces = false; + bool UseMemcmp = true; + bool UseMemmem = true; + bool UseFullCoverageSet = false; + bool Reload = true; + bool ShuffleAtStartUp = true; + bool PreferSmall = true; + size_t MaxNumberOfRuns = ULONG_MAX; + int ReportSlowUnits = 10; + bool OnlyASCII = false; + std::string OutputCorpus; + std::string ArtifactPrefix = "./"; + std::string ExactArtifactPath; + bool SaveArtifacts = true; + bool PrintNEW = true; // Print a status line when new units are found; + bool OutputCSV = false; + bool PrintNewCovPcs = false; + bool PrintFinalStats = false; + bool DetectLeaks = true; + bool TruncateUnits = false; + bool PruneCorpus = true; +}; + +class MutationDispatcher { +public: + MutationDispatcher(Random &Rand, const FuzzingOptions &Options); + ~MutationDispatcher() {} + /// Indicate that we are about to start a new sequence of mutations. + void StartMutationSequence(); + /// Print the current sequence of mutations. + void PrintMutationSequence(); + /// Indicate that the current sequence of mutations was successfull. + void RecordSuccessfulMutationSequence(); + /// Mutates data by invoking user-provided mutator. + size_t Mutate_Custom(uint8_t *Data, size_t Size, size_t MaxSize); + /// Mutates data by invoking user-provided crossover. + size_t Mutate_CustomCrossOver(uint8_t *Data, size_t Size, size_t MaxSize); + /// Mutates data by shuffling bytes. + size_t Mutate_ShuffleBytes(uint8_t *Data, size_t Size, size_t MaxSize); + /// Mutates data by erasing a byte. + size_t Mutate_EraseByte(uint8_t *Data, size_t Size, size_t MaxSize); + /// Mutates data by inserting a byte. + size_t Mutate_InsertByte(uint8_t *Data, size_t Size, size_t MaxSize); + /// Mutates data by chanding one byte. + size_t Mutate_ChangeByte(uint8_t *Data, size_t Size, size_t MaxSize); + /// Mutates data by chanding one bit. + size_t Mutate_ChangeBit(uint8_t *Data, size_t Size, size_t MaxSize); + + /// Mutates data by adding a word from the manual dictionary. + size_t Mutate_AddWordFromManualDictionary(uint8_t *Data, size_t Size, + size_t MaxSize); + + /// Mutates data by adding a word from the temporary automatic dictionary. + size_t Mutate_AddWordFromTemporaryAutoDictionary(uint8_t *Data, size_t Size, + size_t MaxSize); + + /// Mutates data by adding a word from the persistent automatic dictionary. + size_t Mutate_AddWordFromPersistentAutoDictionary(uint8_t *Data, size_t Size, + size_t MaxSize); + + /// Tries to find an ASCII integer in Data, changes it to another ASCII int. + size_t Mutate_ChangeASCIIInteger(uint8_t *Data, size_t Size, size_t MaxSize); + + /// CrossOver Data with some other element of the corpus. + size_t Mutate_CrossOver(uint8_t *Data, size_t Size, size_t MaxSize); + + /// Applies one of the configured mutations. + /// Returns the new size of data which could be up to MaxSize. + size_t Mutate(uint8_t *Data, size_t Size, size_t MaxSize); + /// Applies one of the default mutations. Provided as a service + /// to mutation authors. + size_t DefaultMutate(uint8_t *Data, size_t Size, size_t MaxSize); + + /// Creates a cross-over of two pieces of Data, returns its size. + size_t CrossOver(const uint8_t *Data1, size_t Size1, const uint8_t *Data2, + size_t Size2, uint8_t *Out, size_t MaxOutSize); + + void AddWordToManualDictionary(const Word &W); + + void AddWordToAutoDictionary(DictionaryEntry DE); + void ClearAutoDictionary(); + void PrintRecommendedDictionary(); + + void SetCorpus(const std::vector<Unit> *Corpus) { this->Corpus = Corpus; } + + Random &GetRand() { return Rand; } + +private: + + struct Mutator { + size_t (MutationDispatcher::*Fn)(uint8_t *Data, size_t Size, size_t Max); + const char *Name; + }; + + size_t AddWordFromDictionary(Dictionary &D, uint8_t *Data, size_t Size, + size_t MaxSize); + size_t MutateImpl(uint8_t *Data, size_t Size, size_t MaxSize, + const std::vector<Mutator> &Mutators); + + Random &Rand; + const FuzzingOptions Options; + + // Dictionary provided by the user via -dict=DICT_FILE. + Dictionary ManualDictionary; + // Temporary dictionary modified by the fuzzer itself, + // recreated periodically. + Dictionary TempAutoDictionary; + // Persistent dictionary modified by the fuzzer, consists of + // entries that led to successfull discoveries in the past mutations. + Dictionary PersistentAutoDictionary; + std::vector<Mutator> CurrentMutatorSequence; + std::vector<DictionaryEntry *> CurrentDictionaryEntrySequence; + const std::vector<Unit> *Corpus = nullptr; + std::vector<uint8_t> MutateInPlaceHere; + + std::vector<Mutator> Mutators; + std::vector<Mutator> DefaultMutators; +}; + +class Fuzzer { +public: + + // Aggregates all available coverage measurements. + struct Coverage { + Coverage() { Reset(); } + + void Reset() { + BlockCoverage = 0; + CallerCalleeCoverage = 0; + PcMapBits = 0; + CounterBitmapBits = 0; + PcBufferLen = 0; + CounterBitmap.clear(); + PCMap.Reset(); + } + + std::string DebugString() const; + + size_t BlockCoverage; + size_t CallerCalleeCoverage; + + size_t PcBufferLen; + // Precalculated number of bits in CounterBitmap. + size_t CounterBitmapBits; + std::vector<uint8_t> CounterBitmap; + // Precalculated number of bits in PCMap. + size_t PcMapBits; + PcCoverageMap PCMap; }; - Fuzzer(UserSuppliedFuzzer &USF, FuzzingOptions Options); - void AddToCorpus(const Unit &U) { Corpus.push_back(U); } + + Fuzzer(UserCallback CB, MutationDispatcher &MD, FuzzingOptions Options); + void AddToCorpus(const Unit &U) { + Corpus.push_back(U); + UpdateCorpusDistribution(); + } size_t ChooseUnitIdxToMutate(); const Unit &ChooseUnitToMutate() { return Corpus[ChooseUnitIdxToMutate()]; }; + void TruncateUnits(std::vector<Unit> *NewCorpus); void Loop(); void Drill(); void ShuffleAndMinimize(); void InitializeTraceState(); + void AssignTaintLabels(uint8_t *Data, size_t Size); size_t CorpusSize() const { return Corpus.size(); } - void ReadDir(const std::string &Path, long *Epoch) { + size_t MaxUnitSizeInCorpus() const; + void ReadDir(const std::string &Path, long *Epoch, size_t MaxSize) { Printf("Loading corpus: %s\n", Path.c_str()); - ReadDirToVectorOfUnits(Path.c_str(), &Corpus, Epoch); + ReadDirToVectorOfUnits(Path.c_str(), &Corpus, Epoch, MaxSize); } - void RereadOutputCorpus(); + void RereadOutputCorpus(size_t MaxSize); // Save the current corpus to OutputCorpus. void SaveCorpus(); @@ -119,35 +392,56 @@ class Fuzzer { return duration_cast<seconds>(system_clock::now() - ProcessStartTime) .count(); } + size_t execPerSec() { + size_t Seconds = secondsSinceProcessStartUp(); + return Seconds ? TotalNumberOfRuns / Seconds : 0; + } size_t getTotalNumberOfRuns() { return TotalNumberOfRuns; } static void StaticAlarmCallback(); + static void StaticCrashSignalCallback(); + static void StaticInterruptCallback(); - void ExecuteCallback(const Unit &U); + void ExecuteCallback(const uint8_t *Data, size_t Size); + bool RunOne(const uint8_t *Data, size_t Size); // Merge Corpora[1:] into Corpora[0]. void Merge(const std::vector<std::string> &Corpora); + // Returns a subset of 'Extra' that adds coverage to 'Initial'. + UnitVector FindExtraUnits(const UnitVector &Initial, const UnitVector &Extra); + MutationDispatcher &GetMD() { return MD; } + void PrintFinalStats(); + void SetMaxLen(size_t MaxLen); + void RssLimitCallback(); - private: + // Public for tests. + void ResetCoverage(); + + bool InFuzzingThread() const { return IsMyThread; } + size_t GetCurrentUnitInFuzzingThead(const uint8_t **Data) const; + +private: void AlarmCallback(); + void CrashCallback(); + void InterruptCallback(); void MutateAndTestOne(); void ReportNewCoverage(const Unit &U); - bool RunOne(const Unit &U); - void RunOneAndUpdateCorpus(Unit &U); + bool RunOne(const Unit &U) { return RunOne(U.data(), U.size()); } + void RunOneAndUpdateCorpus(const uint8_t *Data, size_t Size); void WriteToOutputCorpus(const Unit &U); void WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix); void PrintStats(const char *Where, const char *End = "\n"); void PrintStatusForNewUnit(const Unit &U); - void PrintUnitInASCII(const Unit &U, const char *PrintAfter = ""); + void ShuffleCorpus(UnitVector *V); + void TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size, + bool DuringInitialCorpusExecution); - void SyncCorpus(); - - size_t RecordBlockCoverage(); - size_t RecordCallerCalleeCoverage(); - void PrepareCoverageBeforeRun(); - bool CheckCoverageAfterRun(); + // Updates the probability distribution for the units in the corpus. + // Must be called whenever the corpus or unit weights are changed. + void UpdateCorpusDistribution(); + bool UpdateMaxCoverage(); // Trace-based fuzzing: we run a unit with some kind of tracing // enabled and record potentially useful mutations. Then @@ -160,48 +454,41 @@ class Fuzzer { void SetDeathCallback(); static void StaticDeathCallback(); + void DumpCurrentUnit(const char *Prefix); void DeathCallback(); - Unit CurrentUnit; + + void LazyAllocateCurrentUnitData(); + uint8_t *CurrentUnitData = nullptr; + std::atomic<size_t> CurrentUnitSize; size_t TotalNumberOfRuns = 0; - size_t TotalNumberOfExecutedTraceBasedMutations = 0; + size_t NumberOfNewUnitsAdded = 0; + + bool HasMoreMallocsThanFrees = false; + size_t NumberOfLeakDetectionAttempts = 0; std::vector<Unit> Corpus; std::unordered_set<std::string> UnitHashesAddedToCorpus; - // For UseCounters - std::vector<uint8_t> CounterBitmap; - size_t TotalBits() { // Slow. Call it only for printing stats. - size_t Res = 0; - for (auto x : CounterBitmap) Res += __builtin_popcount(x); - return Res; - } - - UserSuppliedFuzzer &USF; + std::piecewise_constant_distribution<double> CorpusDistribution; + UserCallback CB; + MutationDispatcher &MD; FuzzingOptions Options; system_clock::time_point ProcessStartTime = system_clock::now(); - system_clock::time_point LastExternalSync = system_clock::now(); system_clock::time_point UnitStartTime; long TimeOfLongestUnitInSeconds = 0; long EpochOfLastReadOfOutputCorpus = 0; - size_t LastRecordedBlockCoverage = 0; - size_t LastRecordedCallerCalleeCoverage = 0; - size_t LastCoveragePcBufferLen = 0; -}; - -class SimpleUserSuppliedFuzzer: public UserSuppliedFuzzer { - public: - SimpleUserSuppliedFuzzer(FuzzerRandomBase *Rand, UserCallback Callback) - : UserSuppliedFuzzer(Rand), Callback(Callback) {} - virtual int TargetFunction(const uint8_t *Data, size_t Size) override { - return Callback(Data, Size); - } + // Maximum recorded coverage. + Coverage MaxCoverage; - private: - UserCallback Callback = nullptr; + // Need to know our own thread. + static thread_local bool IsMyThread; }; -}; // namespace fuzzer +// Global interface to functions that may or may not be available. +extern ExternalFunctions *EF; + +}; // namespace fuzzer #endif // LLVM_FUZZER_INTERNAL_H diff --git a/gnu/llvm/lib/Fuzzer/FuzzerLoop.cpp b/gnu/llvm/lib/Fuzzer/FuzzerLoop.cpp index 5237682ff24..89db5e0ac0a 100644 --- a/gnu/llvm/lib/Fuzzer/FuzzerLoop.cpp +++ b/gnu/llvm/lib/Fuzzer/FuzzerLoop.cpp @@ -11,63 +11,159 @@ #include "FuzzerInternal.h" #include <algorithm> +#include <cstring> +#include <memory> #if defined(__has_include) -# if __has_include(<sanitizer/coverage_interface.h>) -# include <sanitizer/coverage_interface.h> -# endif +#if __has_include(<sanitizer / coverage_interface.h>) +#include <sanitizer/coverage_interface.h> +#endif +#if __has_include(<sanitizer / lsan_interface.h>) +#include <sanitizer/lsan_interface.h> +#endif #endif -extern "C" { -// Re-declare some of the sanitizer functions as "weak" so that -// libFuzzer can be linked w/o the sanitizers and sanitizer-coverage -// (in which case it will complain at start-up time). -__attribute__((weak)) void __sanitizer_print_stack_trace(); -__attribute__((weak)) void __sanitizer_reset_coverage(); -__attribute__((weak)) size_t __sanitizer_get_total_unique_caller_callee_pairs(); -__attribute__((weak)) size_t __sanitizer_get_total_unique_coverage(); -__attribute__((weak)) -void __sanitizer_set_death_callback(void (*callback)(void)); -__attribute__((weak)) size_t __sanitizer_get_number_of_counters(); -__attribute__((weak)) -uintptr_t __sanitizer_update_counter_bitset_and_clear_counters(uint8_t *bitset); -__attribute__((weak)) uintptr_t -__sanitizer_get_coverage_pc_buffer(uintptr_t **data); -} +#define NO_SANITIZE_MEMORY +#if defined(__has_feature) +#if __has_feature(memory_sanitizer) +#undef NO_SANITIZE_MEMORY +#define NO_SANITIZE_MEMORY __attribute__((no_sanitize_memory)) +#endif +#endif namespace fuzzer { static const size_t kMaxUnitSizeToPrint = 256; +static const size_t TruncateMaxRuns = 1000; + +thread_local bool Fuzzer::IsMyThread; -static void MissingWeakApiFunction(const char *FnName) { +static void MissingExternalApiFunction(const char *FnName) { Printf("ERROR: %s is not defined. Exiting.\n" - "Did you use -fsanitize-coverage=... to build your code?\n", FnName); + "Did you use -fsanitize-coverage=... to build your code?\n", + FnName); exit(1); } -#define CHECK_WEAK_API_FUNCTION(fn) \ +#define CHECK_EXTERNAL_FUNCTION(fn) \ do { \ - if (!fn) \ - MissingWeakApiFunction(#fn); \ + if (!(EF->fn)) \ + MissingExternalApiFunction(#fn); \ } while (false) // Only one Fuzzer per process. static Fuzzer *F; -Fuzzer::Fuzzer(UserSuppliedFuzzer &USF, FuzzingOptions Options) - : USF(USF), Options(Options) { +struct CoverageController { + static void Reset() { + CHECK_EXTERNAL_FUNCTION(__sanitizer_reset_coverage); + EF->__sanitizer_reset_coverage(); + PcMapResetCurrent(); + } + + static void ResetCounters(const FuzzingOptions &Options) { + if (Options.UseCounters) { + EF->__sanitizer_update_counter_bitset_and_clear_counters(0); + } + } + + static void Prepare(const FuzzingOptions &Options, Fuzzer::Coverage *C) { + if (Options.UseCounters) { + size_t NumCounters = EF->__sanitizer_get_number_of_counters(); + C->CounterBitmap.resize(NumCounters); + } + } + + // Records data to a maximum coverage tracker. Returns true if additional + // coverage was discovered. + static bool RecordMax(const FuzzingOptions &Options, Fuzzer::Coverage *C) { + bool Res = false; + + uint64_t NewBlockCoverage = EF->__sanitizer_get_total_unique_coverage(); + if (NewBlockCoverage > C->BlockCoverage) { + Res = true; + C->BlockCoverage = NewBlockCoverage; + } + + if (Options.UseIndirCalls && + EF->__sanitizer_get_total_unique_caller_callee_pairs) { + uint64_t NewCallerCalleeCoverage = + EF->__sanitizer_get_total_unique_caller_callee_pairs(); + if (NewCallerCalleeCoverage > C->CallerCalleeCoverage) { + Res = true; + C->CallerCalleeCoverage = NewCallerCalleeCoverage; + } + } + + if (Options.UseCounters) { + uint64_t CounterDelta = + EF->__sanitizer_update_counter_bitset_and_clear_counters( + C->CounterBitmap.data()); + if (CounterDelta > 0) { + Res = true; + C->CounterBitmapBits += CounterDelta; + } + } + + uint64_t NewPcMapBits = PcMapMergeInto(&C->PCMap); + if (NewPcMapBits > C->PcMapBits) { + Res = true; + C->PcMapBits = NewPcMapBits; + } + + uintptr_t *CoverageBuf; + uint64_t NewPcBufferLen = + EF->__sanitizer_get_coverage_pc_buffer(&CoverageBuf); + if (NewPcBufferLen > C->PcBufferLen) { + Res = true; + C->PcBufferLen = NewPcBufferLen; + } + + return Res; + } +}; + +// Leak detection is expensive, so we first check if there were more mallocs +// than frees (using the sanitizer malloc hooks) and only then try to call lsan. +struct MallocFreeTracer { + void Start() { + Mallocs = 0; + Frees = 0; + } + // Returns true if there were more mallocs than frees. + bool Stop() { return Mallocs > Frees; } + std::atomic<size_t> Mallocs; + std::atomic<size_t> Frees; +}; + +static MallocFreeTracer AllocTracer; + +void MallocHook(const volatile void *ptr, size_t size) { + AllocTracer.Mallocs++; +} +void FreeHook(const volatile void *ptr) { + AllocTracer.Frees++; +} + +Fuzzer::Fuzzer(UserCallback CB, MutationDispatcher &MD, FuzzingOptions Options) + : CB(CB), MD(MD), Options(Options) { SetDeathCallback(); InitializeTraceState(); assert(!F); F = this; + ResetCoverage(); + IsMyThread = true; + if (Options.DetectLeaks && EF->__sanitizer_install_malloc_and_free_hooks) + EF->__sanitizer_install_malloc_and_free_hooks(MallocHook, FreeHook); } -void Fuzzer::SetDeathCallback() { - CHECK_WEAK_API_FUNCTION(__sanitizer_set_death_callback); - __sanitizer_set_death_callback(StaticDeathCallback); +void Fuzzer::LazyAllocateCurrentUnitData() { + if (CurrentUnitData || Options.MaxLen == 0) return; + CurrentUnitData = new uint8_t[Options.MaxLen]; } -void Fuzzer::PrintUnitInASCII(const Unit &U, const char *PrintAfter) { - PrintASCII(U, PrintAfter); +void Fuzzer::SetDeathCallback() { + CHECK_EXTERNAL_FUNCTION(__sanitizer_set_death_callback); + EF->__sanitizer_set_death_callback(StaticDeathCallback); } void Fuzzer::StaticDeathCallback() { @@ -75,13 +171,21 @@ void Fuzzer::StaticDeathCallback() { F->DeathCallback(); } -void Fuzzer::DeathCallback() { - Printf("DEATH:\n"); - if (CurrentUnit.size() <= kMaxUnitSizeToPrint) { - Print(CurrentUnit, "\n"); - PrintUnitInASCII(CurrentUnit, "\n"); +void Fuzzer::DumpCurrentUnit(const char *Prefix) { + if (!CurrentUnitData) return; // Happens when running individual inputs. + size_t UnitSize = CurrentUnitSize; + if (UnitSize <= kMaxUnitSizeToPrint) { + PrintHexArray(CurrentUnitData, UnitSize, "\n"); + PrintASCII(CurrentUnitData, UnitSize, "\n"); } - WriteUnitToFileWithPrefix(CurrentUnit, "crash-"); + WriteUnitToFileWithPrefix({CurrentUnitData, CurrentUnitData + UnitSize}, + Prefix); +} + +NO_SANITIZE_MEMORY +void Fuzzer::DeathCallback() { + DumpCurrentUnit("crash-"); + PrintFinalStats(); } void Fuzzer::StaticAlarmCallback() { @@ -89,131 +193,256 @@ void Fuzzer::StaticAlarmCallback() { F->AlarmCallback(); } +void Fuzzer::StaticCrashSignalCallback() { + assert(F); + F->CrashCallback(); +} + +void Fuzzer::StaticInterruptCallback() { + assert(F); + F->InterruptCallback(); +} + +void Fuzzer::CrashCallback() { + Printf("==%d== ERROR: libFuzzer: deadly signal\n", GetPid()); + if (EF->__sanitizer_print_stack_trace) + EF->__sanitizer_print_stack_trace(); + Printf("NOTE: libFuzzer has rudimentary signal handlers.\n" + " Combine libFuzzer with AddressSanitizer or similar for better " + "crash reports.\n"); + Printf("SUMMARY: libFuzzer: deadly signal\n"); + DumpCurrentUnit("crash-"); + PrintFinalStats(); + exit(Options.ErrorExitCode); +} + +void Fuzzer::InterruptCallback() { + Printf("==%d== libFuzzer: run interrupted; exiting\n", GetPid()); + PrintFinalStats(); + _Exit(0); // Stop right now, don't perform any at-exit actions. +} + +NO_SANITIZE_MEMORY void Fuzzer::AlarmCallback() { assert(Options.UnitTimeoutSec > 0); + if (!InFuzzingThread()) return; + if (!CurrentUnitSize) + return; // We have not started running units yet. size_t Seconds = duration_cast<seconds>(system_clock::now() - UnitStartTime).count(); - if (Seconds == 0) return; + if (Seconds == 0) + return; if (Options.Verbosity >= 2) Printf("AlarmCallback %zd\n", Seconds); if (Seconds >= (size_t)Options.UnitTimeoutSec) { Printf("ALARM: working on the last Unit for %zd seconds\n", Seconds); Printf(" and the timeout value is %d (use -timeout=N to change)\n", Options.UnitTimeoutSec); - if (CurrentUnit.size() <= kMaxUnitSizeToPrint) { - Print(CurrentUnit, "\n"); - PrintUnitInASCII(CurrentUnit, "\n"); - } - WriteUnitToFileWithPrefix(CurrentUnit, "timeout-"); + DumpCurrentUnit("timeout-"); Printf("==%d== ERROR: libFuzzer: timeout after %d seconds\n", GetPid(), Seconds); - if (__sanitizer_print_stack_trace) - __sanitizer_print_stack_trace(); + if (EF->__sanitizer_print_stack_trace) + EF->__sanitizer_print_stack_trace(); Printf("SUMMARY: libFuzzer: timeout\n"); - exit(1); + PrintFinalStats(); + _Exit(Options.TimeoutExitCode); // Stop right now. } } -void Fuzzer::PrintStats(const char *Where, const char *End) { - size_t Seconds = secondsSinceProcessStartUp(); - size_t ExecPerSec = (Seconds ? TotalNumberOfRuns / Seconds : 0); +void Fuzzer::RssLimitCallback() { + Printf( + "==%d== ERROR: libFuzzer: out-of-memory (used: %zdMb; limit: %zdMb)\n", + GetPid(), GetPeakRSSMb(), Options.RssLimitMb); + Printf(" To change the out-of-memory limit use -rss_limit_mb=<N>\n\n"); + if (EF->__sanitizer_print_memory_profile) + EF->__sanitizer_print_memory_profile(50); + DumpCurrentUnit("oom-"); + Printf("SUMMARY: libFuzzer: out-of-memory\n"); + PrintFinalStats(); + _Exit(Options.ErrorExitCode); // Stop right now. +} +void Fuzzer::PrintStats(const char *Where, const char *End) { + size_t ExecPerSec = execPerSec(); if (Options.OutputCSV) { static bool csvHeaderPrinted = false; if (!csvHeaderPrinted) { csvHeaderPrinted = true; Printf("runs,block_cov,bits,cc_cov,corpus,execs_per_sec,tbms,reason\n"); } - Printf("%zd,%zd,%zd,%zd,%zd,%zd,%zd,%s\n", TotalNumberOfRuns, - LastRecordedBlockCoverage, TotalBits(), - LastRecordedCallerCalleeCoverage, Corpus.size(), ExecPerSec, - TotalNumberOfExecutedTraceBasedMutations, Where); + Printf("%zd,%zd,%zd,%zd,%zd,%zd,%s\n", TotalNumberOfRuns, + MaxCoverage.BlockCoverage, MaxCoverage.CounterBitmapBits, + MaxCoverage.CallerCalleeCoverage, Corpus.size(), ExecPerSec, Where); } if (!Options.Verbosity) return; Printf("#%zd\t%s", TotalNumberOfRuns, Where); - if (LastRecordedBlockCoverage) - Printf(" cov: %zd", LastRecordedBlockCoverage); - if (auto TB = TotalBits()) + if (MaxCoverage.BlockCoverage) + Printf(" cov: %zd", MaxCoverage.BlockCoverage); + if (MaxCoverage.PcMapBits) + Printf(" path: %zd", MaxCoverage.PcMapBits); + if (auto TB = MaxCoverage.CounterBitmapBits) Printf(" bits: %zd", TB); - if (LastRecordedCallerCalleeCoverage) - Printf(" indir: %zd", LastRecordedCallerCalleeCoverage); + if (MaxCoverage.CallerCalleeCoverage) + Printf(" indir: %zd", MaxCoverage.CallerCalleeCoverage); Printf(" units: %zd exec/s: %zd", Corpus.size(), ExecPerSec); - if (TotalNumberOfExecutedTraceBasedMutations) - Printf(" tbm: %zd", TotalNumberOfExecutedTraceBasedMutations); Printf("%s", End); } -void Fuzzer::RereadOutputCorpus() { - if (Options.OutputCorpus.empty()) return; +void Fuzzer::PrintFinalStats() { + if (!Options.PrintFinalStats) return; + size_t ExecPerSec = execPerSec(); + Printf("stat::number_of_executed_units: %zd\n", TotalNumberOfRuns); + Printf("stat::average_exec_per_sec: %zd\n", ExecPerSec); + Printf("stat::new_units_added: %zd\n", NumberOfNewUnitsAdded); + Printf("stat::slowest_unit_time_sec: %zd\n", TimeOfLongestUnitInSeconds); + Printf("stat::peak_rss_mb: %zd\n", GetPeakRSSMb()); +} + +size_t Fuzzer::MaxUnitSizeInCorpus() const { + size_t Res = 0; + for (auto &X : Corpus) + Res = std::max(Res, X.size()); + return Res; +} + +void Fuzzer::SetMaxLen(size_t MaxLen) { + assert(Options.MaxLen == 0); // Can only reset MaxLen from 0 to non-0. + assert(MaxLen); + Options.MaxLen = MaxLen; + Printf("INFO: -max_len is not provided, using %zd\n", Options.MaxLen); +} + + +void Fuzzer::RereadOutputCorpus(size_t MaxSize) { + if (Options.OutputCorpus.empty()) + return; std::vector<Unit> AdditionalCorpus; ReadDirToVectorOfUnits(Options.OutputCorpus.c_str(), &AdditionalCorpus, - &EpochOfLastReadOfOutputCorpus); + &EpochOfLastReadOfOutputCorpus, MaxSize); if (Corpus.empty()) { Corpus = AdditionalCorpus; return; } - if (!Options.Reload) return; + if (!Options.Reload) + return; if (Options.Verbosity >= 2) - Printf("Reload: read %zd new units.\n", AdditionalCorpus.size()); + Printf("Reload: read %zd new units.\n", AdditionalCorpus.size()); for (auto &X : AdditionalCorpus) { - if (X.size() > (size_t)Options.MaxLen) - X.resize(Options.MaxLen); + if (X.size() > MaxSize) + X.resize(MaxSize); if (UnitHashesAddedToCorpus.insert(Hash(X)).second) { - CurrentUnit.clear(); - CurrentUnit.insert(CurrentUnit.begin(), X.begin(), X.end()); - if (RunOne(CurrentUnit)) { + if (RunOne(X)) { Corpus.push_back(X); + UpdateCorpusDistribution(); PrintStats("RELOAD"); } } } } +void Fuzzer::ShuffleCorpus(UnitVector *V) { + std::random_shuffle(V->begin(), V->end(), MD.GetRand()); + if (Options.PreferSmall) + std::stable_sort(V->begin(), V->end(), [](const Unit &A, const Unit &B) { + return A.size() < B.size(); + }); +} + +// Tries random prefixes of corpus items. +// Prefix length is chosen according to exponential distribution +// to sample short lengths much more heavily. +void Fuzzer::TruncateUnits(std::vector<Unit> *NewCorpus) { + size_t MaxCorpusLen = 0; + for (const auto &U : Corpus) + MaxCorpusLen = std::max(MaxCorpusLen, U.size()); + + if (MaxCorpusLen <= 1) + return; + + // 50% of exponential distribution is Log[2]/lambda. + // Choose lambda so that median is MaxCorpusLen / 2. + double Lambda = 2.0 * log(2.0) / static_cast<double>(MaxCorpusLen); + std::exponential_distribution<> Dist(Lambda); + std::vector<double> Sizes; + size_t TruncatePoints = std::max(1ul, TruncateMaxRuns / Corpus.size()); + Sizes.reserve(TruncatePoints); + for (size_t I = 0; I < TruncatePoints; ++I) { + Sizes.push_back(Dist(MD.GetRand().Get_mt19937()) + 1); + } + std::sort(Sizes.begin(), Sizes.end()); + + for (size_t S : Sizes) { + for (const auto &U : Corpus) { + if (S < U.size() && RunOne(U.data(), S)) { + Unit U1(U.begin(), U.begin() + S); + NewCorpus->push_back(U1); + WriteToOutputCorpus(U1); + PrintStatusForNewUnit(U1); + } + } + } + PrintStats("TRUNC "); +} + void Fuzzer::ShuffleAndMinimize() { - bool PreferSmall = (Options.PreferSmallDuringInitialShuffle == 1 || - (Options.PreferSmallDuringInitialShuffle == -1 && - USF.GetRand().RandBool())); - if (Options.Verbosity) - Printf("PreferSmall: %d\n", PreferSmall); PrintStats("READ "); std::vector<Unit> NewCorpus; - if (Options.ShuffleAtStartUp) { - std::random_shuffle(Corpus.begin(), Corpus.end(), USF.GetRand()); - if (PreferSmall) - std::stable_sort( - Corpus.begin(), Corpus.end(), - [](const Unit &A, const Unit &B) { return A.size() < B.size(); }); + if (Options.ShuffleAtStartUp) + ShuffleCorpus(&Corpus); + + if (Options.TruncateUnits) { + ResetCoverage(); + TruncateUnits(&NewCorpus); + ResetCoverage(); } - Unit &U = CurrentUnit; - for (const auto &C : Corpus) { - for (size_t First = 0; First < 1; First++) { - U.clear(); - size_t Last = std::min(First + Options.MaxLen, C.size()); - U.insert(U.begin(), C.begin() + First, C.begin() + Last); - if (Options.OnlyASCII) - ToASCII(U); - if (RunOne(U)) { - NewCorpus.push_back(U); - if (Options.Verbosity >= 2) - Printf("NEW0: %zd L %zd\n", LastRecordedBlockCoverage, U.size()); - } + + for (const auto &U : Corpus) { + bool NewCoverage = RunOne(U); + if (!Options.PruneCorpus || NewCoverage) { + NewCorpus.push_back(U); + if (Options.Verbosity >= 2) + Printf("NEW0: %zd L %zd\n", MaxCoverage.BlockCoverage, U.size()); } + TryDetectingAMemoryLeak(U.data(), U.size(), + /*DuringInitialCorpusExecution*/ true); } Corpus = NewCorpus; + UpdateCorpusDistribution(); for (auto &X : Corpus) UnitHashesAddedToCorpus.insert(Hash(X)); PrintStats("INITED"); + if (Corpus.empty()) { + Printf("ERROR: no interesting inputs were found. " + "Is the code instrumented for coverage? Exiting.\n"); + exit(1); + } } -bool Fuzzer::RunOne(const Unit &U) { - UnitStartTime = system_clock::now(); +bool Fuzzer::UpdateMaxCoverage() { + uintptr_t PrevBufferLen = MaxCoverage.PcBufferLen; + bool Res = CoverageController::RecordMax(Options, &MaxCoverage); + + if (Options.PrintNewCovPcs && PrevBufferLen != MaxCoverage.PcBufferLen) { + uintptr_t *CoverageBuf; + EF->__sanitizer_get_coverage_pc_buffer(&CoverageBuf); + assert(CoverageBuf); + for (size_t I = PrevBufferLen; I < MaxCoverage.PcBufferLen; ++I) { + Printf("%p\n", CoverageBuf[I]); + } + } + + return Res; +} + +bool Fuzzer::RunOne(const uint8_t *Data, size_t Size) { TotalNumberOfRuns++; - PrepareCoverageBeforeRun(); - ExecuteCallback(U); - bool Res = CheckCoverageAfterRun(); + // TODO(aizatsky): this Reset call seems to be not needed. + CoverageController::ResetCounters(Options); + ExecuteCallback(Data, Size); + bool Res = UpdateMaxCoverage(); auto UnitStopTime = system_clock::now(); auto TimeOfUnit = @@ -225,88 +454,63 @@ bool Fuzzer::RunOne(const Unit &U) { TimeOfUnit >= Options.ReportSlowUnits) { TimeOfLongestUnitInSeconds = TimeOfUnit; Printf("Slowest unit: %zd s:\n", TimeOfLongestUnitInSeconds); - WriteUnitToFileWithPrefix(U, "slow-unit-"); + WriteUnitToFileWithPrefix({Data, Data + Size}, "slow-unit-"); } return Res; } -void Fuzzer::RunOneAndUpdateCorpus(Unit &U) { +void Fuzzer::RunOneAndUpdateCorpus(const uint8_t *Data, size_t Size) { if (TotalNumberOfRuns >= Options.MaxNumberOfRuns) return; - if (Options.OnlyASCII) - ToASCII(U); - if (RunOne(U)) - ReportNewCoverage(U); -} - -void Fuzzer::ExecuteCallback(const Unit &U) { - const uint8_t *Data = U.data(); - uint8_t EmptyData; - if (!Data) - Data = &EmptyData; - int Res = USF.TargetFunction(Data, U.size()); - (void)Res; - assert(Res == 0); -} - -size_t Fuzzer::RecordBlockCoverage() { - CHECK_WEAK_API_FUNCTION(__sanitizer_get_total_unique_coverage); - uintptr_t PrevCoverage = LastRecordedBlockCoverage; - LastRecordedBlockCoverage = __sanitizer_get_total_unique_coverage(); - - if (PrevCoverage == LastRecordedBlockCoverage || !Options.PrintNewCovPcs) - return LastRecordedBlockCoverage; - - uintptr_t PrevBufferLen = LastCoveragePcBufferLen; - uintptr_t *CoverageBuf; - LastCoveragePcBufferLen = __sanitizer_get_coverage_pc_buffer(&CoverageBuf); - assert(CoverageBuf); - for (size_t i = PrevBufferLen; i < LastCoveragePcBufferLen; ++i) { - Printf("0x%x\n", CoverageBuf[i]); - } - - return LastRecordedBlockCoverage; + if (RunOne(Data, Size)) + ReportNewCoverage({Data, Data + Size}); } -size_t Fuzzer::RecordCallerCalleeCoverage() { - if (!Options.UseIndirCalls) - return 0; - if (!__sanitizer_get_total_unique_caller_callee_pairs) - return 0; - return LastRecordedCallerCalleeCoverage = - __sanitizer_get_total_unique_caller_callee_pairs(); +size_t Fuzzer::GetCurrentUnitInFuzzingThead(const uint8_t **Data) const { + assert(InFuzzingThread()); + *Data = CurrentUnitData; + return CurrentUnitSize; } -void Fuzzer::PrepareCoverageBeforeRun() { - if (Options.UseCounters) { - size_t NumCounters = __sanitizer_get_number_of_counters(); - CounterBitmap.resize(NumCounters); - __sanitizer_update_counter_bitset_and_clear_counters(0); - } - RecordBlockCoverage(); - RecordCallerCalleeCoverage(); +void Fuzzer::ExecuteCallback(const uint8_t *Data, size_t Size) { + assert(InFuzzingThread()); + LazyAllocateCurrentUnitData(); + UnitStartTime = system_clock::now(); + // We copy the contents of Unit into a separate heap buffer + // so that we reliably find buffer overflows in it. + std::unique_ptr<uint8_t[]> DataCopy(new uint8_t[Size]); + memcpy(DataCopy.get(), Data, Size); + if (CurrentUnitData && CurrentUnitData != Data) + memcpy(CurrentUnitData, Data, Size); + AssignTaintLabels(DataCopy.get(), Size); + CurrentUnitSize = Size; + AllocTracer.Start(); + int Res = CB(DataCopy.get(), Size); + (void)Res; + HasMoreMallocsThanFrees = AllocTracer.Stop(); + CurrentUnitSize = 0; + assert(Res == 0); } -bool Fuzzer::CheckCoverageAfterRun() { - size_t OldCoverage = LastRecordedBlockCoverage; - size_t NewCoverage = RecordBlockCoverage(); - size_t OldCallerCalleeCoverage = LastRecordedCallerCalleeCoverage; - size_t NewCallerCalleeCoverage = RecordCallerCalleeCoverage(); - size_t NumNewBits = 0; - if (Options.UseCounters) - NumNewBits = __sanitizer_update_counter_bitset_and_clear_counters( - CounterBitmap.data()); - return NewCoverage > OldCoverage || - NewCallerCalleeCoverage > OldCallerCalleeCoverage || NumNewBits; +std::string Fuzzer::Coverage::DebugString() const { + std::string Result = + std::string("Coverage{") + "BlockCoverage=" + + std::to_string(BlockCoverage) + " CallerCalleeCoverage=" + + std::to_string(CallerCalleeCoverage) + " CounterBitmapBits=" + + std::to_string(CounterBitmapBits) + " PcMapBits=" + + std::to_string(PcMapBits) + "}"; + return Result; } void Fuzzer::WriteToOutputCorpus(const Unit &U) { - if (Options.OutputCorpus.empty()) return; + if (Options.OnlyASCII) + assert(IsASCII(U)); + if (Options.OutputCorpus.empty()) + return; std::string Path = DirPlusFile(Options.OutputCorpus, Hash(U)); WriteToFile(U, Path); if (Options.Verbosity >= 2) Printf("Written to %s\n", Path.c_str()); - assert(!Options.OnlyASCII || IsASCII(U)); } void Fuzzer::WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix) { @@ -314,7 +518,7 @@ void Fuzzer::WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix) { return; std::string Path = Options.ArtifactPrefix + Prefix + Hash(U); if (!Options.ExactArtifactPath.empty()) - Path = Options.ExactArtifactPath; // Overrides ArtifactPrefix. + Path = Options.ExactArtifactPath; // Overrides ArtifactPrefix. WriteToFile(U, Path); Printf("artifact_prefix='%s'; Test unit written to %s\n", Options.ArtifactPrefix.c_str(), Path.c_str()); @@ -323,7 +527,8 @@ void Fuzzer::WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix) { } void Fuzzer::SaveCorpus() { - if (Options.OutputCorpus.empty()) return; + if (Options.OutputCorpus.empty()) + return; for (const auto &U : Corpus) WriteToFile(U, DirPlusFile(Options.OutputCorpus, Hash(U))); if (Options.Verbosity) @@ -337,18 +542,54 @@ void Fuzzer::PrintStatusForNewUnit(const Unit &U) { PrintStats("NEW ", ""); if (Options.Verbosity) { Printf(" L: %zd ", U.size()); - USF.PrintMutationSequence(); + MD.PrintMutationSequence(); Printf("\n"); } } void Fuzzer::ReportNewCoverage(const Unit &U) { Corpus.push_back(U); + UpdateCorpusDistribution(); UnitHashesAddedToCorpus.insert(Hash(U)); + MD.RecordSuccessfulMutationSequence(); PrintStatusForNewUnit(U); WriteToOutputCorpus(U); - if (Options.ExitOnFirst) - exit(0); + NumberOfNewUnitsAdded++; +} + +// Finds minimal number of units in 'Extra' that add coverage to 'Initial'. +// We do it by actually executing the units, sometimes more than once, +// because we may be using different coverage-like signals and the only +// common thing between them is that we can say "this unit found new stuff". +UnitVector Fuzzer::FindExtraUnits(const UnitVector &Initial, + const UnitVector &Extra) { + UnitVector Res = Extra; + size_t OldSize = Res.size(); + for (int Iter = 0; Iter < 10; Iter++) { + ShuffleCorpus(&Res); + ResetCoverage(); + + for (auto &U : Initial) + RunOne(U); + + Corpus.clear(); + for (auto &U : Res) + if (RunOne(U)) + Corpus.push_back(U); + + char Stat[7] = "MIN "; + Stat[3] = '0' + Iter; + PrintStats(Stat); + + size_t NewSize = Corpus.size(); + assert(NewSize <= OldSize); + Res.swap(Corpus); + + if (NewSize + 5 >= OldSize) + break; + OldSize = NewSize; + } + return Res; } void Fuzzer::Merge(const std::vector<std::string> &Corpora) { @@ -356,72 +597,105 @@ void Fuzzer::Merge(const std::vector<std::string> &Corpora) { Printf("Merge requires two or more corpus dirs\n"); return; } - auto InitialCorpusDir = Corpora[0]; - ReadDir(InitialCorpusDir, nullptr); - Printf("Merge: running the initial corpus '%s' of %d units\n", - InitialCorpusDir.c_str(), Corpus.size()); - for (auto &U : Corpus) - RunOne(U); - std::vector<std::string> ExtraCorpora(Corpora.begin() + 1, Corpora.end()); - size_t NumTried = 0; - size_t NumMerged = 0; - for (auto &C : ExtraCorpora) { - Corpus.clear(); - ReadDir(C, nullptr); - Printf("Merge: merging the extra corpus '%s' of %zd units\n", C.c_str(), - Corpus.size()); - for (auto &U : Corpus) { - NumTried++; - if (RunOne(U)) { - WriteToOutputCorpus(U); - NumMerged++; - } - } + assert(Options.MaxLen > 0); + UnitVector Initial, Extra; + ReadDirToVectorOfUnits(Corpora[0].c_str(), &Initial, nullptr, Options.MaxLen); + for (auto &C : ExtraCorpora) + ReadDirToVectorOfUnits(C.c_str(), &Extra, nullptr, Options.MaxLen); + + if (!Initial.empty()) { + Printf("=== Minimizing the initial corpus of %zd units\n", Initial.size()); + Initial = FindExtraUnits({}, Initial); + } + + Printf("=== Merging extra %zd units\n", Extra.size()); + auto Res = FindExtraUnits(Initial, Extra); + + for (auto &U: Res) + WriteToOutputCorpus(U); + + Printf("=== Merge: written %zd units\n", Res.size()); +} + +// Tries detecting a memory leak on the particular input that we have just +// executed before calling this function. +void Fuzzer::TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size, + bool DuringInitialCorpusExecution) { + if (!HasMoreMallocsThanFrees) return; // mallocs==frees, a leak is unlikely. + if (!Options.DetectLeaks) return; + if (!&(EF->__lsan_enable) || !&(EF->__lsan_disable) || + !(EF->__lsan_do_recoverable_leak_check)) + return; // No lsan. + // Run the target once again, but with lsan disabled so that if there is + // a real leak we do not report it twice. + EF->__lsan_disable(); + RunOne(Data, Size); + EF->__lsan_enable(); + if (!HasMoreMallocsThanFrees) return; // a leak is unlikely. + if (NumberOfLeakDetectionAttempts++ > 1000) { + Options.DetectLeaks = false; + Printf("INFO: libFuzzer disabled leak detection after every mutation.\n" + " Most likely the target function accumulates allocated\n" + " memory in a global state w/o actually leaking it.\n" + " If LeakSanitizer is enabled in this process it will still\n" + " run on the process shutdown.\n"); + return; + } + // Now perform the actual lsan pass. This is expensive and we must ensure + // we don't call it too often. + if (EF->__lsan_do_recoverable_leak_check()) { // Leak is found, report it. + if (DuringInitialCorpusExecution) + Printf("\nINFO: a leak has been found in the initial corpus.\n\n"); + Printf("INFO: to ignore leaks on libFuzzer side use -detect_leaks=0.\n\n"); + CurrentUnitSize = Size; + DumpCurrentUnit("leak-"); + PrintFinalStats(); + _Exit(Options.ErrorExitCode); // not exit() to disable lsan further on. } - Printf("Merge: written %zd out of %zd units\n", NumMerged, NumTried); } void Fuzzer::MutateAndTestOne() { - auto &U = CurrentUnit; - USF.StartMutationSequence(); + LazyAllocateCurrentUnitData(); + MD.StartMutationSequence(); - U = ChooseUnitToMutate(); + auto &U = ChooseUnitToMutate(); + assert(CurrentUnitData); + size_t Size = U.size(); + assert(Size <= Options.MaxLen && "Oversized Unit"); + memcpy(CurrentUnitData, U.data(), Size); for (int i = 0; i < Options.MutateDepth; i++) { - size_t Size = U.size(); - U.resize(Options.MaxLen); - size_t NewSize = USF.Mutate(U.data(), Size, U.size()); + size_t NewSize = 0; + NewSize = MD.Mutate(CurrentUnitData, Size, Options.MaxLen); assert(NewSize > 0 && "Mutator returned empty unit"); - assert(NewSize <= (size_t)Options.MaxLen && + assert(NewSize <= Options.MaxLen && "Mutator return overisized unit"); - U.resize(NewSize); + Size = NewSize; if (i == 0) StartTraceRecording(); - RunOneAndUpdateCorpus(U); + RunOneAndUpdateCorpus(CurrentUnitData, Size); StopTraceRecording(); + TryDetectingAMemoryLeak(CurrentUnitData, Size, + /*DuringInitialCorpusExecution*/ false); } } // Returns an index of random unit from the corpus to mutate. // Hypothesis: units added to the corpus last are more likely to be interesting. -// This function gives more wieght to the more recent units. +// This function gives more weight to the more recent units. size_t Fuzzer::ChooseUnitIdxToMutate() { - size_t N = Corpus.size(); - size_t Total = (N + 1) * N / 2; - size_t R = USF.GetRand()(Total); - size_t IdxBeg = 0, IdxEnd = N; - // Binary search. - while (IdxEnd - IdxBeg >= 2) { - size_t Idx = IdxBeg + (IdxEnd - IdxBeg) / 2; - if (R > (Idx + 1) * Idx / 2) - IdxBeg = Idx; - else - IdxEnd = Idx; - } - assert(IdxBeg < N); - return IdxBeg; + size_t Idx = + static_cast<size_t>(CorpusDistribution(MD.GetRand().Get_mt19937())); + assert(Idx < Corpus.size()); + return Idx; +} + +void Fuzzer::ResetCoverage() { + CoverageController::Reset(); + MaxCoverage.Reset(); + CoverageController::Prepare(Options, &MaxCoverage); } // Experimental search heuristic: drilling. @@ -434,16 +708,16 @@ size_t Fuzzer::ChooseUnitIdxToMutate() { void Fuzzer::Drill() { // The corpus is already read, shuffled, and minimized. assert(!Corpus.empty()); - Options.PrintNEW = false; // Don't print NEW status lines when drilling. + Options.PrintNEW = false; // Don't print NEW status lines when drilling. Unit U = ChooseUnitToMutate(); - CHECK_WEAK_API_FUNCTION(__sanitizer_reset_coverage); - __sanitizer_reset_coverage(); + ResetCoverage(); std::vector<Unit> SavedCorpus; SavedCorpus.swap(Corpus); Corpus.push_back(U); + UpdateCorpusDistribution(); assert(Corpus.size() == 1); RunOne(U); PrintStats("DRILL "); @@ -451,19 +725,16 @@ void Fuzzer::Drill() { SavedOutputCorpusPath.swap(Options.OutputCorpus); Loop(); - __sanitizer_reset_coverage(); + ResetCoverage(); PrintStats("REINIT"); SavedOutputCorpusPath.swap(Options.OutputCorpus); - for (auto &U : SavedCorpus) { - CurrentUnit = U; + for (auto &U : SavedCorpus) RunOne(U); - } PrintStats("MERGE "); Options.PrintNEW = true; size_t NumMerged = 0; for (auto &U : Corpus) { - CurrentUnit = U; if (RunOne(U)) { PrintStatusForNewUnit(U); NumMerged++; @@ -478,35 +749,43 @@ void Fuzzer::Drill() { void Fuzzer::Loop() { system_clock::time_point LastCorpusReload = system_clock::now(); if (Options.DoCrossOver) - USF.SetCorpus(&Corpus); + MD.SetCorpus(&Corpus); while (true) { - SyncCorpus(); auto Now = system_clock::now(); if (duration_cast<seconds>(Now - LastCorpusReload).count()) { - RereadOutputCorpus(); + RereadOutputCorpus(Options.MaxLen); LastCorpusReload = Now; } if (TotalNumberOfRuns >= Options.MaxNumberOfRuns) break; if (Options.MaxTotalTimeSec > 0 && secondsSinceProcessStartUp() > - static_cast<size_t>(Options.MaxTotalTimeSec)) + static_cast<size_t>(Options.MaxTotalTimeSec)) break; // Perform several mutations and runs. MutateAndTestOne(); } PrintStats("DONE ", "\n"); + MD.PrintRecommendedDictionary(); } -void Fuzzer::SyncCorpus() { - if (Options.SyncCommand.empty() || Options.OutputCorpus.empty()) return; - auto Now = system_clock::now(); - if (duration_cast<seconds>(Now - LastExternalSync).count() < - Options.SyncTimeout) - return; - LastExternalSync = Now; - ExecuteCommand(Options.SyncCommand + " " + Options.OutputCorpus); +void Fuzzer::UpdateCorpusDistribution() { + size_t N = Corpus.size(); + std::vector<double> Intervals(N + 1); + std::vector<double> Weights(N); + std::iota(Intervals.begin(), Intervals.end(), 0); + std::iota(Weights.begin(), Weights.end(), 1); + CorpusDistribution = std::piecewise_constant_distribution<double>( + Intervals.begin(), Intervals.end(), Weights.begin()); } -} // namespace fuzzer +} // namespace fuzzer + +extern "C" { + +size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) { + assert(fuzzer::F); + return fuzzer::F->GetMD().DefaultMutate(Data, Size, MaxSize); +} +} // extern "C" diff --git a/gnu/llvm/lib/Fuzzer/FuzzerMain.cpp b/gnu/llvm/lib/Fuzzer/FuzzerMain.cpp index c5af5b05909..55f1687b5f0 100644 --- a/gnu/llvm/lib/Fuzzer/FuzzerMain.cpp +++ b/gnu/llvm/lib/Fuzzer/FuzzerMain.cpp @@ -12,9 +12,11 @@ #include "FuzzerInterface.h" #include "FuzzerInternal.h" +extern "C" { // This function should be defined by the user. -extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size); +int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size); +} // extern "C" int main(int argc, char **argv) { - return fuzzer::FuzzerDriver(argc, argv, LLVMFuzzerTestOneInput); + return fuzzer::FuzzerDriver(&argc, &argv, LLVMFuzzerTestOneInput); } diff --git a/gnu/llvm/lib/Fuzzer/FuzzerMutate.cpp b/gnu/llvm/lib/Fuzzer/FuzzerMutate.cpp index 30e5b43c083..65e1650bfea 100644 --- a/gnu/llvm/lib/Fuzzer/FuzzerMutate.cpp +++ b/gnu/llvm/lib/Fuzzer/FuzzerMutate.cpp @@ -13,49 +13,43 @@ #include "FuzzerInternal.h" -#include <algorithm> namespace fuzzer { -struct Mutator { - size_t (MutationDispatcher::*Fn)(uint8_t *Data, size_t Size, size_t Max); - const char *Name; -}; - -struct DictionaryEntry { - Unit Word; - size_t PositionHint; -}; - -struct MutationDispatcher::Impl { - std::vector<DictionaryEntry> ManualDictionary; - std::vector<DictionaryEntry> AutoDictionary; - std::vector<Mutator> Mutators; - std::vector<Mutator> CurrentMutatorSequence; - std::vector<DictionaryEntry> CurrentDictionaryEntrySequence; - const std::vector<Unit> *Corpus = nullptr; - FuzzerRandomBase &Rand; - - void Add(Mutator M) { Mutators.push_back(M); } - Impl(FuzzerRandomBase &Rand) : Rand(Rand) { - Add({&MutationDispatcher::Mutate_EraseByte, "EraseByte"}); - Add({&MutationDispatcher::Mutate_InsertByte, "InsertByte"}); - Add({&MutationDispatcher::Mutate_ChangeByte, "ChangeByte"}); - Add({&MutationDispatcher::Mutate_ChangeBit, "ChangeBit"}); - Add({&MutationDispatcher::Mutate_ShuffleBytes, "ShuffleBytes"}); - Add({&MutationDispatcher::Mutate_ChangeASCIIInteger, "ChangeASCIIInt"}); - Add({&MutationDispatcher::Mutate_CrossOver, "CrossOver"}); - Add({&MutationDispatcher::Mutate_AddWordFromManualDictionary, - "AddFromManualDict"}); - Add({&MutationDispatcher::Mutate_AddWordFromAutoDictionary, - "AddFromAutoDict"}); - } - void SetCorpus(const std::vector<Unit> *Corpus) { this->Corpus = Corpus; } - size_t AddWordFromDictionary(const std::vector<DictionaryEntry> &D, - uint8_t *Data, size_t Size, size_t MaxSize); -}; +const size_t Dictionary::kMaxDictSize; + +MutationDispatcher::MutationDispatcher(Random &Rand, + const FuzzingOptions &Options) + : Rand(Rand), Options(Options) { + DefaultMutators.insert( + DefaultMutators.begin(), + { + {&MutationDispatcher::Mutate_EraseByte, "EraseByte"}, + {&MutationDispatcher::Mutate_InsertByte, "InsertByte"}, + {&MutationDispatcher::Mutate_ChangeByte, "ChangeByte"}, + {&MutationDispatcher::Mutate_ChangeBit, "ChangeBit"}, + {&MutationDispatcher::Mutate_ShuffleBytes, "ShuffleBytes"}, + {&MutationDispatcher::Mutate_ChangeASCIIInteger, "ChangeASCIIInt"}, + {&MutationDispatcher::Mutate_CrossOver, "CrossOver"}, + {&MutationDispatcher::Mutate_AddWordFromManualDictionary, + "AddFromManualDict"}, + {&MutationDispatcher::Mutate_AddWordFromTemporaryAutoDictionary, + "AddFromTempAutoDict"}, + {&MutationDispatcher::Mutate_AddWordFromPersistentAutoDictionary, + "AddFromPersAutoDict"}, + }); -static char FlipRandomBit(char X, FuzzerRandomBase &Rand) { + if (EF->LLVMFuzzerCustomMutator) + Mutators.push_back({&MutationDispatcher::Mutate_Custom, "Custom"}); + else + Mutators = DefaultMutators; + + if (EF->LLVMFuzzerCustomCrossOver) + Mutators.push_back( + {&MutationDispatcher::Mutate_CustomCrossOver, "CustomCrossOver"}); +} + +static char FlipRandomBit(char X, Random &Rand) { int Bit = Rand(8); char Mask = 1 << Bit; char R; @@ -67,12 +61,36 @@ static char FlipRandomBit(char X, FuzzerRandomBase &Rand) { return R; } -static char RandCh(FuzzerRandomBase &Rand) { +static char RandCh(Random &Rand) { if (Rand.RandBool()) return Rand(256); const char *Special = "!*'();:@&=+$,/?%#[]123ABCxyz-`~."; return Special[Rand(sizeof(Special) - 1)]; } +size_t MutationDispatcher::Mutate_Custom(uint8_t *Data, size_t Size, + size_t MaxSize) { + return EF->LLVMFuzzerCustomMutator(Data, Size, MaxSize, Rand.Rand()); +} + +size_t MutationDispatcher::Mutate_CustomCrossOver(uint8_t *Data, size_t Size, + size_t MaxSize) { + if (!Corpus || Corpus->size() < 2 || Size == 0) + return 0; + size_t Idx = Rand(Corpus->size()); + const Unit &Other = (*Corpus)[Idx]; + if (Other.empty()) + return 0; + MutateInPlaceHere.resize(MaxSize); + auto &U = MutateInPlaceHere; + size_t NewSize = EF->LLVMFuzzerCustomCrossOver( + Data, Size, Other.data(), Other.size(), U.data(), U.size(), Rand.Rand()); + if (!NewSize) + return 0; + assert(NewSize <= MaxSize && "CustomCrossOver returned overisized unit"); + memcpy(Data, U.data(), NewSize); + return NewSize; +} + size_t MutationDispatcher::Mutate_ShuffleBytes(uint8_t *Data, size_t Size, size_t MaxSize) { assert(Size); @@ -122,38 +140,39 @@ size_t MutationDispatcher::Mutate_ChangeBit(uint8_t *Data, size_t Size, size_t MutationDispatcher::Mutate_AddWordFromManualDictionary(uint8_t *Data, size_t Size, size_t MaxSize) { - return MDImpl->AddWordFromDictionary(MDImpl->ManualDictionary, Data, Size, - MaxSize); + return AddWordFromDictionary(ManualDictionary, Data, Size, MaxSize); +} + +size_t MutationDispatcher::Mutate_AddWordFromTemporaryAutoDictionary( + uint8_t *Data, size_t Size, size_t MaxSize) { + return AddWordFromDictionary(TempAutoDictionary, Data, Size, MaxSize); } -size_t MutationDispatcher::Mutate_AddWordFromAutoDictionary(uint8_t *Data, - size_t Size, - size_t MaxSize) { - return MDImpl->AddWordFromDictionary(MDImpl->AutoDictionary, Data, Size, - MaxSize); +size_t MutationDispatcher::Mutate_AddWordFromPersistentAutoDictionary( + uint8_t *Data, size_t Size, size_t MaxSize) { + return AddWordFromDictionary(PersistentAutoDictionary, Data, Size, MaxSize); } -size_t MutationDispatcher::Impl::AddWordFromDictionary( - const std::vector<DictionaryEntry> &D, uint8_t *Data, size_t Size, - size_t MaxSize) { +size_t MutationDispatcher::AddWordFromDictionary(Dictionary &D, uint8_t *Data, + size_t Size, size_t MaxSize) { if (D.empty()) return 0; - const DictionaryEntry &DE = D[Rand(D.size())]; - const Unit &Word = DE.Word; - size_t PositionHint = DE.PositionHint; - bool UsePositionHint = PositionHint != std::numeric_limits<size_t>::max() && - PositionHint + Word.size() < Size && Rand.RandBool(); - if (Rand.RandBool()) { // Insert Word. - if (Size + Word.size() > MaxSize) return 0; - size_t Idx = UsePositionHint ? PositionHint : Rand(Size + 1); - memmove(Data + Idx + Word.size(), Data + Idx, Size - Idx); - memcpy(Data + Idx, Word.data(), Word.size()); - Size += Word.size(); - } else { // Overwrite some bytes with Word. - if (Word.size() > Size) return 0; - size_t Idx = UsePositionHint ? PositionHint : Rand(Size - Word.size()); - memcpy(Data + Idx, Word.data(), Word.size()); + DictionaryEntry &DE = D[Rand(D.size())]; + const Word &W = DE.GetW(); + bool UsePositionHint = DE.HasPositionHint() && + DE.GetPositionHint() + W.size() < Size && Rand.RandBool(); + if (Rand.RandBool()) { // Insert W. + if (Size + W.size() > MaxSize) return 0; + size_t Idx = UsePositionHint ? DE.GetPositionHint() : Rand(Size + 1); + memmove(Data + Idx + W.size(), Data + Idx, Size - Idx); + memcpy(Data + Idx, W.data(), W.size()); + Size += W.size(); + } else { // Overwrite some bytes with W. + if (W.size() > Size) return 0; + size_t Idx = UsePositionHint ? DE.GetPositionHint() : Rand(Size - W.size()); + memcpy(Data + Idx, W.data(), W.size()); } - CurrentDictionaryEntrySequence.push_back(DE); + DE.IncUseCount(); + CurrentDictionaryEntrySequence.push_back(&DE); return Size; } @@ -192,12 +211,12 @@ size_t MutationDispatcher::Mutate_ChangeASCIIInteger(uint8_t *Data, size_t Size, size_t MutationDispatcher::Mutate_CrossOver(uint8_t *Data, size_t Size, size_t MaxSize) { - auto Corpus = MDImpl->Corpus; if (!Corpus || Corpus->size() < 2 || Size == 0) return 0; size_t Idx = Rand(Corpus->size()); const Unit &Other = (*Corpus)[Idx]; if (Other.empty()) return 0; - Unit U(MaxSize); + MutateInPlaceHere.resize(MaxSize); + auto &U = MutateInPlaceHere; size_t NewSize = CrossOver(Data, Size, Other.data(), Other.size(), U.data(), U.size()); assert(NewSize > 0 && "CrossOver returned empty unit"); @@ -207,30 +226,69 @@ size_t MutationDispatcher::Mutate_CrossOver(uint8_t *Data, size_t Size, } void MutationDispatcher::StartMutationSequence() { - MDImpl->CurrentMutatorSequence.clear(); - MDImpl->CurrentDictionaryEntrySequence.clear(); + CurrentMutatorSequence.clear(); + CurrentDictionaryEntrySequence.clear(); +} + +// Copy successful dictionary entries to PersistentAutoDictionary. +void MutationDispatcher::RecordSuccessfulMutationSequence() { + for (auto DE : CurrentDictionaryEntrySequence) { + // PersistentAutoDictionary.AddWithSuccessCountOne(DE); + DE->IncSuccessCount(); + // Linear search is fine here as this happens seldom. + if (!PersistentAutoDictionary.ContainsWord(DE->GetW())) + PersistentAutoDictionary.push_back({DE->GetW(), 1}); + } +} + +void MutationDispatcher::PrintRecommendedDictionary() { + std::vector<DictionaryEntry> V; + for (auto &DE : PersistentAutoDictionary) + if (!ManualDictionary.ContainsWord(DE.GetW())) + V.push_back(DE); + if (V.empty()) return; + Printf("###### Recommended dictionary. ######\n"); + for (auto &DE: V) { + Printf("\""); + PrintASCII(DE.GetW(), "\""); + Printf(" # Uses: %zd\n", DE.GetUseCount()); + } + Printf("###### End of recommended dictionary. ######\n"); } void MutationDispatcher::PrintMutationSequence() { - Printf("MS: %zd ", MDImpl->CurrentMutatorSequence.size()); - for (auto M : MDImpl->CurrentMutatorSequence) + Printf("MS: %zd ", CurrentMutatorSequence.size()); + for (auto M : CurrentMutatorSequence) Printf("%s-", M.Name); - if (!MDImpl->CurrentDictionaryEntrySequence.empty()) { + if (!CurrentDictionaryEntrySequence.empty()) { Printf(" DE: "); - for (auto DE : MDImpl->CurrentDictionaryEntrySequence) { + for (auto DE : CurrentDictionaryEntrySequence) { Printf("\""); - PrintASCII(DE.Word, "\"-"); + PrintASCII(DE->GetW(), "\"-"); } } } -// Mutates Data in place, returns new size. size_t MutationDispatcher::Mutate(uint8_t *Data, size_t Size, size_t MaxSize) { + return MutateImpl(Data, Size, MaxSize, Mutators); +} + +size_t MutationDispatcher::DefaultMutate(uint8_t *Data, size_t Size, + size_t MaxSize) { + return MutateImpl(Data, Size, MaxSize, DefaultMutators); +} + +// Mutates Data in place, returns new size. +size_t MutationDispatcher::MutateImpl(uint8_t *Data, size_t Size, + size_t MaxSize, + const std::vector<Mutator> &Mutators) { assert(MaxSize > 0); assert(Size <= MaxSize); if (Size == 0) { for (size_t i = 0; i < MaxSize; i++) Data[i] = RandCh(Rand); + if (Options.OnlyASCII) + ToASCII(Data, MaxSize); return MaxSize; } assert(Size > 0); @@ -238,41 +296,31 @@ size_t MutationDispatcher::Mutate(uint8_t *Data, size_t Size, size_t MaxSize) { // in which case they will return 0. // Try several times before returning un-mutated data. for (int Iter = 0; Iter < 10; Iter++) { - size_t MutatorIdx = Rand(MDImpl->Mutators.size()); - auto M = MDImpl->Mutators[MutatorIdx]; + auto M = Mutators[Rand(Mutators.size())]; size_t NewSize = (this->*(M.Fn))(Data, Size, MaxSize); if (NewSize) { - MDImpl->CurrentMutatorSequence.push_back(M); + if (Options.OnlyASCII) + ToASCII(Data, NewSize); + CurrentMutatorSequence.push_back(M); return NewSize; } } return Size; } -void MutationDispatcher::SetCorpus(const std::vector<Unit> *Corpus) { - MDImpl->SetCorpus(Corpus); -} - -void MutationDispatcher::AddWordToManualDictionary(const Unit &Word) { - MDImpl->ManualDictionary.push_back( - {Word, std::numeric_limits<size_t>::max()}); +void MutationDispatcher::AddWordToManualDictionary(const Word &W) { + ManualDictionary.push_back( + {W, std::numeric_limits<size_t>::max()}); } -void MutationDispatcher::AddWordToAutoDictionary(const Unit &Word, - size_t PositionHint) { +void MutationDispatcher::AddWordToAutoDictionary(DictionaryEntry DE) { static const size_t kMaxAutoDictSize = 1 << 14; - if (MDImpl->AutoDictionary.size() >= kMaxAutoDictSize) return; - MDImpl->AutoDictionary.push_back({Word, PositionHint}); + if (TempAutoDictionary.size() >= kMaxAutoDictSize) return; + TempAutoDictionary.push_back(DE); } void MutationDispatcher::ClearAutoDictionary() { - MDImpl->AutoDictionary.clear(); -} - -MutationDispatcher::MutationDispatcher(FuzzerRandomBase &Rand) : Rand(Rand) { - MDImpl = new Impl(Rand); + TempAutoDictionary.clear(); } -MutationDispatcher::~MutationDispatcher() { delete MDImpl; } - } // namespace fuzzer diff --git a/gnu/llvm/lib/Fuzzer/FuzzerTracePC.cpp b/gnu/llvm/lib/Fuzzer/FuzzerTracePC.cpp new file mode 100644 index 00000000000..46c43d0c17f --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/FuzzerTracePC.cpp @@ -0,0 +1,71 @@ +//===- FuzzerTracePC.cpp - PC tracing--------------------------------------===// +// +// The LLVM Compiler Infrastructure +// +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. +// +//===----------------------------------------------------------------------===// +// Trace PCs. +// This module implements __sanitizer_cov_trace_pc, a callback required +// for -fsanitize-coverage=trace-pc instrumentation. +// +//===----------------------------------------------------------------------===// + +#include "FuzzerInternal.h" + +namespace fuzzer { + +void PcCoverageMap::Reset() { memset(Map, 0, sizeof(Map)); } + +void PcCoverageMap::Update(uintptr_t Addr) { + uintptr_t Idx = Addr % kMapSizeInBits; + uintptr_t WordIdx = Idx / kBitsInWord; + uintptr_t BitIdx = Idx % kBitsInWord; + Map[WordIdx] |= 1UL << BitIdx; +} + +size_t PcCoverageMap::MergeFrom(const PcCoverageMap &Other) { + uintptr_t Res = 0; + for (size_t i = 0; i < kMapSizeInWords; i++) + Res += __builtin_popcountl(Map[i] |= Other.Map[i]); + return Res; +} + +static PcCoverageMap CurrentMap; +static thread_local uintptr_t Prev; + +void PcMapResetCurrent() { + if (Prev) { + Prev = 0; + CurrentMap.Reset(); + } +} + +size_t PcMapMergeInto(PcCoverageMap *Map) { + if (!Prev) + return 0; + return Map->MergeFrom(CurrentMap); +} + +static void HandlePC(uint32_t PC) { + // We take 12 bits of PC and mix it with the previous PCs. + uintptr_t Next = (Prev << 5) ^ (PC & 4095); + CurrentMap.Update(Next); + Prev = Next; +} + +} // namespace fuzzer + +extern "C" { +void __sanitizer_cov_trace_pc() { + fuzzer::HandlePC(static_cast<uint32_t>( + reinterpret_cast<uintptr_t>(__builtin_return_address(0)))); +} + +void __sanitizer_cov_trace_pc_indir(int *) { + // Stub to allow linking with code built with + // -fsanitize=indirect-calls,trace-pc. + // This isn't used currently. +} +} diff --git a/gnu/llvm/lib/Fuzzer/FuzzerTracePC.h b/gnu/llvm/lib/Fuzzer/FuzzerTracePC.h new file mode 100644 index 00000000000..47280ba7faa --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/FuzzerTracePC.h @@ -0,0 +1,37 @@ +//===- FuzzerTracePC.h - INTERNAL - Path tracer. --------*- C++ -* ===// +// +// The LLVM Compiler Infrastructure +// +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. +// +//===----------------------------------------------------------------------===// +// Trace PCs. +// This module implements __sanitizer_cov_trace_pc, a callback required +// for -fsanitize-coverage=trace-pc instrumentation. +//===----------------------------------------------------------------------===// + +#ifndef LLVM_FUZZER_TRACE_PC_H +#define LLVM_FUZZER_TRACE_PC_H + +namespace fuzzer { +struct PcCoverageMap { + static const size_t kMapSizeInBits = 65371; // Prime. + static const size_t kMapSizeInBitsAligned = 65536; // 2^16 + static const size_t kBitsInWord = (sizeof(uintptr_t) * 8); + static const size_t kMapSizeInWords = kMapSizeInBitsAligned / kBitsInWord; + + void Reset(); + inline void Update(uintptr_t Addr); + size_t MergeFrom(const PcCoverageMap &Other); + + uintptr_t Map[kMapSizeInWords] __attribute__((aligned(512))); +}; + +// Clears the current PC Map. +void PcMapResetCurrent(); +// Merges the current PC Map into the combined one, and clears the former. +size_t PcMapMergeInto(PcCoverageMap *Map); +} + +#endif diff --git a/gnu/llvm/lib/Fuzzer/FuzzerTraceState.cpp b/gnu/llvm/lib/Fuzzer/FuzzerTraceState.cpp index b2006fa3aa4..d6e1f79791f 100644 --- a/gnu/llvm/lib/Fuzzer/FuzzerTraceState.cpp +++ b/gnu/llvm/lib/Fuzzer/FuzzerTraceState.cpp @@ -41,8 +41,8 @@ // __dfsw_HOOK(a, b, label(a), label(b)) so that __dfsw_HOOK // gets all the taint labels for the arguments. // * At the Fuzzer startup we assign a unique DFSan label -// to every byte of the input string (Fuzzer::CurrentUnit) so that for any -// chunk of data we know which input bytes it has derived from. +// to every byte of the input string (Fuzzer::CurrentUnitData) so that +// for any chunk of data we know which input bytes it has derived from. // * The __dfsw_* functions (implemented in this file) record the // parameters (i.e. the application data and the corresponding taint labels) // in a global state. @@ -77,6 +77,7 @@ #include <cstring> #include <thread> #include <map> +#include <set> #if !LLVM_FUZZER_SUPPORTS_DFSAN // Stubs for dfsan for platforms where dfsan does not exist and weak @@ -164,24 +165,20 @@ struct LabelRange { // For now, very simple: put Size bytes of Data at position Pos. struct TraceBasedMutation { - static const size_t kMaxSize = 28; - uint32_t Pos : 24; - uint32_t Size : 8; - uint8_t Data[kMaxSize]; + uint32_t Pos; + Word W; }; -const size_t TraceBasedMutation::kMaxSize; +// Declared as static globals for faster checks inside the hooks. +static bool RecordingTraces = false; +static bool RecordingMemcmp = false; +static bool RecordingMemmem = false; class TraceState { - public: - TraceState(UserSuppliedFuzzer &USF, - const Fuzzer::FuzzingOptions &Options, const Unit &CurrentUnit) - : USF(USF), Options(Options), CurrentUnit(CurrentUnit) { - // Current trace collection is not thread-friendly and it probably - // does not have to be such, but at least we should not crash in presence - // of threads. So, just ignore all traces coming from all threads but one. - IsMyThread = true; - } +public: + TraceState(MutationDispatcher &MD, const FuzzingOptions &Options, + const Fuzzer *F) + : MD(MD), Options(Options), F(F) {} LabelRange GetLabelRange(dfsan_label L); void DFSanCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType, @@ -200,28 +197,33 @@ class TraceState { void TraceSwitchCallback(uintptr_t PC, size_t ValSizeInBits, uint64_t Val, size_t NumCases, uint64_t *Cases); int TryToAddDesiredData(uint64_t PresentData, uint64_t DesiredData, - size_t DataSize); + size_t DataSize); int TryToAddDesiredData(const uint8_t *PresentData, const uint8_t *DesiredData, size_t DataSize); void StartTraceRecording() { - if (!Options.UseTraces) return; - RecordingTraces = true; + if (!Options.UseTraces && !Options.UseMemcmp) + return; + RecordingTraces = Options.UseTraces; + RecordingMemcmp = Options.UseMemcmp; + RecordingMemmem = Options.UseMemmem; NumMutations = 0; - USF.GetMD().ClearAutoDictionary(); + InterestingWords.clear(); + MD.ClearAutoDictionary(); } void StopTraceRecording() { - if (!RecordingTraces) return; + if (!RecordingTraces && !RecordingMemcmp) + return; RecordingTraces = false; + RecordingMemcmp = false; for (size_t i = 0; i < NumMutations; i++) { auto &M = Mutations[i]; - Unit U(M.Data, M.Data + M.Size); if (Options.Verbosity >= 2) { - AutoDictUnitCounts[U]++; + AutoDictUnitCounts[M.W]++; AutoDictAdds++; if ((AutoDictAdds & (AutoDictAdds - 1)) == 0) { - typedef std::pair<size_t, Unit> CU; + typedef std::pair<size_t, Word> CU; std::vector<CU> CountedUnits; for (auto &I : AutoDictUnitCounts) CountedUnits.push_back(std::make_pair(I.second, I.first)); @@ -235,17 +237,17 @@ class TraceState { } } } - USF.GetMD().AddWordToAutoDictionary(U, M.Pos); + MD.AddWordToAutoDictionary({M.W, M.Pos}); } + for (auto &W : InterestingWords) + MD.AddWordToAutoDictionary({W}); } void AddMutation(uint32_t Pos, uint32_t Size, const uint8_t *Data) { if (NumMutations >= kMaxMutations) return; - assert(Size <= TraceBasedMutation::kMaxSize); auto &M = Mutations[NumMutations++]; M.Pos = Pos; - M.Size = Size; - memcpy(M.Data, Data, Size); + M.W.Set(Data, Size); } void AddMutation(uint32_t Pos, uint32_t Size, uint64_t Data) { @@ -253,26 +255,61 @@ class TraceState { AddMutation(Pos, Size, reinterpret_cast<uint8_t*>(&Data)); } + void AddInterestingWord(const uint8_t *Data, size_t Size) { + if (!RecordingMemmem || !F->InFuzzingThread()) return; + if (Size <= 1) return; + Size = std::min(Size, Word::GetMaxSize()); + Word W(Data, Size); + InterestingWords.insert(W); + } + + void EnsureDfsanLabels(size_t Size) { + for (; LastDfsanLabel < Size; LastDfsanLabel++) { + dfsan_label L = dfsan_create_label("input", (void *)(LastDfsanLabel + 1)); + // We assume that no one else has called dfsan_create_label before. + if (L != LastDfsanLabel + 1) { + Printf("DFSan labels are not starting from 1, exiting\n"); + exit(1); + } + } + } + private: bool IsTwoByteData(uint64_t Data) { int64_t Signed = static_cast<int64_t>(Data); Signed >>= 16; return Signed == 0 || Signed == -1L; } - bool RecordingTraces = false; + + // We don't want to create too many trace-based mutations as it is both + // expensive and useless. So after some number of mutations is collected, + // start rejecting some of them. The more there are mutations the more we + // reject. + bool WantToHandleOneMoreMutation() { + const size_t FirstN = 64; + // Gladly handle first N mutations. + if (NumMutations <= FirstN) return true; + size_t Diff = NumMutations - FirstN; + size_t DiffLog = sizeof(long) * 8 - __builtin_clzl((long)Diff); + assert(DiffLog > 0 && DiffLog < 64); + bool WantThisOne = MD.GetRand()(1 << DiffLog) == 0; // 1 out of DiffLog. + return WantThisOne; + } + static const size_t kMaxMutations = 1 << 16; size_t NumMutations; TraceBasedMutation Mutations[kMaxMutations]; + // TODO: std::set is too inefficient, need to have a custom DS here. + std::set<Word> InterestingWords; LabelRange LabelRanges[1 << (sizeof(dfsan_label) * 8)]; - UserSuppliedFuzzer &USF; - const Fuzzer::FuzzingOptions &Options; - const Unit &CurrentUnit; - std::map<Unit, size_t> AutoDictUnitCounts; + size_t LastDfsanLabel = 0; + MutationDispatcher &MD; + const FuzzingOptions Options; + const Fuzzer *F; + std::map<Word, size_t> AutoDictUnitCounts; size_t AutoDictAdds = 0; - static thread_local bool IsMyThread; }; -thread_local bool TraceState::IsMyThread; LabelRange TraceState::GetLabelRange(dfsan_label L) { LabelRange &LR = LabelRanges[L]; @@ -288,7 +325,7 @@ void TraceState::DFSanCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType, uint64_t Arg1, uint64_t Arg2, dfsan_label L1, dfsan_label L2) { assert(ReallyHaveDFSan()); - if (!RecordingTraces || !IsMyThread) return; + if (!RecordingTraces || !F->InFuzzingThread()) return; if (L1 == 0 && L2 == 0) return; // Not actionable. if (L1 != 0 && L2 != 0) @@ -303,7 +340,7 @@ void TraceState::DFSanCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType, AddMutation(Pos, CmpSize, Data - 1); } - if (CmpSize > LR.End - LR.Beg) + if (CmpSize > (size_t)(LR.End - LR.Beg)) AddMutation(LR.Beg, (unsigned)(LR.End - LR.Beg), Data); @@ -318,7 +355,7 @@ void TraceState::DFSanMemcmpCallback(size_t CmpSize, const uint8_t *Data1, dfsan_label L2) { assert(ReallyHaveDFSan()); - if (!RecordingTraces || !IsMyThread) return; + if (!RecordingMemcmp || !F->InFuzzingThread()) return; if (L1 == 0 && L2 == 0) return; // Not actionable. if (L1 != 0 && L2 != 0) @@ -337,7 +374,7 @@ void TraceState::DFSanSwitchCallback(uint64_t PC, size_t ValSizeInBits, uint64_t Val, size_t NumCases, uint64_t *Cases, dfsan_label L) { assert(ReallyHaveDFSan()); - if (!RecordingTraces || !IsMyThread) return; + if (!RecordingTraces || !F->InFuzzingThread()) return; if (!L) return; // Not actionable. LabelRange LR = GetLabelRange(L); size_t ValSize = ValSizeInBits / 8; @@ -362,15 +399,18 @@ void TraceState::DFSanSwitchCallback(uint64_t PC, size_t ValSizeInBits, int TraceState::TryToAddDesiredData(uint64_t PresentData, uint64_t DesiredData, size_t DataSize) { + if (NumMutations >= kMaxMutations || !WantToHandleOneMoreMutation()) return 0; + const uint8_t *UnitData; + auto UnitSize = F->GetCurrentUnitInFuzzingThead(&UnitData); int Res = 0; - const uint8_t *Beg = CurrentUnit.data(); - const uint8_t *End = Beg + CurrentUnit.size(); + const uint8_t *Beg = UnitData; + const uint8_t *End = Beg + UnitSize; for (const uint8_t *Cur = Beg; Cur < End; Cur++) { Cur = (uint8_t *)memmem(Cur, End - Cur, &PresentData, DataSize); if (!Cur) break; size_t Pos = Cur - Beg; - assert(Pos < CurrentUnit.size()); + assert(Pos < UnitSize); AddMutation(Pos, DataSize, DesiredData); AddMutation(Pos, DataSize, DesiredData + 1); AddMutation(Pos, DataSize, DesiredData - 1); @@ -382,15 +422,18 @@ int TraceState::TryToAddDesiredData(uint64_t PresentData, uint64_t DesiredData, int TraceState::TryToAddDesiredData(const uint8_t *PresentData, const uint8_t *DesiredData, size_t DataSize) { + if (NumMutations >= kMaxMutations || !WantToHandleOneMoreMutation()) return 0; + const uint8_t *UnitData; + auto UnitSize = F->GetCurrentUnitInFuzzingThead(&UnitData); int Res = 0; - const uint8_t *Beg = CurrentUnit.data(); - const uint8_t *End = Beg + CurrentUnit.size(); + const uint8_t *Beg = UnitData; + const uint8_t *End = Beg + UnitSize; for (const uint8_t *Cur = Beg; Cur < End; Cur++) { Cur = (uint8_t *)memmem(Cur, End - Cur, PresentData, DataSize); if (!Cur) break; size_t Pos = Cur - Beg; - assert(Pos < CurrentUnit.size()); + assert(Pos < UnitSize); AddMutation(Pos, DataSize, DesiredData); Res++; } @@ -399,7 +442,7 @@ int TraceState::TryToAddDesiredData(const uint8_t *PresentData, void TraceState::TraceCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType, uint64_t Arg1, uint64_t Arg2) { - if (!RecordingTraces || !IsMyThread) return; + if (!RecordingTraces || !F->InFuzzingThread()) return; if ((CmpType == ICMP_EQ || CmpType == ICMP_NE) && Arg1 == Arg2) return; // No reason to mutate. int Added = 0; @@ -415,8 +458,8 @@ void TraceState::TraceCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType, void TraceState::TraceMemcmpCallback(size_t CmpSize, const uint8_t *Data1, const uint8_t *Data2) { - if (!RecordingTraces || !IsMyThread) return; - CmpSize = std::min(CmpSize, TraceBasedMutation::kMaxSize); + if (!RecordingMemcmp || !F->InFuzzingThread()) return; + CmpSize = std::min(CmpSize, Word::GetMaxSize()); int Added2 = TryToAddDesiredData(Data1, Data2, CmpSize); int Added1 = TryToAddDesiredData(Data2, Data1, CmpSize); if ((Added1 || Added2) && Options.Verbosity >= 3) { @@ -430,7 +473,7 @@ void TraceState::TraceMemcmpCallback(size_t CmpSize, const uint8_t *Data1, void TraceState::TraceSwitchCallback(uintptr_t PC, size_t ValSizeInBits, uint64_t Val, size_t NumCases, uint64_t *Cases) { - if (!RecordingTraces || !IsMyThread) return; + if (!RecordingTraces || !F->InFuzzingThread()) return; size_t ValSize = ValSizeInBits / 8; bool TryShort = IsTwoByteData(Val); for (size_t i = 0; i < NumCases; i++) @@ -451,9 +494,6 @@ static TraceState *TS; void Fuzzer::StartTraceRecording() { if (!TS) return; - if (ReallyHaveDFSan()) - for (size_t i = 0; i < static_cast<size_t>(Options.MaxLen); i++) - dfsan_set_label(i + 1, &CurrentUnit[i], 1); TS->StartTraceRecording(); } @@ -462,20 +502,17 @@ void Fuzzer::StopTraceRecording() { TS->StopTraceRecording(); } -void Fuzzer::InitializeTraceState() { - if (!Options.UseTraces) return; - TS = new TraceState(USF, Options, CurrentUnit); - CurrentUnit.resize(Options.MaxLen); - // The rest really requires DFSan. +void Fuzzer::AssignTaintLabels(uint8_t *Data, size_t Size) { + if (!Options.UseTraces && !Options.UseMemcmp) return; if (!ReallyHaveDFSan()) return; - for (size_t i = 0; i < static_cast<size_t>(Options.MaxLen); i++) { - dfsan_label L = dfsan_create_label("input", (void*)(i + 1)); - // We assume that no one else has called dfsan_create_label before. - if (L != i + 1) { - Printf("DFSan labels are not starting from 1, exiting\n"); - exit(1); - } - } + TS->EnsureDfsanLabels(Size); + for (size_t i = 0; i < Size; i++) + dfsan_set_label(i + 1, &Data[i], 1); +} + +void Fuzzer::InitializeTraceState() { + if (!Options.UseTraces && !Options.UseMemcmp) return; + TS = new TraceState(MD, Options, this); } static size_t InternalStrnlen(const char *S, size_t MaxLen) { @@ -487,12 +524,14 @@ static size_t InternalStrnlen(const char *S, size_t MaxLen) { } // namespace fuzzer using fuzzer::TS; +using fuzzer::RecordingTraces; +using fuzzer::RecordingMemcmp; extern "C" { void __dfsw___sanitizer_cov_trace_cmp(uint64_t SizeAndType, uint64_t Arg1, uint64_t Arg2, dfsan_label L0, dfsan_label L1, dfsan_label L2) { - if (!TS) return; + if (!RecordingTraces) return; assert(L0 == 0); uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0)); uint64_t CmpSize = (SizeAndType >> 32) / 8; @@ -502,7 +541,7 @@ void __dfsw___sanitizer_cov_trace_cmp(uint64_t SizeAndType, uint64_t Arg1, void __dfsw___sanitizer_cov_trace_switch(uint64_t Val, uint64_t *Cases, dfsan_label L1, dfsan_label L2) { - if (!TS) return; + if (!RecordingTraces) return; uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0)); TS->DFSanSwitchCallback(PC, Cases[1], Val, Cases[0], Cases+2, L1); } @@ -510,7 +549,7 @@ void __dfsw___sanitizer_cov_trace_switch(uint64_t Val, uint64_t *Cases, void dfsan_weak_hook_memcmp(void *caller_pc, const void *s1, const void *s2, size_t n, dfsan_label s1_label, dfsan_label s2_label, dfsan_label n_label) { - if (!TS) return; + if (!RecordingMemcmp) return; dfsan_label L1 = dfsan_read_label(s1, n); dfsan_label L2 = dfsan_read_label(s2, n); TS->DFSanMemcmpCallback(n, reinterpret_cast<const uint8_t *>(s1), @@ -520,7 +559,7 @@ void dfsan_weak_hook_memcmp(void *caller_pc, const void *s1, const void *s2, void dfsan_weak_hook_strncmp(void *caller_pc, const char *s1, const char *s2, size_t n, dfsan_label s1_label, dfsan_label s2_label, dfsan_label n_label) { - if (!TS) return; + if (!RecordingMemcmp) return; n = std::min(n, fuzzer::InternalStrnlen(s1, n)); n = std::min(n, fuzzer::InternalStrnlen(s2, n)); dfsan_label L1 = dfsan_read_label(s1, n); @@ -531,7 +570,7 @@ void dfsan_weak_hook_strncmp(void *caller_pc, const char *s1, const char *s2, void dfsan_weak_hook_strcmp(void *caller_pc, const char *s1, const char *s2, dfsan_label s1_label, dfsan_label s2_label) { - if (!TS) return; + if (!RecordingMemcmp) return; size_t Len1 = strlen(s1); size_t Len2 = strlen(s2); size_t N = std::min(Len1, Len2); @@ -550,7 +589,7 @@ void dfsan_weak_hook_strcmp(void *caller_pc, const char *s1, const char *s2, #if LLVM_FUZZER_DEFINES_SANITIZER_WEAK_HOOOKS void __sanitizer_weak_hook_memcmp(void *caller_pc, const void *s1, const void *s2, size_t n, int result) { - if (!TS) return; + if (!RecordingMemcmp) return; if (result == 0) return; // No reason to mutate. if (n <= 1) return; // Not interesting. TS->TraceMemcmpCallback(n, reinterpret_cast<const uint8_t *>(s1), @@ -559,7 +598,7 @@ void __sanitizer_weak_hook_memcmp(void *caller_pc, const void *s1, void __sanitizer_weak_hook_strncmp(void *caller_pc, const char *s1, const char *s2, size_t n, int result) { - if (!TS) return; + if (!RecordingMemcmp) return; if (result == 0) return; // No reason to mutate. size_t Len1 = fuzzer::InternalStrnlen(s1, n); size_t Len2 = fuzzer::InternalStrnlen(s2, n); @@ -572,7 +611,7 @@ void __sanitizer_weak_hook_strncmp(void *caller_pc, const char *s1, void __sanitizer_weak_hook_strcmp(void *caller_pc, const char *s1, const char *s2, int result) { - if (!TS) return; + if (!RecordingMemcmp) return; if (result == 0) return; // No reason to mutate. size_t Len1 = strlen(s1); size_t Len2 = strlen(s2); @@ -582,12 +621,33 @@ void __sanitizer_weak_hook_strcmp(void *caller_pc, const char *s1, reinterpret_cast<const uint8_t *>(s2)); } +void __sanitizer_weak_hook_strncasecmp(void *called_pc, const char *s1, + const char *s2, size_t n, int result) { + return __sanitizer_weak_hook_strncmp(called_pc, s1, s2, n, result); +} +void __sanitizer_weak_hook_strcasecmp(void *called_pc, const char *s1, + const char *s2, int result) { + return __sanitizer_weak_hook_strcmp(called_pc, s1, s2, result); +} +void __sanitizer_weak_hook_strstr(void *called_pc, const char *s1, + const char *s2, char *result) { + TS->AddInterestingWord(reinterpret_cast<const uint8_t *>(s2), strlen(s2)); +} +void __sanitizer_weak_hook_strcasestr(void *called_pc, const char *s1, + const char *s2, char *result) { + TS->AddInterestingWord(reinterpret_cast<const uint8_t *>(s2), strlen(s2)); +} +void __sanitizer_weak_hook_memmem(void *called_pc, const void *s1, size_t len1, + const void *s2, size_t len2, void *result) { + // TODO: can't hook memmem since memmem is used by libFuzzer. +} + #endif // LLVM_FUZZER_DEFINES_SANITIZER_WEAK_HOOOKS __attribute__((visibility("default"))) void __sanitizer_cov_trace_cmp(uint64_t SizeAndType, uint64_t Arg1, uint64_t Arg2) { - if (!TS) return; + if (!RecordingTraces) return; uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0)); uint64_t CmpSize = (SizeAndType >> 32) / 8; uint64_t Type = (SizeAndType << 32) >> 32; @@ -596,7 +656,7 @@ void __sanitizer_cov_trace_cmp(uint64_t SizeAndType, uint64_t Arg1, __attribute__((visibility("default"))) void __sanitizer_cov_trace_switch(uint64_t Val, uint64_t *Cases) { - if (!TS) return; + if (!RecordingTraces) return; uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0)); TS->TraceSwitchCallback(PC, Cases[1], Val, Cases[0], Cases + 2); } diff --git a/gnu/llvm/lib/Fuzzer/FuzzerUtil.cpp b/gnu/llvm/lib/Fuzzer/FuzzerUtil.cpp index d7226cfce96..c2ae94c4d3d 100644 --- a/gnu/llvm/lib/Fuzzer/FuzzerUtil.cpp +++ b/gnu/llvm/lib/Fuzzer/FuzzerUtil.cpp @@ -12,21 +12,32 @@ #include "FuzzerInternal.h" #include <sstream> #include <iomanip> +#include <sys/resource.h> #include <sys/time.h> +#include <sys/types.h> +#include <sys/syscall.h> #include <cassert> +#include <chrono> #include <cstring> #include <signal.h> #include <sstream> #include <unistd.h> +#include <errno.h> +#include <thread> namespace fuzzer { -void Print(const Unit &v, const char *PrintAfter) { - for (auto x : v) - Printf("0x%x,", (unsigned) x); +void PrintHexArray(const uint8_t *Data, size_t Size, + const char *PrintAfter) { + for (size_t i = 0; i < Size; i++) + Printf("0x%x,", (unsigned)Data[i]); Printf("%s", PrintAfter); } +void Print(const Unit &v, const char *PrintAfter) { + PrintHexArray(v.data(), v.size(), PrintAfter); +} + void PrintASCIIByte(uint8_t Byte) { if (Byte == '\\') Printf("\\\\"); @@ -44,10 +55,12 @@ void PrintASCII(const uint8_t *Data, size_t Size, const char *PrintAfter) { Printf("%s", PrintAfter); } +void PrintASCII(const Word &W, const char *PrintAfter) { + PrintASCII(W.data(), W.size(), PrintAfter); +} + void PrintASCII(const Unit &U, const char *PrintAfter) { - for (auto X : U) - PrintASCIIByte(X); - Printf("%s", PrintAfter); + PrintASCII(U.data(), U.size(), PrintAfter); } std::string Hash(const Unit &U) { @@ -63,22 +76,73 @@ static void AlarmHandler(int, siginfo_t *, void *) { Fuzzer::StaticAlarmCallback(); } -void SetTimer(int Seconds) { - struct itimerval T {{Seconds, 0}, {Seconds, 0}}; - int Res = setitimer(ITIMER_REAL, &T, nullptr); - assert(Res == 0); +static void CrashHandler(int, siginfo_t *, void *) { + Fuzzer::StaticCrashSignalCallback(); +} + +static void InterruptHandler(int, siginfo_t *, void *) { + Fuzzer::StaticInterruptCallback(); +} + +static void SetSigaction(int signum, + void (*callback)(int, siginfo_t *, void *)) { struct sigaction sigact; memset(&sigact, 0, sizeof(sigact)); - sigact.sa_sigaction = AlarmHandler; - Res = sigaction(SIGALRM, &sigact, 0); - assert(Res == 0); + sigact.sa_sigaction = callback; + if (sigaction(signum, &sigact, 0)) { + Printf("libFuzzer: sigaction failed with %d\n", errno); + exit(1); + } } +void SetTimer(int Seconds) { + struct itimerval T {{Seconds, 0}, {Seconds, 0}}; + if (setitimer(ITIMER_REAL, &T, nullptr)) { + Printf("libFuzzer: setitimer failed with %d\n", errno); + exit(1); + } + SetSigaction(SIGALRM, AlarmHandler); +} + +void SetSigSegvHandler() { SetSigaction(SIGSEGV, CrashHandler); } +void SetSigBusHandler() { SetSigaction(SIGBUS, CrashHandler); } +void SetSigAbrtHandler() { SetSigaction(SIGABRT, CrashHandler); } +void SetSigIllHandler() { SetSigaction(SIGILL, CrashHandler); } +void SetSigFpeHandler() { SetSigaction(SIGFPE, CrashHandler); } +void SetSigIntHandler() { SetSigaction(SIGINT, InterruptHandler); } +void SetSigTermHandler() { SetSigaction(SIGTERM, InterruptHandler); } + int NumberOfCpuCores() { - FILE *F = popen("nproc", "r"); - int N = 0; - fscanf(F, "%d", &N); - fclose(F); + const char *CmdLine = nullptr; + if (LIBFUZZER_LINUX) { + CmdLine = "nproc"; + } else if (LIBFUZZER_APPLE) { + CmdLine = "sysctl -n hw.ncpu"; + } else { + assert(0 && "NumberOfCpuCores() is not implemented for your platform"); + } + + FILE *F = popen(CmdLine, "r"); + int N = 1; + if (!F || fscanf(F, "%d", &N) != 1) { + Printf("WARNING: Failed to parse output of command \"%s\" in %s(). " + "Assuming CPU count of 1.\n", + CmdLine, __func__); + N = 1; + } + + if (pclose(F)) { + Printf("WARNING: Executing command \"%s\" failed in %s(). " + "Assuming CPU count of 1.\n", + CmdLine, __func__); + N = 1; + } + if (N < 1) { + Printf("WARNING: Reported CPU count (%d) from command \"%s\" was invalid " + "in %s(). Assuming CPU count of 1.\n", + N, CmdLine, __func__); + N = 1; + } return N; } @@ -86,9 +150,10 @@ int ExecuteCommand(const std::string &Command) { return system(Command.c_str()); } -bool ToASCII(Unit &U) { +bool ToASCII(uint8_t *Data, size_t Size) { bool Changed = false; - for (auto &X : U) { + for (size_t i = 0; i < Size; i++) { + uint8_t &X = Data[i]; auto NewX = X; NewX &= 127; if (!isspace(NewX) && !isprint(NewX)) @@ -99,9 +164,11 @@ bool ToASCII(Unit &U) { return Changed; } -bool IsASCII(const Unit &U) { - for (auto X : U) - if (!(isprint(X) || isspace(X))) return false; +bool IsASCII(const Unit &U) { return IsASCII(U.data(), U.size()); } + +bool IsASCII(const uint8_t *Data, size_t Size) { + for (size_t i = 0; i < Size; i++) + if (!(isprint(Data[i]) || isspace(Data[i]))) return false; return true; } @@ -178,8 +245,11 @@ bool ParseDictionaryFile(const std::string &Text, std::vector<Unit> *Units) { return true; } -int GetPid() { return getpid(); } +void SleepSeconds(int Seconds) { + std::this_thread::sleep_for(std::chrono::seconds(Seconds)); +} +int GetPid() { return getpid(); } std::string Base64(const Unit &U) { static const char Table[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZ" @@ -209,4 +279,19 @@ std::string Base64(const Unit &U) { return Res; } +size_t GetPeakRSSMb() { + struct rusage usage; + if (getrusage(RUSAGE_SELF, &usage)) + return 0; + if (LIBFUZZER_LINUX) { + // ru_maxrss is in KiB + return usage.ru_maxrss >> 10; + } else if (LIBFUZZER_APPLE) { + // ru_maxrss is in bytes + return usage.ru_maxrss >> 20; + } + assert(0 && "GetPeakRSSMb() is not implemented for your platform"); + return 0; +} + } // namespace fuzzer diff --git a/gnu/llvm/lib/Fuzzer/afl/afl_driver.cpp b/gnu/llvm/lib/Fuzzer/afl/afl_driver.cpp new file mode 100644 index 00000000000..0f789981d74 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/afl/afl_driver.cpp @@ -0,0 +1,287 @@ +//===- afl_driver.cpp - a glue between AFL and libFuzzer --------*- C++ -* ===// +// +// The LLVM Compiler Infrastructure +// +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. +//===----------------------------------------------------------------------===// + +/* This file allows to fuzz libFuzzer-style target functions + (LLVMFuzzerTestOneInput) with AFL using AFL's persistent (in-process) mode. + +Usage: +################################################################################ +cat << EOF > test_fuzzer.cc +#include <stdint.h> +#include <stddef.h> +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + if (size > 0 && data[0] == 'H') + if (size > 1 && data[1] == 'I') + if (size > 2 && data[2] == '!') + __builtin_trap(); + return 0; +} +EOF +# Build your target with -fsanitize-coverage=trace-pc using fresh clang. +clang -g -fsanitize-coverage=trace-pc test_fuzzer.cc -c +# Build afl-llvm-rt.o.c from the AFL distribution. +clang -c -w $AFL_HOME/llvm_mode/afl-llvm-rt.o.c +# Build this file, link it with afl-llvm-rt.o.o and the target code. +clang++ afl_driver.cpp test_fuzzer.o afl-llvm-rt.o.o +# Run AFL: +rm -rf IN OUT; mkdir IN OUT; echo z > IN/z; +$AFL_HOME/afl-fuzz -i IN -o OUT ./a.out +################################################################################ +Environment Variables: +There are a few environment variables that can be set to use features that +afl-fuzz doesn't have. + +AFL_DRIVER_STDERR_DUPLICATE_FILENAME: Setting this *appends* stderr to the file +specified. If the file does not exist, it is created. This is useful for getting +stack traces (when using ASAN for example) or original error messages on hard to +reproduce bugs. + +AFL_DRIVER_EXTRA_STATS_FILENAME: Setting this causes afl_driver to write extra +statistics to the file specified. Currently these are peak_rss_mb +(the peak amount of virtual memory used in MB) and slowest_unit_time_secs. If +the file does not exist it is created. If the file does exist then +afl_driver assumes it was restarted by afl-fuzz and will try to read old +statistics from the file. If that fails then the process will quit. + +*/ +#include <assert.h> +#include <stdio.h> +#include <stdint.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> +#include <errno.h> +#include <signal.h> +#include <sys/resource.h> +#include <sys/time.h> +// Platform detection. Copied from FuzzerInternal.h +#ifdef __linux__ +#define LIBFUZZER_LINUX 1 +#define LIBFUZZER_APPLE 0 +#elif __APPLE__ +#define LIBFUZZER_LINUX 0 +#define LIBFUZZER_APPLE 1 +#else +#error "Support for your platform has not been implemented" +#endif + +// Used to avoid repeating error checking boilerplate. If cond is false, a +// fatal error has occured in the program. In this event print error_message +// to stderr and abort(). Otherwise do nothing. Note that setting +// AFL_DRIVER_STDERR_DUPLICATE_FILENAME may cause error_message to be appended +// to the file as well, if the error occurs after the duplication is performed. +#define CHECK_ERROR(cond, error_message) \ + if (!(cond)) { \ + fprintf(stderr, (error_message)); \ + abort(); \ + } + +// libFuzzer interface is thin, so we don't include any libFuzzer headers. +extern "C" { +int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size); +__attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv); +} + +// Notify AFL about persistent mode. +static volatile char AFL_PERSISTENT[] = "##SIG_AFL_PERSISTENT##"; +extern "C" int __afl_persistent_loop(unsigned int); +static volatile char suppress_warning2 = AFL_PERSISTENT[0]; + +// Notify AFL about deferred forkserver. +static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##"; +extern "C" void __afl_manual_init(); +static volatile char suppress_warning1 = AFL_DEFER_FORKSVR[0]; + +// Input buffer. +static const size_t kMaxAflInputSize = 1 << 20; +static uint8_t AflInputBuf[kMaxAflInputSize]; + +// Variables we need for writing to the extra stats file. +static FILE *extra_stats_file = NULL; +static uint32_t previous_peak_rss = 0; +static time_t slowest_unit_time_secs = 0; +static const int kNumExtraStats = 2; +static const char *kExtraStatsFormatString = "peak_rss_mb : %u\n" + "slowest_unit_time_sec : %u\n"; + +// Copied from FuzzerUtil.cpp. +size_t GetPeakRSSMb() { + struct rusage usage; + if (getrusage(RUSAGE_SELF, &usage)) + return 0; + if (LIBFUZZER_LINUX) { + // ru_maxrss is in KiB + return usage.ru_maxrss >> 10; + } else if (LIBFUZZER_APPLE) { + // ru_maxrss is in bytes + return usage.ru_maxrss >> 20; + } + assert(0 && "GetPeakRSSMb() is not implemented for your platform"); + return 0; +} + +// Based on SetSigaction in FuzzerUtil.cpp +static void SetSigaction(int signum, + void (*callback)(int, siginfo_t *, void *)) { + struct sigaction sigact; + memset(&sigact, 0, sizeof(sigact)); + sigact.sa_sigaction = callback; + if (sigaction(signum, &sigact, 0)) { + fprintf(stderr, "libFuzzer: sigaction failed with %d\n", errno); + exit(1); + } +} + +// Write extra stats to the file specified by the user. If none is specified +// this function will never be called. +static void write_extra_stats() { + uint32_t peak_rss = GetPeakRSSMb(); + + if (peak_rss < previous_peak_rss) + peak_rss = previous_peak_rss; + + int chars_printed = fprintf(extra_stats_file, kExtraStatsFormatString, + peak_rss, slowest_unit_time_secs); + + CHECK_ERROR(chars_printed != 0, "Failed to write extra_stats_file"); + + CHECK_ERROR(fclose(extra_stats_file) == 0, + "Failed to close extra_stats_file"); +} + +// Call write_extra_stats before we exit. +static void crash_handler(int, siginfo_t *, void *) { + // Make sure we don't try calling write_extra_stats again if we crashed while + // trying to call it. + static bool first_crash = true; + CHECK_ERROR(first_crash, + "Crashed in crash signal handler. This is a bug in the fuzzer."); + + first_crash = false; + write_extra_stats(); +} + +// If the user has specified an extra_stats_file through the environment +// variable AFL_DRIVER_EXTRA_STATS_FILENAME, then perform necessary set up +// to write stats to it on exit. If no file is specified, do nothing. Otherwise +// install signal and exit handlers to write to the file when the process exits. +// Then if the file doesn't exist create it and set extra stats to 0. But if it +// does exist then read the initial values of the extra stats from the file +// and check that the file is writable. +static void maybe_initialize_extra_stats() { + // If AFL_DRIVER_EXTRA_STATS_FILENAME isn't set then we have nothing to do. + char *extra_stats_filename = getenv("AFL_DRIVER_EXTRA_STATS_FILENAME"); + if (!extra_stats_filename) + return; + + // Open the file and find the previous peak_rss_mb value. + // This is necessary because the fuzzing process is restarted after N + // iterations are completed. So we may need to get this value from a previous + // process to be accurate. + extra_stats_file = fopen(extra_stats_filename, "r"); + + // If extra_stats_file already exists: read old stats from it. + if (extra_stats_file) { + int matches = fscanf(extra_stats_file, kExtraStatsFormatString, + &previous_peak_rss, &slowest_unit_time_secs); + + // Make sure we have read a real extra stats file and that we have used it + // to set slowest_unit_time_secs and previous_peak_rss. + CHECK_ERROR(matches == kNumExtraStats, "Extra stats file is corrupt"); + + CHECK_ERROR(fclose(extra_stats_file) == 0, "Failed to close file"); + + // Now open the file for writing. + extra_stats_file = fopen(extra_stats_filename, "w"); + CHECK_ERROR(extra_stats_file, + "Failed to open extra stats file for writing"); + } else { + // Looks like this is the first time in a fuzzing job this is being called. + extra_stats_file = fopen(extra_stats_filename, "w+"); + CHECK_ERROR(extra_stats_file, "failed to create extra stats file"); + } + + // Make sure that crash_handler gets called on any kind of fatal error. + int crash_signals[] = {SIGSEGV, SIGBUS, SIGABRT, SIGILL, SIGFPE, SIGINT, + SIGTERM}; + + const size_t num_signals = sizeof(crash_signals) / sizeof(crash_signals[0]); + + for (size_t idx = 0; idx < num_signals; idx++) + SetSigaction(crash_signals[idx], crash_handler); + + // Make sure it gets called on other kinds of exits. + atexit(write_extra_stats); +} + +// If the user asks us to duplicate stderr, then do it. +static void maybe_duplicate_stderr() { + char* stderr_duplicate_filename = + getenv("AFL_DRIVER_STDERR_DUPLICATE_FILENAME"); + + if (!stderr_duplicate_filename) + return; + + FILE* stderr_duplicate_stream = + freopen(stderr_duplicate_filename, "a+", stderr); + + if (!stderr_duplicate_stream) { + fprintf( + stderr, + "Failed to duplicate stderr to AFL_DRIVER_STDERR_DUPLICATE_FILENAME"); + abort(); + } +} + +int main(int argc, char **argv) { + fprintf(stderr, "Running in AFl-fuzz mode\nUsage:\n" + "afl-fuzz [afl-flags] %s [N] " + "-- run N fuzzing iterations before " + "re-spawning the process (default: 1000)\n", + argv[0]); + if (LLVMFuzzerInitialize) + LLVMFuzzerInitialize(&argc, &argv); + // Do any other expensive one-time initialization here. + + maybe_duplicate_stderr(); + maybe_initialize_extra_stats(); + + __afl_manual_init(); + + int N = 1000; + if (argc >= 2) + N = atoi(argv[1]); + assert(N > 0); + time_t unit_time_secs; + while (__afl_persistent_loop(N)) { + ssize_t n_read = read(0, AflInputBuf, kMaxAflInputSize); + if (n_read > 0) { + // Copy AflInputBuf into a separate buffer to let asan find buffer + // overflows. Don't use unique_ptr/etc to avoid extra dependencies. + uint8_t *copy = new uint8_t[n_read]; + memcpy(copy, AflInputBuf, n_read); + + struct timeval unit_start_time; + CHECK_ERROR(gettimeofday(&unit_start_time, NULL) == 0, + "Calling gettimeofday failed"); + + LLVMFuzzerTestOneInput(copy, n_read); + + struct timeval unit_stop_time; + CHECK_ERROR(gettimeofday(&unit_stop_time, NULL) == 0, + "Calling gettimeofday failed"); + + // Update slowest_unit_time_secs if we see a new max. + unit_time_secs = unit_stop_time.tv_sec - unit_start_time.tv_sec; + if (slowest_unit_time_secs < unit_time_secs) + slowest_unit_time_secs = unit_time_secs; + + delete[] copy; + } + } +} diff --git a/gnu/llvm/lib/Fuzzer/test/AFLDriverTest.cpp b/gnu/llvm/lib/Fuzzer/test/AFLDriverTest.cpp new file mode 100644 index 00000000000..3dd0b611730 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/AFLDriverTest.cpp @@ -0,0 +1,22 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + +// Contains dummy functions used to avoid dependency on AFL. +#include <stdint.h> +#include <stdlib.h> + +extern "C" void __afl_manual_init() {} + +extern "C" int __afl_persistent_loop(unsigned int) { + return 0; +} + +// This declaration exists to prevent the Darwin linker +// from complaining about this being a missing weak symbol. +extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv) { + return 0; +} + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + return 0; +} diff --git a/gnu/llvm/lib/Fuzzer/test/AccumulateAllocationsTest.cpp b/gnu/llvm/lib/Fuzzer/test/AccumulateAllocationsTest.cpp new file mode 100644 index 00000000000..604d8fa299a --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/AccumulateAllocationsTest.cpp @@ -0,0 +1,17 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + +// Test with a more mallocs than frees, but no leak. +#include <cstdint> +#include <cstddef> + +const int kAllocatedPointersSize = 10000; +int NumAllocatedPointers = 0; +int *AllocatedPointers[kAllocatedPointersSize]; + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + if (NumAllocatedPointers < kAllocatedPointersSize) + AllocatedPointers[NumAllocatedPointers++] = new int; + return 0; +} + diff --git a/gnu/llvm/lib/Fuzzer/test/BufferOverflowOnInput.cpp b/gnu/llvm/lib/Fuzzer/test/BufferOverflowOnInput.cpp new file mode 100644 index 00000000000..b9d14052aee --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/BufferOverflowOnInput.cpp @@ -0,0 +1,23 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + +// Simple test for a fuzzer. The fuzzer must find the string "Hi!". +#include <assert.h> +#include <cstdint> +#include <cstdlib> +#include <cstddef> +#include <iostream> + +static volatile bool SeedLargeBuffer; + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + assert(Data); + if (Size >= 4) + SeedLargeBuffer = true; + if (Size == 3 && SeedLargeBuffer && Data[3]) { + std::cout << "Woops, reading Data[3] w/o crashing\n"; + exit(1); + } + return 0; +} + diff --git a/gnu/llvm/lib/Fuzzer/test/CMakeLists.txt b/gnu/llvm/lib/Fuzzer/test/CMakeLists.txt index cd0b167eb38..cbc983e9e41 100644 --- a/gnu/llvm/lib/Fuzzer/test/CMakeLists.txt +++ b/gnu/llvm/lib/Fuzzer/test/CMakeLists.txt @@ -1,115 +1,190 @@ # Build all these tests with -O0, otherwise optimizations may merge some # basic blocks and we'll fail to discover the targets. -# Also enable the coverage instrumentation back (it is disabled -# for the Fuzzer lib) -set(CMAKE_CXX_FLAGS_RELEASE "${LIBFUZZER_FLAGS_BASE} -O0 -fsanitize-coverage=edge,indirect-calls") - -set(DFSanTests - MemcmpTest - SimpleCmpTest - StrcmpTest - StrncmpTest - SwitchTest +# We change the flags for every build type because we might be doing +# a multi-configuration build (e.g. Xcode) where CMAKE_BUILD_TYPE doesn't +# mean anything. +set(variables_to_filter + CMAKE_CXX_FLAGS_RELEASE + CMAKE_CXX_FLAGS_DEBUG + CMAKE_CXX_FLAGS_RELWITHDEBINFO + CMAKE_CXX_FLAGS_MINSIZEREL + LIBFUZZER_FLAGS_BASE ) +foreach (VARNAME ${variables_to_filter}) + string(REPLACE " " ";" BUILD_FLAGS_AS_LIST "${${VARNAME}}") + set(new_flags "") + foreach (flag ${BUILD_FLAGS_AS_LIST}) + # NOTE: Use of XX here is to avoid a CMake warning due to CMP0054 + if (NOT ("XX${flag}" MATCHES "XX-O[0123s]")) + set(new_flags "${new_flags} ${flag}") + else() + set(new_flags "${new_flags} -O0") + endif() + endforeach() + set(${VARNAME} "${new_flags}") +endforeach() + +# Enable the coverage instrumentation (it is disabled for the Fuzzer lib). +set(CMAKE_CXX_FLAGS "${LIBFUZZER_FLAGS_BASE} -fsanitize-coverage=edge,indirect-calls") + +# add_libfuzzer_test(<name> +# SOURCES source0.cpp [source1.cpp ...] +# ) +# +# Declares a LibFuzzer test executable with target name LLVMFuzzer-<name>. +# +# One or more source files to be compiled into the binary must be declared +# after the SOURCES keyword. +function(add_libfuzzer_test name) + set(multi_arg_options "SOURCES") + cmake_parse_arguments( + "add_libfuzzer_test" "" "" "${multi_arg_options}" ${ARGN}) + if ("${add_libfuzzer_test_SOURCES}" STREQUAL "") + message(FATAL_ERROR "Source files must be specified") + endif() + add_executable(LLVMFuzzer-${name} + ${add_libfuzzer_test_SOURCES} + ) + target_link_libraries(LLVMFuzzer-${name} LLVMFuzzer) + # Place binary where llvm-lit expects to find it + set_target_properties(LLVMFuzzer-${name} + PROPERTIES RUNTIME_OUTPUT_DIRECTORY + "${CMAKE_BINARY_DIR}/lib/Fuzzer/test" + ) + set(TestBinaries ${TestBinaries} LLVMFuzzer-${name} PARENT_SCOPE) +endfunction() + +# Variable to keep track of all test targets +set(TestBinaries) + +############################################################################### +# Basic tests +############################################################################### set(Tests + AccumulateAllocationsTest + BufferOverflowOnInput CallerCalleeTest CounterTest + CustomCrossOverTest + CustomMutatorTest + EmptyTest FourIndependentBranchesTest FullCoverageSetTest + InitializeTest MemcmpTest + LeakTest + LeakTimeoutTest NullDerefTest + NullDerefOnEmptyTest + NthRunCrashTest + OneHugeAllocTest + OutOfMemoryTest + RepeatedMemcmp SimpleCmpTest SimpleDictionaryTest + SimpleFnAdapterTest SimpleHashTest SimpleTest + SimpleThreadedTest + SpamyTest StrcmpTest StrncmpTest + StrstrTest SwitchTest + ThreadedLeakTest ThreadedTest TimeoutTest ) -set(CustomMainTests - UserSuppliedFuzzerTest - ) - -set(UninstrumentedTests - UninstrumentedTest - ) - -set(TraceBBTests - SimpleTest - ) - -set(TestBinaries) +if(APPLE) + # LeakSanitizer is not supported on OSX right now + set(HAS_LSAN 0) + message(WARNING "LeakSanitizer is not supported on Apple platforms." + " Building and running LibFuzzer LeakSanitizer tests is disabled." + ) +else() + set(HAS_LSAN 1) +endif() foreach(Test ${Tests}) - add_executable(LLVMFuzzer-${Test} - ${Test}.cpp - ) - target_link_libraries(LLVMFuzzer-${Test} - LLVMFuzzer - ) - set(TestBinaries ${TestBinaries} LLVMFuzzer-${Test}) + add_libfuzzer_test(${Test} SOURCES ${Test}.cpp) endforeach() -foreach(Test ${CustomMainTests}) - add_executable(LLVMFuzzer-${Test} - ${Test}.cpp - ) - target_link_libraries(LLVMFuzzer-${Test} - LLVMFuzzerNoMain - ) - set(TestBinaries ${TestBinaries} LLVMFuzzer-${Test}) -endforeach() +############################################################################### +# AFL Driver test +############################################################################### +add_executable(AFLDriverTest + AFLDriverTest.cpp ../afl/afl_driver.cpp) -configure_lit_site_cfg( - ${CMAKE_CURRENT_SOURCE_DIR}/lit.site.cfg.in - ${CMAKE_CURRENT_BINARY_DIR}/lit.site.cfg - ) - -configure_lit_site_cfg( - ${CMAKE_CURRENT_SOURCE_DIR}/unit/lit.site.cfg.in - ${CMAKE_CURRENT_BINARY_DIR}/unit/lit.site.cfg - ) +set_target_properties(AFLDriverTest + PROPERTIES RUNTIME_OUTPUT_DIRECTORY + "${CMAKE_BINARY_DIR}/lib/Fuzzer/test" + ) +set(TestBinaries ${TestBinaries} AFLDriverTest) -include_directories(..) -include_directories(${LLVM_MAIN_SRC_DIR}/utils/unittest/googletest/include) +############################################################################### +# Unit tests +############################################################################### add_executable(LLVMFuzzer-Unittest FuzzerUnittest.cpp - $<TARGET_OBJECTS:LLVMFuzzerNoMainObjects> + FuzzerFnAdapterUnittest.cpp ) target_link_libraries(LLVMFuzzer-Unittest gtest gtest_main + LLVMFuzzerNoMain + ) + +target_include_directories(LLVMFuzzer-Unittest PRIVATE + "${LLVM_MAIN_SRC_DIR}/utils/unittest/googletest/include" ) set(TestBinaries ${TestBinaries} LLVMFuzzer-Unittest) +set_target_properties(LLVMFuzzer-Unittest + PROPERTIES RUNTIME_OUTPUT_DIRECTORY + "${CMAKE_CURRENT_BINARY_DIR}" +) +############################################################################### +# Additional tests +############################################################################### -add_subdirectory(dfsan) +include_directories(..) -foreach(Test ${DFSanTests}) - set(TestBinaries ${TestBinaries} LLVMFuzzer-${Test}-DFSan) -endforeach() +if(APPLE) + message(WARNING "DataflowSanitizer is not supported on Apple platforms." + " Building and running LibFuzzer DataflowSanitizer tests is disabled." + ) + set(HAS_DFSAN 0) +else() + set(HAS_DFSAN 1) + add_subdirectory(dfsan) +endif() add_subdirectory(uninstrumented) - -foreach(Test ${UninstrumentedTests}) - set(TestBinaries ${TestBinaries} LLVMFuzzer-${Test}-Uninstrumented) -endforeach() - +add_subdirectory(no-coverage) +add_subdirectory(ubsan) add_subdirectory(trace-bb) +add_subdirectory(trace-pc) -foreach(Test ${TraceBBTests}) - set(TestBinaries ${TestBinaries} LLVMFuzzer-${Test}-TraceBB) -endforeach() +############################################################################### +# Configure lit to run the tests +# +# Note this is done after declaring all tests so we can inform lit if any tests +# need to be disabled. +############################################################################### -set_target_properties(${TestBinaries} - PROPERTIES RUNTIME_OUTPUT_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR} +configure_lit_site_cfg( + ${CMAKE_CURRENT_SOURCE_DIR}/lit.site.cfg.in + ${CMAKE_CURRENT_BINARY_DIR}/lit.site.cfg + ) + +configure_lit_site_cfg( + ${CMAKE_CURRENT_SOURCE_DIR}/unit/lit.site.cfg.in + ${CMAKE_CURRENT_BINARY_DIR}/unit/lit.site.cfg ) add_lit_testsuite(check-fuzzer "Running Fuzzer tests" diff --git a/gnu/llvm/lib/Fuzzer/test/CallerCalleeTest.cpp b/gnu/llvm/lib/Fuzzer/test/CallerCalleeTest.cpp index 150b2fc0405..3ec025d0230 100644 --- a/gnu/llvm/lib/Fuzzer/test/CallerCalleeTest.cpp +++ b/gnu/llvm/lib/Fuzzer/test/CallerCalleeTest.cpp @@ -1,3 +1,6 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + // Simple test for a fuzzer. // Try to find the target using the indirect caller-callee pairs. #include <cstdint> diff --git a/gnu/llvm/lib/Fuzzer/test/CounterTest.cpp b/gnu/llvm/lib/Fuzzer/test/CounterTest.cpp index b61f419c499..4917934c62e 100644 --- a/gnu/llvm/lib/Fuzzer/test/CounterTest.cpp +++ b/gnu/llvm/lib/Fuzzer/test/CounterTest.cpp @@ -1,3 +1,6 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + // Test for a fuzzer: must find the case where a particular basic block is // executed many times. #include <iostream> diff --git a/gnu/llvm/lib/Fuzzer/test/CustomCrossOverTest.cpp b/gnu/llvm/lib/Fuzzer/test/CustomCrossOverTest.cpp new file mode 100644 index 00000000000..2ab5781155f --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/CustomCrossOverTest.cpp @@ -0,0 +1,57 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + +// Simple test for a cutom mutator. +#include <assert.h> +#include <cstddef> +#include <cstdint> +#include <cstdlib> +#include <iostream> +#include <random> +#include <string.h> + +#include "FuzzerInterface.h" + +static const char *Separator = "-_^_-"; +static const char *Target = "012-_^_-abc"; + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + assert(Data); + std::string Str(reinterpret_cast<const char *>(Data), Size); + + if (Str.find(Target) != std::string::npos) { + std::cout << "BINGO; Found the target, exiting\n"; + exit(1); + } + return 0; +} + +extern "C" size_t LLVMFuzzerCustomCrossOver(const uint8_t *Data1, size_t Size1, + const uint8_t *Data2, size_t Size2, + uint8_t *Out, size_t MaxOutSize, + unsigned int Seed) { + static bool Printed; + static size_t SeparatorLen = strlen(Separator); + + if (!Printed) { + std::cerr << "In LLVMFuzzerCustomCrossover\n"; + Printed = true; + } + + std::mt19937 R(Seed); + + size_t Offset1 = 0; + size_t Len1 = R() % (Size1 - Offset1); + size_t Offset2 = 0; + size_t Len2 = R() % (Size2 - Offset2); + size_t Size = Len1 + Len2 + SeparatorLen; + + if (Size > MaxOutSize) + return 0; + + memcpy(Out, Data1 + Offset1, Len1); + memcpy(Out + Len1, Separator, SeparatorLen); + memcpy(Out + Len1 + SeparatorLen, Data2 + Offset2, Len2); + + return Len1 + Len2 + SeparatorLen; +} diff --git a/gnu/llvm/lib/Fuzzer/test/CustomMutatorTest.cpp b/gnu/llvm/lib/Fuzzer/test/CustomMutatorTest.cpp new file mode 100644 index 00000000000..4f84519a90e --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/CustomMutatorTest.cpp @@ -0,0 +1,38 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + +// Simple test for a cutom mutator. +#include <assert.h> +#include <cstdint> +#include <cstdlib> +#include <cstddef> +#include <iostream> + +#include "FuzzerInterface.h" + +static volatile int Sink; + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + assert(Data); + if (Size > 0 && Data[0] == 'H') { + Sink = 1; + if (Size > 1 && Data[1] == 'i') { + Sink = 2; + if (Size > 2 && Data[2] == '!') { + std::cout << "BINGO; Found the target, exiting\n"; + exit(1); + } + } + } + return 0; +} + +extern "C" size_t LLVMFuzzerCustomMutator(uint8_t *Data, size_t Size, + size_t MaxSize, unsigned int Seed) { + static bool Printed; + if (!Printed) { + std::cerr << "In LLVMFuzzerCustomMutator\n"; + Printed = true; + } + return LLVMFuzzerMutate(Data, Size, MaxSize); +} diff --git a/gnu/llvm/lib/Fuzzer/test/EmptyTest.cpp b/gnu/llvm/lib/Fuzzer/test/EmptyTest.cpp new file mode 100644 index 00000000000..5e843308fa5 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/EmptyTest.cpp @@ -0,0 +1,11 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. +// +// A fuzzer with empty target function. + +#include <cstdint> +#include <cstdlib> + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + return 0; +} diff --git a/gnu/llvm/lib/Fuzzer/test/FourIndependentBranchesTest.cpp b/gnu/llvm/lib/Fuzzer/test/FourIndependentBranchesTest.cpp index 6007dd4a027..62b3be76e3a 100644 --- a/gnu/llvm/lib/Fuzzer/test/FourIndependentBranchesTest.cpp +++ b/gnu/llvm/lib/Fuzzer/test/FourIndependentBranchesTest.cpp @@ -1,3 +1,6 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + // Simple test for a fuzzer. The fuzzer must find the string "FUZZ". #include <cstdint> #include <cstdlib> diff --git a/gnu/llvm/lib/Fuzzer/test/FullCoverageSetTest.cpp b/gnu/llvm/lib/Fuzzer/test/FullCoverageSetTest.cpp index a868084a0ce..415e0b4760c 100644 --- a/gnu/llvm/lib/Fuzzer/test/FullCoverageSetTest.cpp +++ b/gnu/llvm/lib/Fuzzer/test/FullCoverageSetTest.cpp @@ -1,3 +1,6 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + // Simple test for a fuzzer. The fuzzer must find the string "FUZZER". #include <cstdint> #include <cstdlib> diff --git a/gnu/llvm/lib/Fuzzer/test/FuzzerFnAdapterUnittest.cpp b/gnu/llvm/lib/Fuzzer/test/FuzzerFnAdapterUnittest.cpp new file mode 100644 index 00000000000..11be18096bc --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/FuzzerFnAdapterUnittest.cpp @@ -0,0 +1,110 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + +#include "FuzzerFnAdapter.h" +#include "gtest/gtest-spi.h" +#include "gtest/gtest.h" + +namespace fuzzer { +namespace impl { + +template <typename... Args> +bool Unpack(std::tuple<Args...> *Tuple, std::initializer_list<uint8_t> data) { + std::vector<uint8_t> V(data); + return Unpack(V.data(), V.size(), Tuple); +} + +TEST(Unpack, Bool) { + std::tuple<bool> T; + EXPECT_TRUE(Unpack(&T, {1})); + EXPECT_TRUE(std::get<0>(T)); + + EXPECT_TRUE(Unpack(&T, {0})); + EXPECT_FALSE(std::get<0>(T)); + + EXPECT_FALSE(Unpack(&T, {})); +} + +TEST(Unpack, BoolBool) { + std::tuple<bool, bool> T; + EXPECT_TRUE(Unpack(&T, {1, 0})); + EXPECT_TRUE(std::get<0>(T)); + EXPECT_FALSE(std::get<1>(T)); + + EXPECT_TRUE(Unpack(&T, {0, 1})); + EXPECT_FALSE(std::get<0>(T)); + EXPECT_TRUE(std::get<1>(T)); + + EXPECT_FALSE(Unpack(&T, {})); + EXPECT_FALSE(Unpack(&T, {10})); +} + +TEST(Unpack, BoolInt) { + std::tuple<bool, int> T; + EXPECT_TRUE(Unpack(&T, {1, 16, 2, 0, 0})); + EXPECT_TRUE(std::get<0>(T)); + EXPECT_EQ(528, std::get<1>(T)); + + EXPECT_FALSE(Unpack(&T, {1, 2})); +} + +TEST(Unpack, Vector) { + std::tuple<std::vector<uint8_t>> T; + const auto &V = std::get<0>(T); + + EXPECT_FALSE(Unpack(&T, {})); + + EXPECT_TRUE(Unpack(&T, {0})); + EXPECT_EQ(0ul, V.size()); + + EXPECT_TRUE(Unpack(&T, {0, 1, 2, 3})); + EXPECT_EQ(0ul, V.size()); + + EXPECT_TRUE(Unpack(&T, {2})); + EXPECT_EQ(0ul, V.size()); + + EXPECT_TRUE(Unpack(&T, {2, 3})); + EXPECT_EQ(1ul, V.size()); + EXPECT_EQ(3, V[0]); + + EXPECT_TRUE(Unpack(&T, {2, 9, 8})); + EXPECT_EQ(2ul, V.size()); + EXPECT_EQ(9, V[0]); + EXPECT_EQ(8, V[1]); +} + +TEST(Unpack, String) { + std::tuple<std::string> T; + const auto &S = std::get<0>(T); + + EXPECT_TRUE(Unpack(&T, {2, 3})); + EXPECT_EQ(1ul, S.size()); + EXPECT_EQ(3, S[0]); +} + +template <typename Fn> +bool UnpackAndApply(Fn F, std::initializer_list<uint8_t> Data) { + std::vector<uint8_t> V(Data); + return UnpackAndApply(F, V.data(), V.size()); +} + +static void fnBool(bool b) { EXPECT_TRUE(b); } + +TEST(Apply, Bool) { + EXPECT_FALSE(UnpackAndApply(fnBool, {})); + EXPECT_TRUE(UnpackAndApply(fnBool, {1})); + EXPECT_NONFATAL_FAILURE(UnpackAndApply(fnBool, {0}), + "Actual: false\nExpected: true"); +} + +static void fnInt(int i) { EXPECT_EQ(42, i); } + +TEST(Apply, Int) { + EXPECT_FALSE(UnpackAndApply(fnInt, {})); + EXPECT_TRUE(UnpackAndApply(fnInt, {42, 0, 0, 0})); + EXPECT_NONFATAL_FAILURE(UnpackAndApply(fnInt, {10, 0, 0, 0}), + "Actual: 10\nExpected: 42"); +} + +} // namespace impl +} // namespace fuzzer diff --git a/gnu/llvm/lib/Fuzzer/test/FuzzerUnittest.cpp b/gnu/llvm/lib/Fuzzer/test/FuzzerUnittest.cpp index b33e0c96145..3fd87e5b9e0 100644 --- a/gnu/llvm/lib/Fuzzer/test/FuzzerUnittest.cpp +++ b/gnu/llvm/lib/Fuzzer/test/FuzzerUnittest.cpp @@ -1,18 +1,28 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + +// Avoid ODR violations (LibFuzzer is built without ASan and this test is built +// with ASan) involving C++ standard library types when using libcxx. +#define _LIBCPP_HAS_NO_ASAN + #include "FuzzerInternal.h" #include "gtest/gtest.h" +#include <memory> #include <set> using namespace fuzzer; // For now, have LLVMFuzzerTestOneInput just to make it link. // Later we may want to make unittests that actually call LLVMFuzzerTestOneInput. -extern "C" void LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { abort(); } TEST(Fuzzer, CrossOver) { - FuzzerRandomLibc Rand(0); - MutationDispatcher MD(Rand); + std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); + fuzzer::EF = t.get(); + Random Rand(0); + MutationDispatcher MD(Rand, {}); Unit A({0, 1, 2}), B({5, 6, 7}); Unit C; Unit Expected[] = { @@ -79,6 +89,8 @@ typedef size_t (MutationDispatcher::*Mutator)(uint8_t *Data, size_t Size, size_t MaxSize); void TestEraseByte(Mutator M, int NumIter) { + std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); + fuzzer::EF = t.get(); uint8_t REM0[8] = {0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; uint8_t REM1[8] = {0x00, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; uint8_t REM2[8] = {0x00, 0x11, 0x33, 0x44, 0x55, 0x66, 0x77}; @@ -87,8 +99,8 @@ void TestEraseByte(Mutator M, int NumIter) { uint8_t REM5[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x66, 0x77}; uint8_t REM6[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x77}; uint8_t REM7[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66}; - FuzzerRandomLibc Rand(0); - MutationDispatcher MD(Rand); + Random Rand(0); + MutationDispatcher MD(Rand, {}); int FoundMask = 0; for (int i = 0; i < NumIter; i++) { uint8_t T[8] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; @@ -113,8 +125,10 @@ TEST(FuzzerMutate, EraseByte2) { } void TestInsertByte(Mutator M, int NumIter) { - FuzzerRandomLibc Rand(0); - MutationDispatcher MD(Rand); + std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); + fuzzer::EF = t.get(); + Random Rand(0); + MutationDispatcher MD(Rand, {}); int FoundMask = 0; uint8_t INS0[8] = {0xF1, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66}; uint8_t INS1[8] = {0x00, 0xF2, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66}; @@ -147,8 +161,10 @@ TEST(FuzzerMutate, InsertByte2) { } void TestChangeByte(Mutator M, int NumIter) { - FuzzerRandomLibc Rand(0); - MutationDispatcher MD(Rand); + std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); + fuzzer::EF = t.get(); + Random Rand(0); + MutationDispatcher MD(Rand, {}); int FoundMask = 0; uint8_t CH0[8] = {0xF0, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; uint8_t CH1[8] = {0x00, 0xF1, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; @@ -181,8 +197,10 @@ TEST(FuzzerMutate, ChangeByte2) { } void TestChangeBit(Mutator M, int NumIter) { - FuzzerRandomLibc Rand(0); - MutationDispatcher MD(Rand); + std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); + fuzzer::EF = t.get(); + Random Rand(0); + MutationDispatcher MD(Rand, {}); int FoundMask = 0; uint8_t CH0[8] = {0x01, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; uint8_t CH1[8] = {0x00, 0x13, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77}; @@ -215,8 +233,10 @@ TEST(FuzzerMutate, ChangeBit2) { } void TestShuffleBytes(Mutator M, int NumIter) { - FuzzerRandomLibc Rand(0); - MutationDispatcher MD(Rand); + std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); + fuzzer::EF = t.get(); + Random Rand(0); + MutationDispatcher MD(Rand, {}); int FoundMask = 0; uint8_t CH0[7] = {0x00, 0x22, 0x11, 0x33, 0x44, 0x55, 0x66}; uint8_t CH1[7] = {0x11, 0x00, 0x33, 0x22, 0x44, 0x55, 0x66}; @@ -236,19 +256,21 @@ void TestShuffleBytes(Mutator M, int NumIter) { } TEST(FuzzerMutate, ShuffleBytes1) { - TestShuffleBytes(&MutationDispatcher::Mutate_ShuffleBytes, 1 << 15); + TestShuffleBytes(&MutationDispatcher::Mutate_ShuffleBytes, 1 << 16); } TEST(FuzzerMutate, ShuffleBytes2) { - TestShuffleBytes(&MutationDispatcher::Mutate, 1 << 19); + TestShuffleBytes(&MutationDispatcher::Mutate, 1 << 20); } void TestAddWordFromDictionary(Mutator M, int NumIter) { - FuzzerRandomLibc Rand(0); - MutationDispatcher MD(Rand); + std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); + fuzzer::EF = t.get(); + Random Rand(0); + MutationDispatcher MD(Rand, {}); uint8_t Word1[4] = {0xAA, 0xBB, 0xCC, 0xDD}; uint8_t Word2[3] = {0xFF, 0xEE, 0xEF}; - MD.AddWordToManualDictionary(Unit(Word1, Word1 + sizeof(Word1))); - MD.AddWordToManualDictionary(Unit(Word2, Word2 + sizeof(Word2))); + MD.AddWordToManualDictionary(Word(Word1, sizeof(Word1))); + MD.AddWordToManualDictionary(Word(Word2, sizeof(Word2))); int FoundMask = 0; uint8_t CH0[7] = {0x00, 0x11, 0x22, 0xAA, 0xBB, 0xCC, 0xDD}; uint8_t CH1[7] = {0x00, 0x11, 0xAA, 0xBB, 0xCC, 0xDD, 0x22}; @@ -283,18 +305,20 @@ TEST(FuzzerMutate, AddWordFromDictionary2) { } void TestAddWordFromDictionaryWithHint(Mutator M, int NumIter) { - FuzzerRandomLibc Rand(0); - MutationDispatcher MD(Rand); - uint8_t Word[] = {0xAA, 0xBB, 0xCC, 0xDD, 0xFF, 0xEE, 0xEF}; + std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); + fuzzer::EF = t.get(); + Random Rand(0); + MutationDispatcher MD(Rand, {}); + uint8_t W[] = {0xAA, 0xBB, 0xCC, 0xDD, 0xFF, 0xEE, 0xEF}; size_t PosHint = 7777; - MD.AddWordToAutoDictionary(Unit(Word, Word + sizeof(Word)), PosHint); + MD.AddWordToAutoDictionary({Word(W, sizeof(W)), PosHint}); int FoundMask = 0; for (int i = 0; i < NumIter; i++) { uint8_t T[10000]; memset(T, 0, sizeof(T)); size_t NewSize = (MD.*M)(T, 9000, 10000); - if (NewSize >= PosHint + sizeof(Word) && - !memcmp(Word, T + PosHint, sizeof(Word))) + if (NewSize >= PosHint + sizeof(W) && + !memcmp(W, T + PosHint, sizeof(W))) FoundMask = 1; } EXPECT_EQ(FoundMask, 1); @@ -302,7 +326,7 @@ void TestAddWordFromDictionaryWithHint(Mutator M, int NumIter) { TEST(FuzzerMutate, AddWordFromDictionaryWithHint1) { TestAddWordFromDictionaryWithHint( - &MutationDispatcher::Mutate_AddWordFromAutoDictionary, 1 << 5); + &MutationDispatcher::Mutate_AddWordFromTemporaryAutoDictionary, 1 << 5); } TEST(FuzzerMutate, AddWordFromDictionaryWithHint2) { @@ -310,8 +334,10 @@ TEST(FuzzerMutate, AddWordFromDictionaryWithHint2) { } void TestChangeASCIIInteger(Mutator M, int NumIter) { - FuzzerRandomLibc Rand(0); - MutationDispatcher MD(Rand); + std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); + fuzzer::EF = t.get(); + Random Rand(0); + MutationDispatcher MD(Rand, {}); uint8_t CH0[8] = {'1', '2', '3', '4', '5', '6', '7', '7'}; uint8_t CH1[8] = {'1', '2', '3', '4', '5', '6', '7', '9'}; @@ -400,3 +426,24 @@ TEST(FuzzerUtil, Base64) { EXPECT_EQ("YWJjeHk=", Base64({'a', 'b', 'c', 'x', 'y'})); EXPECT_EQ("YWJjeHl6", Base64({'a', 'b', 'c', 'x', 'y', 'z'})); } + +TEST(Corpus, Distribution) { + std::unique_ptr<ExternalFunctions> t(new ExternalFunctions()); + fuzzer::EF = t.get(); + Random Rand(0); + MutationDispatcher MD(Rand, {}); + Fuzzer Fuzz(LLVMFuzzerTestOneInput, MD, {}); + size_t N = 10; + size_t TriesPerUnit = 1<<20; + for (size_t i = 0; i < N; i++) { + Fuzz.AddToCorpus(Unit{ static_cast<uint8_t>(i) }); + } + std::vector<size_t> Hist(N); + for (size_t i = 0; i < N * TriesPerUnit; i++) { + Hist[Fuzz.ChooseUnitIdxToMutate()]++; + } + for (size_t i = 0; i < N; i++) { + // A weak sanity check that every unit gets invoked. + EXPECT_GT(Hist[i], TriesPerUnit / N / 3); + } +} diff --git a/gnu/llvm/lib/Fuzzer/test/InitializeTest.cpp b/gnu/llvm/lib/Fuzzer/test/InitializeTest.cpp new file mode 100644 index 00000000000..d40ff2f7936 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/InitializeTest.cpp @@ -0,0 +1,26 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + +// Make sure LLVMFuzzerInitialize is called. +#include <assert.h> +#include <stddef.h> +#include <stdint.h> +#include <stdio.h> +#include <stdlib.h> +#include <string.h> + +static char *argv0; + +extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv) { + assert(argc > 0); + argv0 = **argv; + return 0; +} + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + if (strncmp(reinterpret_cast<const char*>(Data), argv0, Size)) { + fprintf(stderr, "BINGO\n"); + exit(1); + } + return 0; +} diff --git a/gnu/llvm/lib/Fuzzer/test/LeakTest.cpp b/gnu/llvm/lib/Fuzzer/test/LeakTest.cpp new file mode 100644 index 00000000000..22e5164050e --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/LeakTest.cpp @@ -0,0 +1,17 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + +// Test with a leak. +#include <cstdint> +#include <cstddef> + +static volatile void *Sink; + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + if (Size > 0 && *Data == 'H') { + Sink = new int; + Sink = nullptr; + } + return 0; +} + diff --git a/gnu/llvm/lib/Fuzzer/test/LeakTimeoutTest.cpp b/gnu/llvm/lib/Fuzzer/test/LeakTimeoutTest.cpp new file mode 100644 index 00000000000..4f31b3e52c1 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/LeakTimeoutTest.cpp @@ -0,0 +1,17 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + +// Test with a leak. +#include <cstdint> +#include <cstddef> + +static volatile int *Sink; + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + if (!Size) return 0; + Sink = new int; + Sink = new int; + while (Sink) *Sink = 0; // Infinite loop. + return 0; +} + diff --git a/gnu/llvm/lib/Fuzzer/test/MemcmpTest.cpp b/gnu/llvm/lib/Fuzzer/test/MemcmpTest.cpp index c19c95717bb..fdbf94683f7 100644 --- a/gnu/llvm/lib/Fuzzer/test/MemcmpTest.cpp +++ b/gnu/llvm/lib/Fuzzer/test/MemcmpTest.cpp @@ -1,3 +1,6 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + // Simple test for a fuzzer. The fuzzer must find a particular string. #include <cstring> #include <cstdint> @@ -9,7 +12,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { if (Size >= 8 && memcmp(Data, "01234567", 8) == 0) { if (Size >= 12 && memcmp(Data + 8, "ABCD", 4) == 0) { if (Size >= 14 && memcmp(Data + 12, "XY", 2) == 0) { - if (Size >= 16 && memcmp(Data + 14, "KLM", 3) == 0) { + if (Size >= 17 && memcmp(Data + 14, "KLM", 3) == 0) { if (Size >= 27 && memcmp(Data + 17, "ABCDE-GHIJ", 10) == 0){ fprintf(stderr, "BINGO %zd\n", Size); for (size_t i = 0; i < Size; i++) { diff --git a/gnu/llvm/lib/Fuzzer/test/NthRunCrashTest.cpp b/gnu/llvm/lib/Fuzzer/test/NthRunCrashTest.cpp new file mode 100644 index 00000000000..b43e69e51b2 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/NthRunCrashTest.cpp @@ -0,0 +1,18 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + +// Crash on the N-th execution. +#include <cstdint> +#include <cstddef> +#include <iostream> + +static int Counter; + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + if (Counter++ == 1000) { + std::cout << "BINGO; Found the target, exiting\n"; + exit(1); + } + return 0; +} + diff --git a/gnu/llvm/lib/Fuzzer/test/NullDerefOnEmptyTest.cpp b/gnu/llvm/lib/Fuzzer/test/NullDerefOnEmptyTest.cpp new file mode 100644 index 00000000000..153710920a5 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/NullDerefOnEmptyTest.cpp @@ -0,0 +1,19 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + +// Simple test for a fuzzer. The fuzzer must find the empty string. +#include <cstdint> +#include <cstdlib> +#include <cstddef> +#include <iostream> + +static volatile int *Null = 0; + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + if (Size == 0) { + std::cout << "Found the target, dereferencing NULL\n"; + *Null = 1; + } + return 0; +} + diff --git a/gnu/llvm/lib/Fuzzer/test/NullDerefTest.cpp b/gnu/llvm/lib/Fuzzer/test/NullDerefTest.cpp index 200c56ccbbc..3f03d249819 100644 --- a/gnu/llvm/lib/Fuzzer/test/NullDerefTest.cpp +++ b/gnu/llvm/lib/Fuzzer/test/NullDerefTest.cpp @@ -1,3 +1,6 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + // Simple test for a fuzzer. The fuzzer must find the string "Hi!". #include <cstdint> #include <cstdlib> diff --git a/gnu/llvm/lib/Fuzzer/test/OneHugeAllocTest.cpp b/gnu/llvm/lib/Fuzzer/test/OneHugeAllocTest.cpp new file mode 100644 index 00000000000..617fa20fa2e --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/OneHugeAllocTest.cpp @@ -0,0 +1,29 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + +// Tests OOM handling when there is a single large allocation. +#include <assert.h> +#include <cstdint> +#include <cstdlib> +#include <cstddef> +#include <cstring> +#include <iostream> +#include <unistd.h> + +static volatile char *SinkPtr; + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + if (Size > 0 && Data[0] == 'H') { + if (Size > 1 && Data[1] == 'i') { + if (Size > 2 && Data[2] == '!') { + size_t kSize = (size_t)1 << 31; + char *p = new char[kSize]; + memset(p, 0, kSize); + SinkPtr = p; + delete [] p; + } + } + } + return 0; +} + diff --git a/gnu/llvm/lib/Fuzzer/test/OutOfMemoryTest.cpp b/gnu/llvm/lib/Fuzzer/test/OutOfMemoryTest.cpp new file mode 100644 index 00000000000..e5c9f0a038f --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/OutOfMemoryTest.cpp @@ -0,0 +1,31 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + +// Tests OOM handling. +#include <assert.h> +#include <cstdint> +#include <cstdlib> +#include <cstddef> +#include <cstring> +#include <iostream> +#include <unistd.h> + +static volatile char *SinkPtr; + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + if (Size > 0 && Data[0] == 'H') { + if (Size > 1 && Data[1] == 'i') { + if (Size > 2 && Data[2] == '!') { + while (true) { + size_t kSize = 1 << 28; + char *p = new char[kSize]; + memset(p, 0, kSize); + SinkPtr = p; + sleep(1); + } + } + } + } + return 0; +} + diff --git a/gnu/llvm/lib/Fuzzer/test/RepeatedMemcmp.cpp b/gnu/llvm/lib/Fuzzer/test/RepeatedMemcmp.cpp new file mode 100644 index 00000000000..a327bbee781 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/RepeatedMemcmp.cpp @@ -0,0 +1,22 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + + +#include <cstring> +#include <cstdint> +#include <cstdio> +#include <cstdlib> + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + int Matches = 0; + for (size_t i = 0; i + 2 < Size; i += 3) { + const char *Pat = i % 2 ? "foo" : "bar"; + if (!memcmp(Data + i, Pat, 3)) + Matches++; + } + if (Matches > 20) { + fprintf(stderr, "BINGO!\n"); + exit(1); + } + return 0; +} diff --git a/gnu/llvm/lib/Fuzzer/test/SignedIntOverflowTest.cpp b/gnu/llvm/lib/Fuzzer/test/SignedIntOverflowTest.cpp new file mode 100644 index 00000000000..7df32ad5793 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/SignedIntOverflowTest.cpp @@ -0,0 +1,28 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + +// Test for signed-integer-overflow. +#include <assert.h> +#include <cstdint> +#include <cstdlib> +#include <cstddef> +#include <iostream> +#include <climits> + +static volatile int Sink; +static int Large = INT_MAX; + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + assert(Data); + if (Size > 0 && Data[0] == 'H') { + Sink = 1; + if (Size > 1 && Data[1] == 'i') { + Sink = 2; + if (Size > 2 && Data[2] == '!') { + Large++; // int overflow. + } + } + } + return 0; +} + diff --git a/gnu/llvm/lib/Fuzzer/test/SimpleCmpTest.cpp b/gnu/llvm/lib/Fuzzer/test/SimpleCmpTest.cpp index 8568c737efb..54dc016ce84 100644 --- a/gnu/llvm/lib/Fuzzer/test/SimpleCmpTest.cpp +++ b/gnu/llvm/lib/Fuzzer/test/SimpleCmpTest.cpp @@ -1,3 +1,6 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + // Simple test for a fuzzer. The fuzzer must find several narrow ranges. #include <cstdint> #include <cstdlib> diff --git a/gnu/llvm/lib/Fuzzer/test/SimpleDictionaryTest.cpp b/gnu/llvm/lib/Fuzzer/test/SimpleDictionaryTest.cpp index b9cb2f0270a..cd7292bd006 100644 --- a/gnu/llvm/lib/Fuzzer/test/SimpleDictionaryTest.cpp +++ b/gnu/llvm/lib/Fuzzer/test/SimpleDictionaryTest.cpp @@ -1,3 +1,6 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + // Simple test for a fuzzer. // The fuzzer must find a string based on dictionary words: // "Elvis" diff --git a/gnu/llvm/lib/Fuzzer/test/SimpleFnAdapterTest.cpp b/gnu/llvm/lib/Fuzzer/test/SimpleFnAdapterTest.cpp new file mode 100644 index 00000000000..d30c98b250e --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/SimpleFnAdapterTest.cpp @@ -0,0 +1,24 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + +// Simple test for a fuzzer Fn adapter. The fuzzer has to find two non-empty +// vectors with the same content. + +#include <iostream> +#include <vector> + +#include "FuzzerFnAdapter.h" + +static void TestFn(std::vector<uint8_t> V1, std::vector<uint8_t> V2) { + if (V1.size() > 0 && V1 == V2) { + std::cout << "BINGO; Found the target, exiting\n"; + exit(0); + } +} + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + fuzzer::Adapt(TestFn, Data, Size); + return 0; +} + + diff --git a/gnu/llvm/lib/Fuzzer/test/SimpleHashTest.cpp b/gnu/llvm/lib/Fuzzer/test/SimpleHashTest.cpp index 5bab3fa7f64..00599de78eb 100644 --- a/gnu/llvm/lib/Fuzzer/test/SimpleHashTest.cpp +++ b/gnu/llvm/lib/Fuzzer/test/SimpleHashTest.cpp @@ -1,3 +1,6 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + // This test computes a checksum of the data (all but the last 4 bytes), // and then compares the last 4 bytes with the computed value. // A fuzzer with cmp traces is expected to defeat this check. diff --git a/gnu/llvm/lib/Fuzzer/test/SimpleTest.cpp b/gnu/llvm/lib/Fuzzer/test/SimpleTest.cpp index 04225a889f5..e53ea160ed8 100644 --- a/gnu/llvm/lib/Fuzzer/test/SimpleTest.cpp +++ b/gnu/llvm/lib/Fuzzer/test/SimpleTest.cpp @@ -1,3 +1,6 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + // Simple test for a fuzzer. The fuzzer must find the string "Hi!". #include <assert.h> #include <cstdint> diff --git a/gnu/llvm/lib/Fuzzer/test/SimpleThreadedTest.cpp b/gnu/llvm/lib/Fuzzer/test/SimpleThreadedTest.cpp new file mode 100644 index 00000000000..5f02d3f8457 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/SimpleThreadedTest.cpp @@ -0,0 +1,25 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + +// Threaded test for a fuzzer. The fuzzer should find "H" +#include <assert.h> +#include <cstdint> +#include <cstddef> +#include <cstring> +#include <iostream> +#include <thread> + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + auto C = [&] { + if (Size >= 2 && Data[0] == 'H') { + std::cout << "BINGO; Found the target, exiting\n"; + abort(); + } + }; + std::thread T[] = {std::thread(C), std::thread(C), std::thread(C), + std::thread(C), std::thread(C), std::thread(C)}; + for (auto &X : T) + X.join(); + return 0; +} + diff --git a/gnu/llvm/lib/Fuzzer/test/SpamyTest.cpp b/gnu/llvm/lib/Fuzzer/test/SpamyTest.cpp new file mode 100644 index 00000000000..d294d4dc53e --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/SpamyTest.cpp @@ -0,0 +1,21 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + +// The test spams to stderr and stdout. +#include <assert.h> +#include <cstdint> +#include <cstdio> +#include <cstddef> +#include <iostream> + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + assert(Data); + printf("PRINTF_STDOUT\n"); + fflush(stdout); + fprintf(stderr, "PRINTF_STDERR\n"); + std::cout << "STREAM_COUT\n"; + std::cout.flush(); + std::cerr << "STREAM_CERR\n"; + return 0; +} + diff --git a/gnu/llvm/lib/Fuzzer/test/StrcmpTest.cpp b/gnu/llvm/lib/Fuzzer/test/StrcmpTest.cpp index 835819ae2f4..5a132990461 100644 --- a/gnu/llvm/lib/Fuzzer/test/StrcmpTest.cpp +++ b/gnu/llvm/lib/Fuzzer/test/StrcmpTest.cpp @@ -1,3 +1,6 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + // Break through a series of strcmp. #include <cstring> #include <cstdint> diff --git a/gnu/llvm/lib/Fuzzer/test/StrncmpTest.cpp b/gnu/llvm/lib/Fuzzer/test/StrncmpTest.cpp index 55344d75e0b..8575c2682f1 100644 --- a/gnu/llvm/lib/Fuzzer/test/StrncmpTest.cpp +++ b/gnu/llvm/lib/Fuzzer/test/StrncmpTest.cpp @@ -1,3 +1,6 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + // Simple test for a fuzzer. The fuzzer must find a particular string. #include <cstring> #include <cstdint> diff --git a/gnu/llvm/lib/Fuzzer/test/StrstrTest.cpp b/gnu/llvm/lib/Fuzzer/test/StrstrTest.cpp new file mode 100644 index 00000000000..90d539b660a --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/StrstrTest.cpp @@ -0,0 +1,18 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + +// Test strstr and strcasestr hooks. +#include <string> +#include <string.h> +#include <cstdint> +#include <cstdio> +#include <cstdlib> + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + std::string s(reinterpret_cast<const char*>(Data), Size); + if (strstr(s.c_str(), "FUZZ") && strcasestr(s.c_str(), "aBcD")) { + fprintf(stderr, "BINGO\n"); + exit(1); + } + return 0; +} diff --git a/gnu/llvm/lib/Fuzzer/test/SwitchTest.cpp b/gnu/llvm/lib/Fuzzer/test/SwitchTest.cpp index 5de7fff7452..3dc051ff7b5 100644 --- a/gnu/llvm/lib/Fuzzer/test/SwitchTest.cpp +++ b/gnu/llvm/lib/Fuzzer/test/SwitchTest.cpp @@ -1,3 +1,6 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + // Simple test for a fuzzer. The fuzzer must find the interesting switch value. #include <cstdint> #include <cstdlib> diff --git a/gnu/llvm/lib/Fuzzer/test/ThreadedLeakTest.cpp b/gnu/llvm/lib/Fuzzer/test/ThreadedLeakTest.cpp new file mode 100644 index 00000000000..75110711087 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/ThreadedLeakTest.cpp @@ -0,0 +1,18 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + +// The fuzzer should find a leak in a non-main thread. +#include <cstdint> +#include <cstddef> +#include <thread> + +static volatile int *Sink; + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + if (Size == 0) return 0; + if (Data[0] != 'F') return 0; + std::thread T([&] { Sink = new int; }); + T.join(); + return 0; +} + diff --git a/gnu/llvm/lib/Fuzzer/test/ThreadedTest.cpp b/gnu/llvm/lib/Fuzzer/test/ThreadedTest.cpp index 7aa114a41f3..09137a9a70c 100644 --- a/gnu/llvm/lib/Fuzzer/test/ThreadedTest.cpp +++ b/gnu/llvm/lib/Fuzzer/test/ThreadedTest.cpp @@ -1,3 +1,6 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + // Threaded test for a fuzzer. The fuzzer should not crash. #include <assert.h> #include <cstdint> diff --git a/gnu/llvm/lib/Fuzzer/test/TimeoutTest.cpp b/gnu/llvm/lib/Fuzzer/test/TimeoutTest.cpp index 71790ded95a..f8107012c84 100644 --- a/gnu/llvm/lib/Fuzzer/test/TimeoutTest.cpp +++ b/gnu/llvm/lib/Fuzzer/test/TimeoutTest.cpp @@ -1,3 +1,6 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + // Simple test for a fuzzer. The fuzzer must find the string "Hi!". #include <cstdint> #include <cstdlib> diff --git a/gnu/llvm/lib/Fuzzer/test/UninstrumentedTest.cpp b/gnu/llvm/lib/Fuzzer/test/UninstrumentedTest.cpp index c1730198d83..ffe952c749d 100644 --- a/gnu/llvm/lib/Fuzzer/test/UninstrumentedTest.cpp +++ b/gnu/llvm/lib/Fuzzer/test/UninstrumentedTest.cpp @@ -1,3 +1,6 @@ +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. + // This test should not be instrumented. #include <cstdint> #include <cstddef> diff --git a/gnu/llvm/lib/Fuzzer/test/afl-driver-extra-stats.test b/gnu/llvm/lib/Fuzzer/test/afl-driver-extra-stats.test new file mode 100644 index 00000000000..81e384e7dad --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/afl-driver-extra-stats.test @@ -0,0 +1,28 @@ +; Test that not specifying an extra stats file isn't broken. +RUN: unset AFL_DRIVER_EXTRA_STATS_FILENAME +RUN: AFLDriverTest + +; Test that specifying an invalid extra stats file causes a crash. +RUN: ASAN_OPTIONS= AFL_DRIVER_EXTRA_STATS_FILENAME=%T not --crash AFLDriverTest + +; Test that specifying a corrupted stats file causes a crash. +echo "peak_rss_mb :0" > %t +ASAN_OPTIONS= AFL_DRIVER_EXTRA_STATS_FILENAME=%t not --crash AFLDriverTest + +; Test that specifying a valid nonexistent stats file works. +RUN: rm -f %t +RUN: AFL_DRIVER_EXTRA_STATS_FILENAME=%t AFLDriverTest +RUN: [[ $(grep "peak_rss_mb\|slowest_unit_time_sec" %t | wc -l) -eq 2 ]] + +; Test that specifying a valid preexisting stats file works. +RUN: printf "peak_rss_mb : 0\nslowest_unit_time_sec: 0\n" > %t +RUN: AFL_DRIVER_EXTRA_STATS_FILENAME=%t AFLDriverTest +; Check that both lines were printed. +RUN: [[ $(grep "peak_rss_mb\|slowest_unit_time_sec" %t | wc -l) -eq 2 ]] + +; Test that peak_rss_mb and slowest_unit_time_in_secs are only updated when necessary. +; Check that both lines have 9999 since there's no way we have exceeded that +; amount of time or virtual memory. +RUN: printf "peak_rss_mb : 9999\nslowest_unit_time_sec: 9999\n" > %t +RUN: AFL_DRIVER_EXTRA_STATS_FILENAME=%t AFLDriverTest +RUN: [[ $(grep "9999" %t | wc -l) -eq 2 ]] diff --git a/gnu/llvm/lib/Fuzzer/test/afl-driver-stderr.test b/gnu/llvm/lib/Fuzzer/test/afl-driver-stderr.test new file mode 100644 index 00000000000..c0f9c8398c2 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/afl-driver-stderr.test @@ -0,0 +1,10 @@ +; Test that not specifying a stderr file isn't broken. +RUN: unset AFL_DRIVER_STDERR_DUPLICATE_FILENAME +RUN: AFLDriverTest + +; Test that specifying an invalid file causes a crash. +RUN: ASAN_OPTIONS= AFL_DRIVER_STDERR_DUPLICATE_FILENAME="%T" not --crash AFLDriverTest + +; Test that a file is created when specified as the duplicate stderr. +RUN: AFL_DRIVER_STDERR_DUPLICATE_FILENAME=%t AFLDriverTest +RUN: stat %t diff --git a/gnu/llvm/lib/Fuzzer/test/dfsan/CMakeLists.txt b/gnu/llvm/lib/Fuzzer/test/dfsan/CMakeLists.txt index 2b49831fcdb..2a4dc18bfee 100644 --- a/gnu/llvm/lib/Fuzzer/test/dfsan/CMakeLists.txt +++ b/gnu/llvm/lib/Fuzzer/test/dfsan/CMakeLists.txt @@ -1,14 +1,19 @@ # These tests depend on both coverage and dfsan instrumentation. -set(CMAKE_CXX_FLAGS_RELEASE - "${LIBFUZZER_FLAGS_BASE} -O0 -fno-sanitize=all -fsanitize=dataflow") +set(CMAKE_CXX_FLAGS + "${LIBFUZZER_FLAGS_BASE} -fno-sanitize=all -fsanitize=dataflow") + +set(DFSanTests + MemcmpTest + SimpleCmpTest + StrcmpTest + StrncmpTest + SwitchTest + ) foreach(Test ${DFSanTests}) - add_executable(LLVMFuzzer-${Test}-DFSan - ../${Test}.cpp - ) - target_link_libraries(LLVMFuzzer-${Test}-DFSan - LLVMFuzzer - ) + add_libfuzzer_test(${Test}-DFSan SOURCES ../${Test}.cpp) endforeach() +# Propagate value into parent directory +set(TestBinaries ${TestBinaries} PARENT_SCOPE) diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-customcrossover.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-customcrossover.test new file mode 100644 index 00000000000..4be54d3f799 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-customcrossover.test @@ -0,0 +1,10 @@ +RUN: rm -rf %t/CustomCrossover +RUN: mkdir -p %t/CustomCrossover +RUN: echo "0123456789" > %t/CustomCrossover/digits +RUN: echo "abcdefghij" > %t/CustomCrossover/chars +RUN: not LLVMFuzzer-CustomCrossOverTest -seed=1 -use_memcmp=0 -runs=100000 -prune_corpus=0 %t/CustomCrossover 2>&1 | FileCheck %s --check-prefix=LLVMFuzzerCustomCrossover +RUN: rm -rf %t/CustomCrossover + +LLVMFuzzerCustomCrossover: In LLVMFuzzerCustomCrossover +LLVMFuzzerCustomCrossover: BINGO + diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-custommutator.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-custommutator.test new file mode 100644 index 00000000000..fcd740bf545 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-custommutator.test @@ -0,0 +1,4 @@ +RUN: not LLVMFuzzer-CustomMutatorTest 2>&1 | FileCheck %s --check-prefix=LLVMFuzzerCustomMutator +LLVMFuzzerCustomMutator: In LLVMFuzzerCustomMutator +LLVMFuzzerCustomMutator: BINGO + diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-dfsan.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-dfsan.test index 567086ed65a..5bd5c0f18d2 100644 --- a/gnu/llvm/lib/Fuzzer/test/fuzzer-dfsan.test +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-dfsan.test @@ -1,3 +1,4 @@ +REQUIRES: dfsan CHECK1: BINGO CHECK2: BINGO CHECK3: BINGO @@ -7,10 +8,10 @@ CHECK_DFSanCmpCallback: DFSanCmpCallback: PC CHECK_DFSanSwitchCallback: DFSanSwitchCallback: PC CHECK_DFSanMemcmpCallback: DFSanMemcmpCallback: Pos -RUN: not LLVMFuzzer-SimpleCmpTest-DFSan -use_traces=1 -seed=1 -runs=1000000 -timeout=5 2>&1 | FileCheck %s --check-prefix=CHECK1 +RUN: not LLVMFuzzer-SimpleCmpTest-DFSan -use_traces=1 -seed=1 -runs=10000000 -timeout=5 2>&1 | FileCheck %s --check-prefix=CHECK1 RUN: LLVMFuzzer-SimpleCmpTest-DFSan -use_traces=1 -seed=1 -runs=100 -timeout=5 -verbosity=3 2>&1 | FileCheck %s -check-prefix=CHECK_DFSanCmpCallback -RUN: not LLVMFuzzer-MemcmpTest-DFSan -use_traces=1 -seed=1 -runs=10000 -timeout=5 2>&1 | FileCheck %s --check-prefix=CHECK2 +RUN: not LLVMFuzzer-MemcmpTest-DFSan -use_traces=1 -seed=1 -runs=100000 -timeout=5 2>&1 | FileCheck %s --check-prefix=CHECK2 RUN: LLVMFuzzer-MemcmpTest-DFSan -use_traces=1 -seed=1 -runs=2 -timeout=5 -verbosity=3 2>&1 | FileCheck %s -check-prefix=CHECK_DFSanMemcmpCallback RUN: not LLVMFuzzer-StrncmpTest-DFSan -use_traces=1 -seed=1 -runs=10000 -timeout=5 2>&1 | FileCheck %s --check-prefix=CHECK3 diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-dirs.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-dirs.test new file mode 100644 index 00000000000..3eaaf6b6bb5 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-dirs.test @@ -0,0 +1,12 @@ +RUN: rm -rf %t/SUB1 +RUN: mkdir -p %t/SUB1/SUB2/SUB3 +RUN: echo a > %t/SUB1/a +RUN: echo b > %t/SUB1/SUB2/b +RUN: echo c > %t/SUB1/SUB2/SUB3/c +RUN: LLVMFuzzer-SimpleTest %t/SUB1 -runs=0 2>&1 | FileCheck %s --check-prefix=SUBDIRS +SUBDIRS: READ units: 3 +RUN: rm -rf %t/SUB1 + +RUN: not LLVMFuzzer-SimpleTest NONEXISTENT_DIR 2>&1 | FileCheck %s --check-prefix=NONEXISTENT_DIR +NONEXISTENT_DIR: No such directory: NONEXISTENT_DIR; exiting + diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-fdmask.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-fdmask.test new file mode 100644 index 00000000000..abbc4bd6412 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-fdmask.test @@ -0,0 +1,30 @@ +RUN: LLVMFuzzer-SpamyTest -runs=1 2>&1 | FileCheck %s --check-prefix=FD_MASK_0 +RUN: LLVMFuzzer-SpamyTest -runs=1 -close_fd_mask=0 2>&1 | FileCheck %s --check-prefix=FD_MASK_0 +RUN: LLVMFuzzer-SpamyTest -runs=1 -close_fd_mask=1 2>&1 | FileCheck %s --check-prefix=FD_MASK_1 +RUN: LLVMFuzzer-SpamyTest -runs=1 -close_fd_mask=2 2>&1 | FileCheck %s --check-prefix=FD_MASK_2 +RUN: LLVMFuzzer-SpamyTest -runs=1 -close_fd_mask=3 2>&1 | FileCheck %s --check-prefix=FD_MASK_3 + +FD_MASK_0: PRINTF_STDOUT +FD_MASK_0: PRINTF_STDERR +FD_MASK_0: STREAM_COUT +FD_MASK_0: STREAM_CERR +FD_MASK_0: INITED + +FD_MASK_1-NOT: PRINTF_STDOUT +FD_MASK_1: PRINTF_STDERR +FD_MASK_1-NOT: STREAM_COUT +FD_MASK_1: STREAM_CERR +FD_MASK_1: INITED + +FD_MASK_2: PRINTF_STDOUT +FD_MASK_2-NOT: PRINTF_STDERR +FD_MASK_2: STREAM_COUT +FD_MASK_2-NOTE: STREAM_CERR +FD_MASK_2: INITED + +FD_MASK_3-NOT: PRINTF_STDOUT +FD_MASK_3-NOT: PRINTF_STDERR +FD_MASK_3-NOT: STREAM_COUT +FD_MASK_3-NOT: STREAM_CERR +FD_MASK_3: INITED + diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-finalstats.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-finalstats.test new file mode 100644 index 00000000000..1cbcd10f049 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-finalstats.test @@ -0,0 +1,11 @@ +RUN: LLVMFuzzer-SimpleTest -seed=1 -runs=77 -print_final_stats=1 2>&1 | FileCheck %s --check-prefix=FINAL_STATS +FINAL_STATS: stat::number_of_executed_units: 77 +FINAL_STATS: stat::average_exec_per_sec: 0 +FINAL_STATS: stat::new_units_added: +FINAL_STATS: stat::slowest_unit_time_sec: 0 +FINAL_STATS: stat::peak_rss_mb: + +RUN: LLVMFuzzer-SimpleTest %S/dict1.txt -runs=33 -print_final_stats=1 2>&1 | FileCheck %s --check-prefix=FINAL_STATS1 +FINAL_STATS1: stat::number_of_executed_units: 33 +FINAL_STATS1: stat::peak_rss_mb: + diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-flags.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-flags.test new file mode 100644 index 00000000000..a94faf20a58 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-flags.test @@ -0,0 +1,8 @@ +RUN: LLVMFuzzer-SimpleTest -foo_bar=1 2>&1 | FileCheck %s --check-prefix=FOO_BAR +FOO_BAR: WARNING: unrecognized flag '-foo_bar=1'; use -help=1 to list all flags +FOO_BAR: BINGO + +RUN: LLVMFuzzer-SimpleTest -runs=10 --max_len=100 2>&1 | FileCheck %s --check-prefix=DASH_DASH +DASH_DASH: WARNING: did you mean '-max_len=100' (single dash)? +DASH_DASH: INFO: A corpus is not provided, starting from an empty corpus + diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-fn-adapter.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-fn-adapter.test new file mode 100644 index 00000000000..0ea96f3f9f0 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-fn-adapter.test @@ -0,0 +1,3 @@ +RUN: LLVMFuzzer-SimpleFnAdapterTest 2>&1 | FileCheck %s + +CHECK: BINGO diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-leak.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-leak.test new file mode 100644 index 00000000000..59ba02cd7d2 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-leak.test @@ -0,0 +1,31 @@ +REQUIRES: lsan +RUN: not LLVMFuzzer-LeakTest -runs=100000 -detect_leaks=1 2>&1 | FileCheck %s --check-prefix=LEAK_DURING +LEAK_DURING: ERROR: LeakSanitizer: detected memory leaks +LEAK_DURING: Direct leak of 4 byte(s) in 1 object(s) allocated from: +LEAK_DURING: INFO: to ignore leaks on libFuzzer side use -detect_leaks=0 +LEAK_DURING: Test unit written to ./leak- +LEAK_DURING-NOT: DONE +LEAK_DURING-NOT: Done + +RUN: not LLVMFuzzer-LeakTest -runs=0 -detect_leaks=1 %S 2>&1 | FileCheck %s --check-prefix=LEAK_IN_CORPUS +LEAK_IN_CORPUS: ERROR: LeakSanitizer: detected memory leaks +LEAK_IN_CORPUS: INFO: a leak has been found in the initial corpus. + + +RUN: not LLVMFuzzer-LeakTest -runs=100000 -detect_leaks=0 2>&1 | FileCheck %s --check-prefix=LEAK_AFTER +RUN: not LLVMFuzzer-LeakTest -runs=100000 2>&1 | FileCheck %s --check-prefix=LEAK_DURING +RUN: not LLVMFuzzer-ThreadedLeakTest -runs=100000 -detect_leaks=0 2>&1 | FileCheck %s --check-prefix=LEAK_AFTER +RUN: not LLVMFuzzer-ThreadedLeakTest -runs=100000 2>&1 | FileCheck %s --check-prefix=LEAK_DURING +LEAK_AFTER: Done 100000 runs in +LEAK_AFTER: ERROR: LeakSanitizer: detected memory leaks + +RUN: not LLVMFuzzer-LeakTest -runs=100000 -max_len=1 2>&1 | FileCheck %s --check-prefix=MAX_LEN_1 +MAX_LEN_1: Test unit written to ./leak-7cf184f4c67ad58283ecb19349720b0cae756829 + +RUN: not LLVMFuzzer-LeakTimeoutTest -timeout=1 2>&1 | FileCheck %s --check-prefix=LEAK_TIMEOUT +LEAK_TIMEOUT: ERROR: libFuzzer: timeout after +LEAK_TIMEOUT-NOT: LeakSanitizer + +RUN: LLVMFuzzer-AccumulateAllocationsTest -detect_leaks=1 -runs=100000 2>&1 | FileCheck %s --check-prefix=ACCUMULATE_ALLOCS +ACCUMULATE_ALLOCS: INFO: libFuzzer disabled leak detection after every mutation + diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-oom-with-profile.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-oom-with-profile.test new file mode 100644 index 00000000000..391fd4bb0ff --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-oom-with-profile.test @@ -0,0 +1,6 @@ +REQUIRES: linux +RUN: not LLVMFuzzer-OutOfMemoryTest -rss_limit_mb=10 2>&1 | FileCheck %s +CHECK: ERROR: libFuzzer: out-of-memory (used: {{.*}}; limit: 10Mb) +CHECK: Live Heap Allocations +CHECK: Test unit written to ./oom- +SUMMARY: libFuzzer: out-of-memory diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-oom.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-oom.test new file mode 100644 index 00000000000..4cdff2142fd --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-oom.test @@ -0,0 +1,4 @@ +RUN: not LLVMFuzzer-OutOfMemoryTest -rss_limit_mb=10 2>&1 | FileCheck %s +CHECK: ERROR: libFuzzer: out-of-memory (used: {{.*}}; limit: 10Mb) +CHECK: Test unit written to ./oom- +SUMMARY: libFuzzer: out-of-memory diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-printcovpcs.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-printcovpcs.test new file mode 100644 index 00000000000..70b22c7a54b --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-printcovpcs.test @@ -0,0 +1,5 @@ +RUN: LLVMFuzzer-SimpleTest -print_new_cov_pcs=1 2>&1 | FileCheck %s --check-prefix=PCS +PCS:{{^0x[a-f0-9]+}} +PCS:NEW +PCS:BINGO + diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-prunecorpus.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-prunecorpus.test new file mode 100644 index 00000000000..a8a660e91b9 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-prunecorpus.test @@ -0,0 +1,13 @@ +RUN: rm -rf %t/PruneCorpus +RUN: mkdir -p %t/PruneCorpus +RUN: echo a > %t/PruneCorpus/a +RUN: echo b > %t/PruneCorpus/b +RUN: LLVMFuzzer-EmptyTest %t/PruneCorpus -prune_corpus=1 -runs=0 2>&1 | FileCheck %s --check-prefix=PRUNE +RUN: LLVMFuzzer-EmptyTest %t/PruneCorpus -prune_corpus=0 -runs=0 2>&1 | FileCheck %s --check-prefix=NOPRUNE +RUN: rm -rf %t/PruneCorpus + +PRUNE: READ units: 2 +PRUNE: INITED{{.*}}units: 1 +NOPRUNE: READ units: 2 +NOPRUNE: INITED{{.*}}units: 2 + diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-runs.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-runs.test new file mode 100644 index 00000000000..056c44782a1 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-runs.test @@ -0,0 +1,8 @@ +RUN: mkdir -p %t +RUN: echo abcd > %t/NthRunCrashTest.in +RUN: LLVMFuzzer-NthRunCrashTest %t/NthRunCrashTest.in +RUN: LLVMFuzzer-NthRunCrashTest %t/NthRunCrashTest.in -runs=10 +RUN: not LLVMFuzzer-NthRunCrashTest %t/NthRunCrashTest.in -runs=10000 2>&1 | FileCheck %s +RUN: rm %t/NthRunCrashTest.in +CHECK: BINGO + diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-seed.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-seed.test new file mode 100644 index 00000000000..f1bdf9e4ae9 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-seed.test @@ -0,0 +1,3 @@ +RUN: LLVMFuzzer-SimpleCmpTest -seed=-1 -runs=0 2>&1 | FileCheck %s --check-prefix=CHECK_SEED_MINUS_ONE +CHECK_SEED_MINUS_ONE: Seed: 4294967295 + diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-segv.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-segv.test new file mode 100644 index 00000000000..330f03bcc49 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-segv.test @@ -0,0 +1,5 @@ +RUN: ASAN_OPTIONS=handle_segv=0 not LLVMFuzzer-NullDerefTest 2>&1 | FileCheck %s --check-prefix=LIBFUZZER_OWN_SEGV_HANDLER +LIBFUZZER_OWN_SEGV_HANDLER: == ERROR: libFuzzer: deadly signal +LIBFUZZER_OWN_SEGV_HANDLER: SUMMARY: libFuzzer: deadly signal +LIBFUZZER_OWN_SEGV_HANDLER: Test unit written to ./crash- + diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-singleinputs.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-singleinputs.test new file mode 100644 index 00000000000..a4faf2cea50 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-singleinputs.test @@ -0,0 +1,13 @@ +RUN: not LLVMFuzzer-NullDerefTest %S/hi.txt 2>&1 | FileCheck %s --check-prefix=SingleInput +SingleInput-NOT: Test unit written to ./crash- + +RUN: rm -rf %tmp/SINGLE_INPUTS +RUN: mkdir -p %tmp/SINGLE_INPUTS +RUN: echo aaa > %tmp/SINGLE_INPUTS/aaa +RUN: echo bbb > %tmp/SINGLE_INPUTS/bbb +RUN: LLVMFuzzer-SimpleTest %tmp/SINGLE_INPUTS/aaa %tmp/SINGLE_INPUTS/bbb 2>&1 | FileCheck %s --check-prefix=SINGLE_INPUTS +RUN: rm -rf %tmp/SINGLE_INPUTS +SINGLE_INPUTS: LLVMFuzzer-SimpleTest: Running 2 inputs 1 time(s) each. +SINGLE_INPUTS: aaa in +SINGLE_INPUTS: bbb in + diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-timeout.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-timeout.test index c3a9e8a3a9e..8e8b713fcd7 100644 --- a/gnu/llvm/lib/Fuzzer/test/fuzzer-timeout.test +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-timeout.test @@ -7,7 +7,8 @@ TimeoutTest: #1 TimeoutTest: #2 TimeoutTest: SUMMARY: libFuzzer: timeout -RUN: not LLVMFuzzer-TimeoutTest -timeout=1 -test_single_input=%S/hi.txt 2>&1 | FileCheck %s --check-prefix=SingleInputTimeoutTest -SingleInputTimeoutTest: ALARM: working on the last Unit for +RUN: not LLVMFuzzer-TimeoutTest -timeout=1 %S/hi.txt 2>&1 | FileCheck %s --check-prefix=SingleInputTimeoutTest +SingleInputTimeoutTest: ALARM: working on the last Unit for {{[1-3]}} seconds SingleInputTimeoutTest-NOT: Test unit written to ./timeout- +RUN: LLVMFuzzer-TimeoutTest -timeout=1 -timeout_exitcode=0 diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-trace-pc.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-trace-pc.test new file mode 100644 index 00000000000..673249d0478 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-trace-pc.test @@ -0,0 +1,7 @@ +CHECK: BINGO +REQUIRES: linux +RUN: not LLVMFuzzer-FourIndependentBranchesTest-TracePC -seed=1 -runs=1000000 2>&1 | FileCheck %s +// FIXME: The test below uses a significant amount of memory on OSX and +// sometimes hits the 2GiB memory limit. This needs to be investigated. For now +// only run the test on Linux. +RUN: not LLVMFuzzer-FullCoverageSetTest-TracePC -seed=1 -runs=10000000 2>&1 | FileCheck %s diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-traces-hooks.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-traces-hooks.test new file mode 100644 index 00000000000..71fe6f2daf1 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-traces-hooks.test @@ -0,0 +1,25 @@ +// FIXME: Support sanitizer hooks for memcmp and strcmp need +// to be implemented in the sanitizer runtime for platforms other +// than linux +REQUIRES: linux +CHECK: BINGO +Done1000000: Done 1000000 runs in + +RUN: not LLVMFuzzer-MemcmpTest -seed=4294967295 -runs=100000 2>&1 | FileCheck %s +RUN: LLVMFuzzer-MemcmpTest -use_memcmp=0 -seed=4294967295 -runs=1000000 2>&1 | FileCheck %s --check-prefix=Done1000000 + +RUN: not LLVMFuzzer-StrncmpTest -seed=2 -runs=100000 2>&1 | FileCheck %s +RUN: LLVMFuzzer-StrncmpTest -use_memcmp=0 -seed=3 -runs=1000000 2>&1 | FileCheck %s --check-prefix=Done1000000 + +RUN: not LLVMFuzzer-StrcmpTest -seed=4 -runs=200000 2>&1 | FileCheck %s +RUN: LLVMFuzzer-StrcmpTest -use_memcmp=0 -seed=5 -runs=1000000 2>&1 | FileCheck %s --check-prefix=Done1000000 + +RUN: not LLVMFuzzer-StrstrTest -seed=6 -runs=200000 2>&1 | FileCheck %s +RUN: LLVMFuzzer-StrstrTest -use_memmem=0 -seed=7 -runs=1000000 2>&1 | FileCheck %s --check-prefix=Done1000000 + +RUN: LLVMFuzzer-RepeatedMemcmp -seed=10 -runs=100000 2>&1 | FileCheck %s --check-prefix=RECOMMENDED_DICT +RECOMMENDED_DICT:###### Recommended dictionary. ###### +RECOMMENDED_DICT-DAG: "foo" +RECOMMENDED_DICT-DAG: "bar" +RECOMMENDED_DICT:###### End of recommended dictionary. ###### + diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-traces.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-traces.test index 3b8639b8e94..2d772953664 100644 --- a/gnu/llvm/lib/Fuzzer/test/fuzzer-traces.test +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-traces.test @@ -1,20 +1,9 @@ CHECK: BINGO Done1000000: Done 1000000 runs in -Done10000000: Done 10000000 runs in - RUN: not LLVMFuzzer-SimpleCmpTest -use_traces=1 -seed=1 -runs=10000001 2>&1 | FileCheck %s -RUN: not LLVMFuzzer-MemcmpTest -use_traces=1 -seed=4294967295 -runs=100000 2>&1 | FileCheck %s -RUN: LLVMFuzzer-MemcmpTest -seed=4294967295 -runs=1000000 2>&1 | FileCheck %s --check-prefix=Done1000000 - -RUN: not LLVMFuzzer-StrncmpTest -use_traces=1 -seed=1 -runs=100000 2>&1 | FileCheck %s -RUN: LLVMFuzzer-StrncmpTest -seed=1 -runs=1000000 2>&1 | FileCheck %s --check-prefix=Done1000000 - -RUN: not LLVMFuzzer-StrcmpTest -use_traces=1 -seed=1 -runs=200000 2>&1 | FileCheck %s -RUN: LLVMFuzzer-StrcmpTest -seed=1 -runs=1000000 2>&1 | FileCheck %s --check-prefix=Done1000000 - -RUN: not LLVMFuzzer-SwitchTest -use_traces=1 -seed=1 -runs=1000002 2>&1 | FileCheck %s -RUN: LLVMFuzzer-SwitchTest -seed=1 -runs=1000000 2>&1 | FileCheck %s --check-prefix=Done1000000 +RUN: not LLVMFuzzer-SwitchTest -use_traces=1 -seed=6 -runs=1000002 2>&1 | FileCheck %s +RUN: LLVMFuzzer-SwitchTest -seed=7 -runs=1000000 2>&1 | FileCheck %s --check-prefix=Done1000000 -RUN: not LLVMFuzzer-SimpleHashTest -use_traces=1 -seed=1 -runs=10000000 2>&1 | FileCheck %s -RUN: LLVMFuzzer-SimpleHashTest -seed=1 -runs=10000000 2>&1 | FileCheck %s --check-prefix=Done10000000 +RUN: not LLVMFuzzer-SimpleHashTest -use_traces=1 -seed=8 -runs=1000000 -max_len=16 2>&1 | FileCheck %s +RUN: LLVMFuzzer-SimpleHashTest -seed=9 -runs=1000000 -max_len=16 2>&1 | FileCheck %s --check-prefix=Done1000000 diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-trunc.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-trunc.test new file mode 100644 index 00000000000..ebab7b863a0 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-trunc.test @@ -0,0 +1,10 @@ +# Test truncate_units option. +RUN: rm -rf FuzzerTruncateTestCORPUS +RUN: mkdir FuzzerTruncateTestCORPUS +RUN: echo "01234567890123456789012345678901234567890" > FuzzerTruncateTestCORPUS/unit1 +# Simply running a fuzzer won't produce new results +RUN: LLVMFuzzer-EmptyTest -seed=1 -runs=100 -truncate_units=0 ./FuzzerTruncateTestCORPUS +# Truncating would create a new unit of length 1. +RUN: LLVMFuzzer-EmptyTest -seed=1 -runs=0 -truncate_units=1 ./FuzzerTruncateTestCORPUS +RUN: find FuzzerTruncateTestCORPUS/b6589fc6ab0dc82cf12099d1c2d40ab994e8410c +RUN: rm -rf FuzzerTruncateTestCORPUS diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer-ubsan.test b/gnu/llvm/lib/Fuzzer/test/fuzzer-ubsan.test new file mode 100644 index 00000000000..0e8ad6c94a1 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer-ubsan.test @@ -0,0 +1,4 @@ +RUN: not LLVMFuzzer-SignedIntOverflowTest-Ubsan 2>&1 | FileCheck %s +CHECK: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int' +CHECK: Test unit written to ./crash- + diff --git a/gnu/llvm/lib/Fuzzer/test/fuzzer.test b/gnu/llvm/lib/Fuzzer/test/fuzzer.test index c63014f59d6..11343ae3834 100644 --- a/gnu/llvm/lib/Fuzzer/test/fuzzer.test +++ b/gnu/llvm/lib/Fuzzer/test/fuzzer.test @@ -2,19 +2,25 @@ CHECK: BINGO Done1000000: Done 1000000 runs in RUN: LLVMFuzzer-SimpleTest 2>&1 | FileCheck %s -RUN: not LLVMFuzzer-NullDerefTest -test_single_input=%S/hi.txt 2>&1 | FileCheck %s --check-prefix=SingleInput -SingleInput-NOT: Test unit written to ./crash- + +# only_ascii mode. Will perform some minimal self-validation. +RUN: LLVMFuzzer-SimpleTest -only_ascii=1 2>&1 RUN: LLVMFuzzer-SimpleCmpTest -max_total_time=1 2>&1 | FileCheck %s --check-prefix=MaxTotalTime MaxTotalTime: Done {{.*}} runs in {{.}} second(s) -RUN: not LLVMFuzzer-NullDerefTest 2>&1 | FileCheck %s --check-prefix=NullDerefTest +RUN: not LLVMFuzzer-NullDerefTest 2>&1 | FileCheck %s --check-prefix=NullDerefTest +RUN: not LLVMFuzzer-NullDerefTest -close_fd_mask=3 2>&1 | FileCheck %s --check-prefix=NullDerefTest +NullDerefTest: ERROR: AddressSanitizer: SEGV on unknown address NullDerefTest: Test unit written to ./crash- RUN: not LLVMFuzzer-NullDerefTest -artifact_prefix=ZZZ 2>&1 | FileCheck %s --check-prefix=NullDerefTestPrefix NullDerefTestPrefix: Test unit written to ZZZcrash- RUN: not LLVMFuzzer-NullDerefTest -artifact_prefix=ZZZ -exact_artifact_path=FOOBAR 2>&1 | FileCheck %s --check-prefix=NullDerefTestExactPath NullDerefTestExactPath: Test unit written to FOOBAR +RUN: not LLVMFuzzer-NullDerefOnEmptyTest -print_final_stats=1 2>&1 | FileCheck %s --check-prefix=NULL_DEREF_ON_EMPTY +NULL_DEREF_ON_EMPTY: stat::number_of_executed_units: + #not LLVMFuzzer-FullCoverageSetTest -timeout=15 -seed=1 -mutate_depth=2 -use_full_coverage_set=1 2>&1 | FileCheck %s RUN: not LLVMFuzzer-CounterTest -use_counters=1 -max_len=6 -seed=1 -timeout=15 2>&1 | FileCheck %s @@ -23,14 +29,15 @@ RUN: not LLVMFuzzer-CallerCalleeTest -cross_over=0 -max_len= # This one is flaky, may actually find the goal even w/o use_indir_calls. # LLVMFuzzer-CallerCalleeTest -use_indir_calls=0 -cross_over=0 -max_len=6 -seed=1 -runs=1000000 2>&1 | FileCheck %s --check-prefix=Done1000000 - -RUN: not LLVMFuzzer-UserSuppliedFuzzerTest -seed=1 -timeout=15 2>&1 | FileCheck %s - RUN: not LLVMFuzzer-UninstrumentedTest-Uninstrumented 2>&1 | FileCheck %s --check-prefix=UNINSTRUMENTED UNINSTRUMENTED: ERROR: __sanitizer_set_death_callback is not defined. Exiting. -RUN: LLVMFuzzer-SimpleTest -print_new_cov_pcs=1 2>&1 | FileCheck %s --check-prefix=PCS -PCS:{{^0x[a-f0-9]+}} -PCS:NEW -PCS:BINGO +RUN: not LLVMFuzzer-UninstrumentedTest-NoCoverage 2>&1 | FileCheck %s --check-prefix=NO_COVERAGE +NO_COVERAGE: ERROR: no interesting inputs were found. Is the code instrumented for coverage? Exiting + +RUN: not LLVMFuzzer-BufferOverflowOnInput 2>&1 | FileCheck %s --check-prefix=OOB +OOB: AddressSanitizer: heap-buffer-overflow +OOB: is located 0 bytes to the right of 3-byte region + +RUN: not LLVMFuzzer-InitializeTest 2>&1 | FileCheck %s diff --git a/gnu/llvm/lib/Fuzzer/test/lit.cfg b/gnu/llvm/lib/Fuzzer/test/lit.cfg index 2140a97668b..e262e3c2585 100644 --- a/gnu/llvm/lib/Fuzzer/test/lit.cfg +++ b/gnu/llvm/lib/Fuzzer/test/lit.cfg @@ -1,4 +1,5 @@ import lit.formats +import sys config.name = "LLVMFuzzer" config.test_format = lit.formats.ShTest(True) @@ -13,3 +14,22 @@ path = os.path.pathsep.join((llvm_tools_dir, config.test_exec_root, config.environment['PATH'])) config.environment['PATH'] = path +if config.has_dfsan: + lit_config.note('dfsan feature available') + config.available_features.add('dfsan') +else: + lit_config.note('dfsan feature unavailable') + +if config.has_lsan: + lit_config.note('lsan feature available') + config.available_features.add('lsan') +else: + lit_config.note('lsan feature unavailable') + +if sys.platform.startswith('linux'): + # Note the value of ``sys.platform`` is not consistent + # between python 2 and 3, hence the use of ``.startswith()``. + lit_config.note('linux feature available') + config.available_features.add('linux') +else: + lit_config.note('linux feature unavailable') diff --git a/gnu/llvm/lib/Fuzzer/test/lit.site.cfg.in b/gnu/llvm/lib/Fuzzer/test/lit.site.cfg.in index e520db8e881..95ad6d0ab17 100644 --- a/gnu/llvm/lib/Fuzzer/test/lit.site.cfg.in +++ b/gnu/llvm/lib/Fuzzer/test/lit.site.cfg.in @@ -1,3 +1,5 @@ config.test_exec_root = "@CMAKE_CURRENT_BINARY_DIR@" config.llvm_tools_dir = "@LLVM_TOOLS_DIR@" +config.has_dfsan = True if @HAS_DFSAN@ == 1 else False +config.has_lsan = True if @HAS_LSAN@ == 1 else False lit_config.load_config(config, "@CMAKE_CURRENT_SOURCE_DIR@/lit.cfg") diff --git a/gnu/llvm/lib/Fuzzer/test/merge.test b/gnu/llvm/lib/Fuzzer/test/merge.test index 57ecc141bbf..6f19e21d132 100644 --- a/gnu/llvm/lib/Fuzzer/test/merge.test +++ b/gnu/llvm/lib/Fuzzer/test/merge.test @@ -8,8 +8,8 @@ RUN: echo ..Z... > %tmp/T1/3 # T1 has 3 elements, T2 is empty. RUN: LLVMFuzzer-FullCoverageSetTest -merge=1 %tmp/T1 %tmp/T2 2>&1 | FileCheck %s --check-prefix=CHECK1 -CHECK1: Merge: running the initial corpus {{.*}} of 3 units -CHECK1: Merge: written 0 out of 0 units +CHECK1: === Minimizing the initial corpus of 3 units +CHECK1: === Merge: written 0 units RUN: echo ...Z.. > %tmp/T2/1 RUN: echo ....E. > %tmp/T2/2 @@ -20,10 +20,11 @@ RUN: echo ..Z... > %tmp/T2/c # T1 has 3 elements, T2 has 6 elements, only 3 are new. RUN: LLVMFuzzer-FullCoverageSetTest -merge=1 %tmp/T1 %tmp/T2 2>&1 | FileCheck %s --check-prefix=CHECK2 -CHECK2: Merge: running the initial corpus {{.*}} of 3 units -CHECK2: Merge: written 3 out of 6 units +CHECK2: === Minimizing the initial corpus of 3 units +CHECK2: === Merging extra 6 units +CHECK2: === Merge: written 3 units # Now, T1 has 6 units and T2 has no new interesting units. RUN: LLVMFuzzer-FullCoverageSetTest -merge=1 %tmp/T1 %tmp/T2 2>&1 | FileCheck %s --check-prefix=CHECK3 -CHECK3: Merge: running the initial corpus {{.*}} of 6 units -CHECK3: Merge: written 0 out of 6 units +CHECK3: === Minimizing the initial corpus of 6 units +CHECK3: === Merge: written 0 units diff --git a/gnu/llvm/lib/Fuzzer/test/no-coverage/CMakeLists.txt b/gnu/llvm/lib/Fuzzer/test/no-coverage/CMakeLists.txt new file mode 100644 index 00000000000..1dc7d15926c --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/no-coverage/CMakeLists.txt @@ -0,0 +1,16 @@ +# These tests are not instrumented with coverage, +# but have coverage rt in the binary. + +set(CMAKE_CXX_FLAGS + "${LIBFUZZER_FLAGS_BASE} -fno-sanitize-coverage=edge,trace-cmp,indirect-calls,8bit-counters") + +set(NoCoverageTests + UninstrumentedTest + ) + +foreach(Test ${NoCoverageTests}) + add_libfuzzer_test(${Test}-NoCoverage SOURCES ../${Test}.cpp) +endforeach() + +# Propagate value into parent directory +set(TestBinaries ${TestBinaries} PARENT_SCOPE) diff --git a/gnu/llvm/lib/Fuzzer/test/trace-bb/CMakeLists.txt b/gnu/llvm/lib/Fuzzer/test/trace-bb/CMakeLists.txt index 99af019565b..fd168c4515b 100644 --- a/gnu/llvm/lib/Fuzzer/test/trace-bb/CMakeLists.txt +++ b/gnu/llvm/lib/Fuzzer/test/trace-bb/CMakeLists.txt @@ -1,14 +1,15 @@ # These tests are not instrumented with coverage. -set(CMAKE_CXX_FLAGS_RELEASE +set(CMAKE_CXX_FLAGS "${LIBFUZZER_FLAGS_BASE} -fsanitize-coverage=edge,trace-bb") +set(TraceBBTests + SimpleTest + ) + foreach(Test ${TraceBBTests}) - add_executable(LLVMFuzzer-${Test}-TraceBB - ../${Test}.cpp - ) - target_link_libraries(LLVMFuzzer-${Test}-TraceBB - LLVMFuzzer - ) + add_libfuzzer_test(${Test}-TraceBB SOURCES ../${Test}.cpp) endforeach() +# Propagate value into parent directory +set(TestBinaries ${TestBinaries} PARENT_SCOPE) diff --git a/gnu/llvm/lib/Fuzzer/test/trace-pc/CMakeLists.txt b/gnu/llvm/lib/Fuzzer/test/trace-pc/CMakeLists.txt new file mode 100644 index 00000000000..cf18278ac64 --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/trace-pc/CMakeLists.txt @@ -0,0 +1,16 @@ +# These tests are not instrumented with coverage. + +set(CMAKE_CXX_FLAGS + "${LIBFUZZER_FLAGS_BASE} -fno-sanitize-coverage=8bit-counters -fsanitize-coverage=trace-pc") + +set(TracePCTests + FourIndependentBranchesTest + FullCoverageSetTest + ) + +foreach(Test ${TracePCTests}) + add_libfuzzer_test(${Test}-TracePC SOURCES ../${Test}.cpp) +endforeach() + +# Propagate value into parent directory +set(TestBinaries ${TestBinaries} PARENT_SCOPE) diff --git a/gnu/llvm/lib/Fuzzer/test/ubsan/CMakeLists.txt b/gnu/llvm/lib/Fuzzer/test/ubsan/CMakeLists.txt new file mode 100644 index 00000000000..7a9eacdbe7d --- /dev/null +++ b/gnu/llvm/lib/Fuzzer/test/ubsan/CMakeLists.txt @@ -0,0 +1,15 @@ +# These tests are instrumented with ubsan in non-recovery mode. + +set(CMAKE_CXX_FLAGS + "${LIBFUZZER_FLAGS_BASE} -fsanitize=undefined -fno-sanitize-recover=all") + +set(UbsanTests + SignedIntOverflowTest + ) + +foreach(Test ${UbsanTests}) + add_libfuzzer_test(${Test}-Ubsan SOURCES ../${Test}.cpp) +endforeach() + +# Propagate value into parent directory +set(TestBinaries ${TestBinaries} PARENT_SCOPE) diff --git a/gnu/llvm/lib/Fuzzer/test/uninstrumented/CMakeLists.txt b/gnu/llvm/lib/Fuzzer/test/uninstrumented/CMakeLists.txt index 443ba3716f6..06e48985e7e 100644 --- a/gnu/llvm/lib/Fuzzer/test/uninstrumented/CMakeLists.txt +++ b/gnu/llvm/lib/Fuzzer/test/uninstrumented/CMakeLists.txt @@ -1,14 +1,16 @@ -# These tests are not instrumented with coverage. +# These tests are not instrumented with coverage and don't +# have coverage rt in the binary. -set(CMAKE_CXX_FLAGS_RELEASE - "${LIBFUZZER_FLAGS_BASE} -O0 -fno-sanitize=all") +set(CMAKE_CXX_FLAGS + "${LIBFUZZER_FLAGS_BASE} -fno-sanitize=all -fno-sanitize-coverage=edge,trace-cmp,indirect-calls,8bit-counters") + +set(UninstrumentedTests + UninstrumentedTest + ) foreach(Test ${UninstrumentedTests}) - add_executable(LLVMFuzzer-${Test}-Uninstrumented - ../${Test}.cpp - ) - target_link_libraries(LLVMFuzzer-${Test}-Uninstrumented - LLVMFuzzer - ) + add_libfuzzer_test(${Test}-Uninstrumented SOURCES ../${Test}.cpp) endforeach() +# Propagate value into parent directory +set(TestBinaries ${TestBinaries} PARENT_SCOPE) |