maxjhandsome
/
llvm-project
forked from OSchip/llvm-project
1
0
Fork 0
Code Issues Pull Requests Packages Releases Wiki Activity

[libFuzzer] when tracing switch statements, handle only one case at a time (to make things faster). Also ensure that the signals from value profile do not intersect with the regular coverage 

llvm-svn: 290031
This commit is contained in:
Kostya Serebryany 2016-12-17 02:03:34 +00:00
parent 95294127d0
commit 00e638e642
3 changed files with 16 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
llvm/lib/Fuzzer/FuzzerTracePC.cpp
View File

@ -290,12 +290,22 @@ void __sanitizer_cov_trace_cmp1(uint8_t Arg1, uint8_t Arg2) {
__attribute__((visibility("default")))
void __sanitizer_cov_trace_switch(uint64_t Val, uint64_t *Cases) {
// Updates the value profile based on the relative position of Val and Cases.
// We want to handle one random case at every call (handling all is slow).
// Since none of the arguments contain any random bits we use a thread-local
// counter to choose the random case to handle.
static thread_local size_t Counter;
Counter++;
uint64_t N = Cases[0];
uint64_t *Vals = Cases + 2;
char *PC = (char*)__builtin_return_address(0);
for (size_t i = 0; i < N; i++)
if (Val != Vals[i])
fuzzer::TPC.HandleCmp(PC + i, Val, Vals[i]);
size_t Idx = Counter % N;
uint64_t TwoIn32 = 1ULL << 32;
if ((Val | Vals[Idx]) < TwoIn32)
fuzzer::TPC.HandleCmp(PC + Idx, static_cast<uint32_t>(Val),
static_cast<uint32_t>(Vals[Idx]));
else
fuzzer::TPC.HandleCmp(PC + Idx, Val, Vals[Idx]);
}
__attribute__((visibility("default")))

2
llvm/lib/Fuzzer/FuzzerTracePC.h
View File

@ -144,7 +144,7 @@ size_t TracePC::CollectFeatures(Callback CB) {
}
if (UseValueProfile)
ValueProfileMap.ForEach([&](size_t Idx) {
if (CB(NumGuards + Idx))
if (CB(NumGuards * 8 + Idx))
Res++;
});
return Res;

4
llvm/lib/Fuzzer/test/SwitchTest.cpp
View File

@ -20,8 +20,8 @@ bool Switch(const uint8_t *Data, size_t Size) {
case 101: Sink = __LINE__; break;
case 1001: Sink = __LINE__; break;
case 10001: Sink = __LINE__; break;
case 100001: Sink = __LINE__; break;
case 1000001: Sink = __LINE__; break;
// case 100001: Sink = __LINE__; break;
// case 1000001: Sink = __LINE__; break;
case 10000001: Sink = __LINE__; break;
case 100000001: return true;
}