maxjhandsome
/
llvm-project
forked from OSchip/llvm-project
1
0
Fork 0
Code Issues Pull Requests Packages Releases Wiki Activity

[libFuzzer] use data-flow feedback from strcmp 

llvm-svn: 244084
This commit is contained in:
Kostya Serebryany 2015-08-05 18:23:01 +00:00
parent dd8b3952b8
commit 7f4227d59a
5 changed files with 45 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
llvm/docs/LibFuzzer.rst
View File

@ -282,7 +282,7 @@ Data-flow-guided fuzzing
With an additional compiler flag ``-fsanitize-coverage=trace-cmp`` (see SanitizerCoverageTraceDataFlow_)
and extra run-time flag ``-use_traces=1`` the fuzzer will try to apply *data-flow-guided fuzzing*.
That is, the fuzzer will record the inputs to comparison instructions, switch statements,
and several libc functions (``memcmp``, ``strncmp``, etc).
and several libc functions (``memcmp``, ``strcmp``, ``strncmp``, etc).
It will later use those recorded inputs during mutations.
This mode can be combined with DataFlowSanitizer_ to achieve better sensitivity.

38
llvm/lib/Fuzzer/FuzzerTraceState.cpp
View File

@ -356,8 +356,9 @@ void TraceState::TraceCmpCallback(uintptr_t PC, size_t CmpSize, size_t CmpType,
CSP->Counter[ComputeCmp(CmpSize, CmpType, Arg1, Arg2)]++;
size_t C0 = CSP->Counter[0];
size_t C1 = CSP->Counter[1];
if (!CSP->IsInterestingCmpTarget())
return;
// FIXME: is this a good idea or a bad?
// if (!CSP->IsInterestingCmpTarget())
// return;
if (Options.Verbosity >= 3)
Printf("TraceCmp: %p %zd/%zd; %zd %zd\n", CSP->PC, C0, C1, Arg1, Arg2);
Added += TryToAddDesiredData(Arg1, Arg2, CmpSize);
@ -479,6 +480,23 @@ void dfsan_weak_hook_strncmp(void *caller_pc, const char *s1, const char *s2,
TS->DFSanCmpCallback(PC, n, fuzzer::ICMP_EQ, S1, S2, L1, L2);
}
void dfsan_weak_hook_strcmp(void *caller_pc, const char *s1, const char *s2,
dfsan_label s1_label, dfsan_label s2_label) {
if (!TS) return;
uintptr_t PC = reinterpret_cast<uintptr_t>(caller_pc);
uint64_t S1 = 0, S2 = 0;
size_t Len1 = strlen(s1);
size_t Len2 = strlen(s2);
size_t N = std::min(Len1, Len2);
if (N <= 1) return; // Not interesting.
// Simplification: handle only first 8 bytes.
memcpy(&S1, s1, std::min(N, sizeof(S1)));
memcpy(&S2, s2, std::min(N, sizeof(S2)));
dfsan_label L1 = dfsan_read_label(s1, Len1);
dfsan_label L2 = dfsan_read_label(s2, Len2);
TS->DFSanCmpCallback(PC, N, fuzzer::ICMP_EQ, S1, S2, L1, L2);
}
void __sanitizer_weak_hook_memcmp(void *caller_pc, const void *s1,
const void *s2, size_t n) {
if (!TS) return;
@ -506,6 +524,22 @@ void __sanitizer_weak_hook_strncmp(void *caller_pc, const char *s1,
TS->TraceCmpCallback(PC, n, fuzzer::ICMP_EQ, S1, S2);
}
void __sanitizer_weak_hook_strcmp(void *caller_pc, const char *s1,
const char *s2) {
if (!TS) return;
uintptr_t PC = reinterpret_cast<uintptr_t>(caller_pc);
uint64_t S1 = 0, S2 = 0;
size_t Len1 = strlen(s1);
size_t Len2 = strlen(s2);
size_t N = std::min(Len1, Len2);
if (N <= 1) return; // Not interesting.
// Simplification: handle only first 8 bytes.
memcpy(&S1, s1, std::min(N, sizeof(S1)));
memcpy(&S2, s2, std::min(N, sizeof(S2)));
TS->TraceCmpCallback(PC, N, fuzzer::ICMP_EQ, S1, S2);
}
void __sanitizer_cov_trace_cmp(uint64_t SizeAndType, uint64_t Arg1,
uint64_t Arg2) {
if (!TS) return;

2
llvm/lib/Fuzzer/test/CMakeLists.txt
View File

@ -7,6 +7,7 @@ set(CMAKE_CXX_FLAGS_RELEASE "${LIBFUZZER_FLAGS_BASE} -O0 -fsanitize-coverage=edg
set(DFSanTests
MemcmpTest
SimpleCmpTest
StrcmpTest
StrncmpTest
SwitchTest
)
@ -21,6 +22,7 @@ set(Tests
NullDerefTest
SimpleCmpTest
SimpleTest
StrcmpTest
StrncmpTest
SwitchTest
TimeoutTest

3
llvm/lib/Fuzzer/test/fuzzer-dfsan.test
View File

@ -15,5 +15,8 @@ RUN: LLVMFuzzer-MemcmpTest-DFSan -use_traces=1 -seed=1 -runs=2 -timeout=5 -verbo
RUN: not LLVMFuzzer-StrncmpTest-DFSan -use_traces=1 -seed=1 -runs=10000 -timeout=5 2>&1 | FileCheck %s --check-prefix=CHECK3
RUN: LLVMFuzzer-StrncmpTest-DFSan -use_traces=1 -seed=1 -runs=2 -timeout=5 -verbosity=3 2>&1 | FileCheck %s -check-prefix=CHECK_DFSanCmpCallback
RUN: not LLVMFuzzer-StrcmpTest-DFSan -use_traces=1 -seed=1 -runs=10000 -timeout=5 2>&1 | FileCheck %s --check-prefix=CHECK3
RUN: LLVMFuzzer-StrcmpTest-DFSan -use_traces=1 -seed=1 -runs=2 -timeout=5 -verbosity=3 2>&1 | FileCheck %s -check-prefix=CHECK_DFSanCmpCallback
RUN: not LLVMFuzzer-SwitchTest-DFSan -use_traces=1 -seed=1 -runs=100000 -timeout=5 2>&1 | FileCheck %s --check-prefix=CHECK4
RUN: LLVMFuzzer-SwitchTest-DFSan -use_traces=1 -seed=1 -runs=2 -timeout=5 -verbosity=3 2>&1 | FileCheck %s -check-prefix=CHECK_DFSanSwitchCallback

3
llvm/lib/Fuzzer/test/fuzzer.test
View File

@ -32,5 +32,8 @@ Done1000000: Done 1000000 runs in
RUN: not LLVMFuzzer-StrncmpTest -use_traces=1 -seed=1 -runs=10000 2>&1 | FileCheck %s
RUN: LLVMFuzzer-StrncmpTest -seed=1 -runs=1000000 2>&1 | FileCheck %s --check-prefix=Done1000000
RUN: not LLVMFuzzer-StrcmpTest -use_traces=1 -seed=1 -runs=10000 2>&1 | FileCheck %s
RUN: LLVMFuzzer-StrcmpTest -seed=1 -runs=1000000 2>&1 | FileCheck %s --check-prefix=Done1000000
RUN: not LLVMFuzzer-SwitchTest -use_traces=1 -seed=1 -runs=1000000 2>&1 | FileCheck %s
RUN: LLVMFuzzer-SwitchTest -seed=1 -runs=1000000 2>&1 | FileCheck %s --check-prefix=Done1000000