[libFuzzer] Use custom allocators for STL containers in libFuzzer

Avoids ODR violations causing spurious ASAN container overflow warnings.

Differential Revision: https://reviews.llvm.org/D37086

llvm-svn: 311830
This commit is contained in:
George Karpenkov 2017-08-26 17:17:37 +00:00
parent de269f4620
commit d50410bfb1
18 changed files with 83 additions and 70 deletions

View File

@ -35,7 +35,7 @@ struct InputInfo {
size_t NumSuccessfullMutations = 0;
bool MayDeleteFile = false;
bool Reduced = false;
std::vector<uint32_t> UniqFeatureSet;
fuzzer::vector<uint32_t> UniqFeatureSet;
};
class InputCorpus {
@ -71,7 +71,7 @@ class InputCorpus {
bool empty() const { return Inputs.empty(); }
const Unit &operator[] (size_t Idx) const { return Inputs[Idx]->U; }
void AddToCorpus(const Unit &U, size_t NumFeatures, bool MayDeleteFile,
const std::vector<uint32_t> &FeatureSet) {
const fuzzer::vector<uint32_t> &FeatureSet) {
assert(!U.empty());
if (FeatureDebug)
Printf("ADD_TO_CORPUS %zd NF %zd\n", Inputs.size(), NumFeatures);
@ -100,7 +100,7 @@ class InputCorpus {
}
// Debug-only
void PrintFeatureSet(const std::vector<uint32_t> &FeatureSet) {
void PrintFeatureSet(const fuzzer::vector<uint32_t> &FeatureSet) {
if (!FeatureDebug) return;
Printf("{");
for (uint32_t Feature: FeatureSet)
@ -256,11 +256,11 @@ private:
}
std::piecewise_constant_distribution<double> CorpusDistribution;
std::vector<double> Intervals;
std::vector<double> Weights;
fuzzer::vector<double> Intervals;
fuzzer::vector<double> Weights;
std::unordered_set<std::string> Hashes;
std::vector<InputInfo*> Inputs;
fuzzer::vector<InputInfo*> Inputs;
size_t NumAddedFeatures = 0;
size_t NumUpdatedFeatures = 0;

View File

@ -18,6 +18,8 @@
#include <cstring>
#include <string>
#include <vector>
#include <set>
#include <memory>
// Platform detection.
#ifdef __linux__
@ -102,8 +104,19 @@ struct ExternalFunctions;
// Global interface to functions that may or may not be available.
extern ExternalFunctions *EF;
typedef std::vector<uint8_t> Unit;
typedef std::vector<Unit> UnitVector;
// We are using a custom allocator to give a different symbol name to STL
// containers in order to avoid ODR violations.
template<typename T>
class fuzzer_allocator: public std::allocator<T> {};
template<typename T>
using vector = std::vector<T, fuzzer_allocator<T>>;
template<typename T>
using set = std::set<T, std::less<T>, fuzzer_allocator<T>>;
typedef fuzzer::vector<uint8_t> Unit;
typedef fuzzer::vector<Unit> UnitVector;
typedef int (*UserCallback)(const uint8_t *Data, size_t Size);
int FuzzerDriver(int *argc, char ***argv, UserCallback Callback);

View File

@ -120,7 +120,7 @@ private:
bool ParseOneDictionaryEntry(const std::string &Str, Unit *U);
// Parses the dictionary file, fills Units, returns true iff all lines
// were parsed succesfully.
bool ParseDictionaryFile(const std::string &Text, std::vector<Unit> *Units);
bool ParseDictionaryFile(const std::string &Text, fuzzer::vector<Unit> *Units);
} // namespace fuzzer

View File

@ -74,7 +74,7 @@ static const FlagDescription FlagDescriptions [] {
static const size_t kNumFlags =
sizeof(FlagDescriptions) / sizeof(FlagDescriptions[0]);
static std::vector<std::string> *Inputs;
static fuzzer::vector<std::string> *Inputs;
static std::string *ProgName;
static void PrintHelp() {
@ -175,7 +175,7 @@ static bool ParseOneFlag(const char *Param) {
}
// We don't use any library to minimize dependencies.
static void ParseFlags(const std::vector<std::string> &Args) {
static void ParseFlags(const fuzzer::vector<std::string> &Args) {
for (size_t F = 0; F < kNumFlags; F++) {
if (FlagDescriptions[F].IntFlag)
*FlagDescriptions[F].IntFlag = FlagDescriptions[F].Default;
@ -185,7 +185,7 @@ static void ParseFlags(const std::vector<std::string> &Args) {
if (FlagDescriptions[F].StrFlag)
*FlagDescriptions[F].StrFlag = nullptr;
}
Inputs = new std::vector<std::string>;
Inputs = new fuzzer::vector<std::string>;
for (size_t A = 1; A < Args.size(); A++) {
if (ParseOneFlag(Args[A].c_str())) {
if (Flags.ignore_remaining_args)
@ -225,7 +225,7 @@ static void WorkerThread(const std::string &Cmd, std::atomic<unsigned> *Counter,
}
}
std::string CloneArgsWithoutX(const std::vector<std::string> &Args,
std::string CloneArgsWithoutX(const fuzzer::vector<std::string> &Args,
const char *X1, const char *X2) {
std::string Cmd;
for (auto &S : Args) {
@ -236,12 +236,12 @@ std::string CloneArgsWithoutX(const std::vector<std::string> &Args,
return Cmd;
}
static int RunInMultipleProcesses(const std::vector<std::string> &Args,
static int RunInMultipleProcesses(const fuzzer::vector<std::string> &Args,
unsigned NumWorkers, unsigned NumJobs) {
std::atomic<unsigned> Counter(0);
std::atomic<bool> HasErrors(false);
std::string Cmd = CloneArgsWithoutX(Args, "jobs", "workers");
std::vector<std::thread> V;
fuzzer::vector<std::thread> V;
std::thread Pulse(PulseThread);
Pulse.detach();
for (unsigned i = 0; i < NumWorkers; i++)
@ -294,7 +294,7 @@ static std::string GetDedupTokenFromFile(const std::string &Path) {
return S.substr(Beg, End - Beg);
}
int CleanseCrashInput(const std::vector<std::string> &Args,
int CleanseCrashInput(const fuzzer::vector<std::string> &Args,
const FuzzingOptions &Options) {
if (Inputs->size() != 1 || !Flags.exact_artifact_path) {
Printf("ERROR: -cleanse_crash should be given one input file and"
@ -322,7 +322,7 @@ int CleanseCrashInput(const std::vector<std::string> &Args,
auto U = FileToVector(CurrentFilePath);
size_t Size = U.size();
const std::vector<uint8_t> ReplacementBytes = {' ', 0xff};
const fuzzer::vector<uint8_t> ReplacementBytes = {' ', 0xff};
for (int NumAttempts = 0; NumAttempts < 5; NumAttempts++) {
bool Changed = false;
for (size_t Idx = 0; Idx < Size; Idx++) {
@ -354,7 +354,7 @@ int CleanseCrashInput(const std::vector<std::string> &Args,
return 0;
}
int MinimizeCrashInput(const std::vector<std::string> &Args,
int MinimizeCrashInput(const fuzzer::vector<std::string> &Args,
const FuzzingOptions &Options) {
if (Inputs->size() != 1) {
Printf("ERROR: -minimize_crash should be given one input file\n");
@ -456,17 +456,17 @@ int MinimizeCrashInputInternalStep(Fuzzer *F, InputCorpus *Corpus) {
return 0;
}
int AnalyzeDictionary(Fuzzer *F, const std::vector<Unit>& Dict,
int AnalyzeDictionary(Fuzzer *F, const fuzzer::vector<Unit>& Dict,
UnitVector& Corpus) {
Printf("Started dictionary minimization (up to %d tests)\n",
Dict.size() * Corpus.size() * 2);
// Scores and usage count for each dictionary unit.
std::vector<int> Scores(Dict.size());
std::vector<int> Usages(Dict.size());
fuzzer::vector<int> Scores(Dict.size());
fuzzer::vector<int> Usages(Dict.size());
std::vector<size_t> InitialFeatures;
std::vector<size_t> ModifiedFeatures;
fuzzer::vector<size_t> InitialFeatures;
fuzzer::vector<size_t> ModifiedFeatures;
for (auto &C : Corpus) {
// Get coverage for the testcase without modifications.
F->ExecuteCallback(C.data(), C.size());
@ -531,7 +531,7 @@ int FuzzerDriver(int *argc, char ***argv, UserCallback Callback) {
EF = new ExternalFunctions();
if (EF->LLVMFuzzerInitialize)
EF->LLVMFuzzerInitialize(argc, argv);
const std::vector<std::string> Args(*argv, *argv + *argc);
const fuzzer::vector<std::string> Args(*argv, *argv + *argc);
assert(!Args.empty());
ProgName = new std::string(Args[0]);
if (Argv0 != *ProgName) {
@ -593,7 +593,7 @@ int FuzzerDriver(int *argc, char ***argv, UserCallback Callback) {
Options.ArtifactPrefix = Flags.artifact_prefix;
if (Flags.exact_artifact_path)
Options.ExactArtifactPath = Flags.exact_artifact_path;
std::vector<Unit> Dictionary;
fuzzer::vector<Unit> Dictionary;
if (Flags.dict)
if (!ParseDictionaryFile(FileToString(Flags.dict), &Dictionary))
return 1;

View File

@ -68,10 +68,10 @@ void WriteToFile(const Unit &U, const std::string &Path) {
fclose(Out);
}
void ReadDirToVectorOfUnits(const char *Path, std::vector<Unit> *V,
void ReadDirToVectorOfUnits(const char *Path, fuzzer::vector<Unit> *V,
long *Epoch, size_t MaxSize, bool ExitOnError) {
long E = Epoch ? *Epoch : 0;
std::vector<std::string> Files;
fuzzer::vector<std::string> Files;
ListFilesInDirRecursive(Path, Epoch, &Files, /*TopDir*/true);
size_t NumLoaded = 0;
for (size_t i = 0; i < Files.size(); i++) {

View File

@ -27,7 +27,7 @@ void CopyFileToErr(const std::string &Path);
void WriteToFile(const Unit &U, const std::string &Path);
void ReadDirToVectorOfUnits(const char *Path, std::vector<Unit> *V,
void ReadDirToVectorOfUnits(const char *Path, fuzzer::vector<Unit> *V,
long *Epoch, size_t MaxSize, bool ExitOnError);
// Returns "Dir/FileName" or equivalent for the current OS.
@ -55,7 +55,7 @@ void RawPrint(const char *Str);
bool IsFile(const std::string &Path);
void ListFilesInDirRecursive(const std::string &Dir, long *Epoch,
std::vector<std::string> *V, bool TopDir);
fuzzer::vector<std::string> *V, bool TopDir);
char GetSeparator();

View File

@ -33,7 +33,7 @@ bool IsFile(const std::string &Path) {
}
void ListFilesInDirRecursive(const std::string &Dir, long *Epoch,
std::vector<std::string> *V, bool TopDir) {
fuzzer::vector<std::string> *V, bool TopDir) {
auto E = GetEpoch(Dir);
if (Epoch)
if (E && *Epoch >= E) return;

View File

@ -73,7 +73,7 @@ bool IsFile(const std::string &Path) {
}
void ListFilesInDirRecursive(const std::string &Dir, long *Epoch,
std::vector<std::string> *V, bool TopDir) {
fuzzer::vector<std::string> *V, bool TopDir) {
auto E = GetEpoch(Dir);
if (Epoch)
if (E && *Epoch >= E) return;

View File

@ -69,9 +69,9 @@ public:
InputInfo *II = nullptr);
// Merge Corpora[1:] into Corpora[0].
void Merge(const std::vector<std::string> &Corpora);
void CrashResistantMerge(const std::vector<std::string> &Args,
const std::vector<std::string> &Corpora,
void Merge(const fuzzer::vector<std::string> &Corpora);
void CrashResistantMerge(const fuzzer::vector<std::string> &Args,
const fuzzer::vector<std::string> &Corpora,
const char *CoverageSummaryInputPathOrNull,
const char *CoverageSummaryOutputPathOrNull);
void CrashResistantMergeInternalStep(const std::string &ControlFilePath);
@ -139,7 +139,7 @@ private:
size_t MaxMutationLen = 0;
size_t TmpMaxMutationLen = 0;
std::vector<uint32_t> UniqFeatureSetTmp;
fuzzer::vector<uint32_t> UniqFeatureSetTmp;
// Need to know our own thread.
static thread_local bool IsMyThread;

View File

@ -350,7 +350,7 @@ void Fuzzer::CheckExitOnSrcPosOrItem() {
void Fuzzer::RereadOutputCorpus(size_t MaxSize) {
if (Options.OutputCorpus.empty() || !Options.ReloadIntervalSec) return;
std::vector<Unit> AdditionalCorpus;
fuzzer::vector<Unit> AdditionalCorpus;
ReadDirToVectorOfUnits(Options.OutputCorpus.c_str(), &AdditionalCorpus,
&EpochOfLastReadOfOutputCorpus, MaxSize,
/*ExitOnError*/ false);

View File

@ -74,7 +74,7 @@ bool Merger::Parse(std::istream &IS, bool ParseCoverage) {
size_t ExpectedStartMarker = 0;
const size_t kInvalidStartMarker = -1;
size_t LastSeenStartMarker = kInvalidStartMarker;
std::vector<uint32_t> TmpFeatures;
fuzzer::vector<uint32_t> TmpFeatures;
while (std::getline(IS, Line, '\n')) {
std::istringstream ISS1(Line);
std::string Marker;
@ -123,7 +123,7 @@ size_t Merger::ApproximateMemoryConsumption() const {
// Decides which files need to be merged (add thost to NewFiles).
// Returns the number of new features added.
size_t Merger::Merge(const std::set<uint32_t> &InitialFeatures,
std::vector<std::string> *NewFiles) {
fuzzer::vector<std::string> *NewFiles) {
NewFiles->clear();
assert(NumFilesInFirstCorpus <= Files.size());
std::set<uint32_t> AllFeatures(InitialFeatures);
@ -138,7 +138,7 @@ size_t Merger::Merge(const std::set<uint32_t> &InitialFeatures,
// Remove all features that we already know from all other inputs.
for (size_t i = NumFilesInFirstCorpus; i < Files.size(); i++) {
auto &Cur = Files[i].Features;
std::vector<uint32_t> Tmp;
fuzzer::vector<uint32_t> Tmp;
std::set_difference(Cur.begin(), Cur.end(), AllFeatures.begin(),
AllFeatures.end(), std::inserter(Tmp, Tmp.begin()));
Cur.swap(Tmp);
@ -252,15 +252,15 @@ void Fuzzer::CrashResistantMergeInternalStep(const std::string &CFPath) {
}
// Outer process. Does not call the target code and thus sohuld not fail.
void Fuzzer::CrashResistantMerge(const std::vector<std::string> &Args,
const std::vector<std::string> &Corpora,
void Fuzzer::CrashResistantMerge(const fuzzer::vector<std::string> &Args,
const fuzzer::vector<std::string> &Corpora,
const char *CoverageSummaryInputPathOrNull,
const char *CoverageSummaryOutputPathOrNull) {
if (Corpora.size() <= 1) {
Printf("Merge requires two or more corpus dirs\n");
return;
}
std::vector<std::string> AllFiles;
fuzzer::vector<std::string> AllFiles;
ListFilesInDirRecursive(Corpora[0], nullptr, &AllFiles, /*TopDir*/true);
size_t NumFilesInFirstCorpus = AllFiles.size();
for (size_t i = 1; i < Corpora.size(); i++)
@ -318,7 +318,7 @@ void Fuzzer::CrashResistantMerge(const std::vector<std::string> &Args,
std::ofstream SummaryOut(CoverageSummaryOutputPathOrNull);
M.PrintSummary(SummaryOut);
}
std::vector<std::string> NewFiles;
fuzzer::vector<std::string> NewFiles;
std::set<uint32_t> InitialFeatures;
if (CoverageSummaryInputPathOrNull) {
std::ifstream SummaryIn(CoverageSummaryInputPathOrNull);

View File

@ -52,11 +52,11 @@ namespace fuzzer {
struct MergeFileInfo {
std::string Name;
size_t Size = 0;
std::vector<uint32_t> Features;
fuzzer::vector<uint32_t> Features;
};
struct Merger {
std::vector<MergeFileInfo> Files;
fuzzer::vector<MergeFileInfo> Files;
size_t NumFilesInFirstCorpus = 0;
size_t FirstNotProcessedFile = 0;
std::string LastFailure;
@ -67,8 +67,8 @@ struct Merger {
void PrintSummary(std::ostream &OS);
std::set<uint32_t> ParseSummary(std::istream &IS);
size_t Merge(const std::set<uint32_t> &InitialFeatures,
std::vector<std::string> *NewFiles);
size_t Merge(std::vector<std::string> *NewFiles) {
fuzzer::vector<std::string> *NewFiles);
size_t Merge(fuzzer::vector<std::string> *NewFiles) {
return Merge(std::set<uint32_t>{}, NewFiles);
}
size_t ApproximateMemoryConsumption() const;

View File

@ -466,7 +466,7 @@ void MutationDispatcher::RecordSuccessfulMutationSequence() {
}
void MutationDispatcher::PrintRecommendedDictionary() {
std::vector<DictionaryEntry> V;
fuzzer::vector<DictionaryEntry> V;
for (auto &DE : PersistentAutoDictionary)
if (!ManualDictionary.ContainsWord(DE.GetW()))
V.push_back(DE);
@ -506,7 +506,7 @@ size_t MutationDispatcher::DefaultMutate(uint8_t *Data, size_t Size,
// Mutates Data in place, returns new size.
size_t MutationDispatcher::MutateImpl(uint8_t *Data, size_t Size,
size_t MaxSize,
const std::vector<Mutator> &Mutators) {
const fuzzer::vector<Mutator> &Mutators) {
assert(MaxSize > 0);
// Some mutations may fail (e.g. can't insert more bytes if Size == MaxSize),
// in which case they will return 0.

View File

@ -96,7 +96,7 @@ private:
size_t AddWordFromDictionary(Dictionary &D, uint8_t *Data, size_t Size,
size_t MaxSize);
size_t MutateImpl(uint8_t *Data, size_t Size, size_t MaxSize,
const std::vector<Mutator> &Mutators);
const fuzzer::vector<Mutator> &Mutators);
size_t InsertPartOf(const uint8_t *From, size_t FromSize, uint8_t *To,
size_t ToSize, size_t MaxToSize);
@ -128,21 +128,21 @@ private:
// entries that led to successfull discoveries in the past mutations.
Dictionary PersistentAutoDictionary;
std::vector<Mutator> CurrentMutatorSequence;
std::vector<DictionaryEntry *> CurrentDictionaryEntrySequence;
fuzzer::vector<Mutator> CurrentMutatorSequence;
fuzzer::vector<DictionaryEntry *> CurrentDictionaryEntrySequence;
static const size_t kCmpDictionaryEntriesDequeSize = 16;
DictionaryEntry CmpDictionaryEntriesDeque[kCmpDictionaryEntriesDequeSize];
size_t CmpDictionaryEntriesDequeIdx = 0;
const InputCorpus *Corpus = nullptr;
std::vector<uint8_t> MutateInPlaceHere;
fuzzer::vector<uint8_t> MutateInPlaceHere;
// CustomCrossOver needs its own buffer as a custom implementation may call
// LLVMFuzzerMutate, which in turn may resize MutateInPlaceHere.
std::vector<uint8_t> CustomCrossOverInPlaceHere;
fuzzer::vector<uint8_t> CustomCrossOverInPlaceHere;
std::vector<Mutator> Mutators;
std::vector<Mutator> DefaultMutators;
fuzzer::vector<Mutator> Mutators;
fuzzer::vector<Mutator> DefaultMutators;
};
} // namespace fuzzer

View File

@ -270,7 +270,7 @@ void TracePC::PrintCoverage() {
void TracePC::DumpCoverage() {
if (EF->__sanitizer_dump_coverage) {
std::vector<uintptr_t> PCsCopy(GetNumPCs());
fuzzer::vector<uintptr_t> PCsCopy(GetNumPCs());
for (size_t i = 0; i < GetNumPCs(); i++)
PCsCopy[i] = PCs()[i] ? GetPreviousInstructionPc(PCs()[i]) : 0;
EF->__sanitizer_dump_coverage(PCsCopy.data(), PCsCopy.size());

View File

@ -124,7 +124,7 @@ bool ParseOneDictionaryEntry(const std::string &Str, Unit *U) {
return true;
}
bool ParseDictionaryFile(const std::string &Text, std::vector<Unit> *Units) {
bool ParseDictionaryFile(const std::string &Text, fuzzer::vector<Unit> *Units) {
if (Text.empty()) {
Printf("ParseDictionaryFile: file does not exist or is empty\n");
return false;

View File

@ -57,10 +57,10 @@ FILE *OpenProcessPipe(const char *Command, const char *Mode);
const void *SearchMemory(const void *haystack, size_t haystacklen,
const void *needle, size_t needlelen);
std::string CloneArgsWithoutX(const std::vector<std::string> &Args,
std::string CloneArgsWithoutX(const fuzzer::vector<std::string> &Args,
const char *X1, const char *X2);
inline std::string CloneArgsWithoutX(const std::vector<std::string> &Args,
inline std::string CloneArgsWithoutX(const fuzzer::vector<std::string> &Args,
const char *X) {
return CloneArgsWithoutX(Args, X, X);
}

View File

@ -526,7 +526,7 @@ TEST(FuzzerDictionary, ParseOneDictionaryEntry) {
}
TEST(FuzzerDictionary, ParseDictionaryFile) {
std::vector<Unit> Units;
fuzzer::vector<Unit> Units;
EXPECT_FALSE(ParseDictionaryFile("zzz\n", &Units));
EXPECT_FALSE(ParseDictionaryFile("", &Units));
EXPECT_TRUE(ParseDictionaryFile("\n", &Units));
@ -538,11 +538,11 @@ TEST(FuzzerDictionary, ParseDictionaryFile) {
EXPECT_TRUE(ParseDictionaryFile(" #zzzz\n", &Units));
EXPECT_EQ(Units.size(), 0U);
EXPECT_TRUE(ParseDictionaryFile(" #zzzz\naaa=\"aa\"", &Units));
EXPECT_EQ(Units, std::vector<Unit>({Unit({'a', 'a'})}));
EXPECT_EQ(Units, fuzzer::vector<Unit>({Unit({'a', 'a'})}));
EXPECT_TRUE(
ParseDictionaryFile(" #zzzz\naaa=\"aa\"\n\nabc=\"abc\"", &Units));
EXPECT_EQ(Units,
std::vector<Unit>({Unit({'a', 'a'}), Unit({'a', 'b', 'c'})}));
fuzzer::vector<Unit>({Unit({'a', 'a'}), Unit({'a', 'b', 'c'})}));
}
TEST(FuzzerUtil, Base64) {
@ -566,7 +566,7 @@ TEST(Corpus, Distribution) {
for (size_t i = 0; i < N; i++)
C->AddToCorpus(Unit{ static_cast<uint8_t>(i) }, 1, false, {});
std::vector<size_t> Hist(N);
fuzzer::vector<size_t> Hist(N);
for (size_t i = 0; i < N * TriesPerUnit; i++) {
Hist[C->ChooseUnitIdxToMutate(Rand)]++;
}
@ -596,21 +596,21 @@ TEST(Merge, Bad) {
}
}
void EQ(const std::vector<uint32_t> &A, const std::vector<uint32_t> &B) {
void EQ(const fuzzer::vector<uint32_t> &A, const fuzzer::vector<uint32_t> &B) {
EXPECT_EQ(A, B);
}
void EQ(const std::vector<std::string> &A, const std::vector<std::string> &B) {
void EQ(const fuzzer::vector<std::string> &A, const fuzzer::vector<std::string> &B) {
std::set<std::string> a(A.begin(), A.end());
std::set<std::string> b(B.begin(), B.end());
EXPECT_EQ(a, b);
}
static void Merge(const std::string &Input,
const std::vector<std::string> Result,
const fuzzer::vector<std::string> Result,
size_t NumNewFeatures) {
Merger M;
std::vector<std::string> NewFiles;
fuzzer::vector<std::string> NewFiles;
EXPECT_TRUE(M.Parse(Input, true));
std::stringstream SS;
M.PrintSummary(SS);
@ -658,7 +658,7 @@ TEST(Merge, Good) {
EQ(M.Files[1].Features, {4, 5, 6});
std::vector<std::string> NewFiles;
fuzzer::vector<std::string> NewFiles;
EXPECT_TRUE(M.Parse("3\n2\nAA\nBB\nC\n"
"STARTED 0 1000\nDONE 0 1 2 3\n"
@ -739,7 +739,7 @@ TEST(Fuzzer, ForEachNonZeroByte) {
0, 0, 0, 0, 0, 0, 0, 8,
9, 9, 9, 9, 9, 9, 9, 9,
};
typedef std::vector<std::pair<size_t, uint8_t> > Vec;
typedef fuzzer::vector<std::pair<size_t, uint8_t> > Vec;
Vec Res, Expected;
auto CB = [&](size_t FirstFeature, size_t Idx, uint8_t V) {
Res.push_back({FirstFeature + Idx, V});