Commit Graph

88 Commits

Author SHA1 Message Date
Kostya Serebryany c135b55ae0 [libFuzzer] add hooks for strstr, strcasestr, strcasecmp, strncasecmp
llvm-svn: 275648
2016-07-15 23:27:19 +00:00
Mike Aizatsky f0b3e85f4e [libfuzzer] moving is_ascii handler inside mutation dispatcher.
Summary: It also fixes a bug, when first random might not be ascii.

Differential Revision: http://reviews.llvm.org/D21573

llvm-svn: 273611
2016-06-23 20:44:48 +00:00
Kostya Serebryany 042d1a7b04 [libFuzzer] make the single-run output more reliable
llvm-svn: 272998
2016-06-17 13:07:06 +00:00
Dan Liew 1873a496e2 [LibFuzzer] Declare and use sanitizer functions in ``fuzzer::ExternalFunctions``
This fixes linking problems on OSX.

Unfortunately it turns out we need to use an instance of the
``fuzzer::ExternalFunctions`` object in several places so this
commit also replaces all instances with a single global instance.

It also turns out initializing a global ``fuzzer::ExternalFunctions``
before main is entered (i.e. letting the object be initialised by the
global initializers) is not safe (on OSX the call to ``Printf()`` in the
CTOR crashes if it is called from a global initializer) so we instead
have a global ``fuzzer::ExternalFunctions*`` and initialize it inside
``FuzzerDriver()``.

Multiple unit tests depend also depend on the
``fuzzer::ExternalFunctions*`` global so a ``main()`` function has been
added that initializes it before running any tests.

Differential Revision: http://reviews.llvm.org/D20943

llvm-svn: 272072
2016-06-07 23:32:50 +00:00
Mike Aizatsky 1f88b12272 [libfuzzer] prune_corpus option for disabling pruning during the load.
Summary:
The option is very useful for testing, plus I intend to measure
its effect on fuzzer effectiveness.

Differential Revision: http://reviews.llvm.org/D21084

llvm-svn: 272035
2016-06-07 18:16:32 +00:00
Dan Liew d3c33116fd [LibFuzzer] Reimplement how the optional user functions are called.
The motivation for this change is to fix linking issues on OSX.
However this only partially fixes linking issues (the uninstrumented
tests and a few others  won't succesfully link yet).

This change introduces a struct of function pointers
(``fuzzer::ExternalFuntions``) which when initialised will point to the
optional functions if they are available.  Currently these
``LLVMFuzzerInitialize`` and ``LLVMFuzzerCustomMutator`` functions.

Two implementations of ``fuzzer::ExternalFunctions`` constructor are
provided one for Linux and one for OSX.

The OSX implementation uses ``dlsym()`` because the prior implementation
using weak symbols does not work unless the additional flags are passed
to the linker.

The Linux implementation continues to use weak symbols because the
``dlsym()`` approach does not work unless additional flags are passed
to the linker.

Differential Revision: http://reviews.llvm.org/D20741

llvm-svn: 271491
2016-06-02 05:48:02 +00:00
Kostya Serebryany f817731a19 [libFuzzer] when an invalid flag is given, warn, but don't crash
llvm-svn: 271404
2016-06-01 16:41:12 +00:00
Mike Aizatsky af432a45e3 [libfuzzer] Trying random unit prefixes during corpus load.
Differential Revision: http://reviews.llvm.org/D20301

llvm-svn: 270632
2016-05-24 23:14:29 +00:00
Kostya Serebryany 6289536922 [libFuzzer] print the file name before executing the input so that if there is a crash we know which files has caused it
llvm-svn: 269450
2016-05-13 18:10:33 +00:00
Kostya Serebryany 8b8f7a3cda [libFuzzer] enhance -rss_limit_mb and enable by default. Now it will print the OOM reproducer.
llvm-svn: 268821
2016-05-06 23:38:07 +00:00
Kostya Serebryany 52b394e981 [libFuzzer] add exeprimental -rss_limit_mb flag to fight against OOMs
llvm-svn: 268807
2016-05-06 21:58:35 +00:00
Kostya Serebryany baf7fd0b16 [libFuzzer] print stats after running individual inputs
llvm-svn: 268547
2016-05-04 20:44:50 +00:00
Kostya Serebryany 1bfd583d82 [libFuzzer] added -detect_leaks flag (0 by default for now). When enabled, it will help finding leaks while fuzzing
llvm-svn: 266838
2016-04-20 00:24:21 +00:00
Kostya Serebryany 09087bba4d [libFuzzer] warn if the corpus is empty
llvm-svn: 266670
2016-04-18 21:14:11 +00:00
Mehdi Amini b550cb1750 [NFC] Header cleanup
Removed some unused headers, replaced some headers with forward class declarations.

Found using simple scripts like this one:
clear && ack --cpp -l '#include "llvm/ADT/IndexedMap.h"' | xargs grep -L 'IndexedMap[<]' | xargs grep -n --color=auto 'IndexedMap'

Patch by Eugene Kosov <claprix@yandex.ru>

Differential Revision: http://reviews.llvm.org/D19219

From: Mehdi Amini <mehdi.amini@apple.com>
llvm-svn: 266595
2016-04-18 09:17:29 +00:00
Kostya Serebryany b60397f54c [libFuzzer] add a better warning for command line flags with -- (two dashes)
llvm-svn: 266480
2016-04-15 21:56:29 +00:00
Hans Wennborg e631996350 Remove redundant .c_str(), as suggested by PR25633
llvm-svn: 265988
2016-04-11 20:35:17 +00:00
Kostya Serebryany f389ae12c1 [libFuzzer] handle SIGTERM
llvm-svn: 264338
2016-03-24 21:03:58 +00:00
Kostya Serebryany 49e409068a [libFuzzer] add a flag close_fd_mask so that we can silence spammy targets by closing stderr/stdout
llvm-svn: 263831
2016-03-18 20:58:29 +00:00
Kostya Serebryany 945761b8c2 [libFuzzer] improve -merge functionality
llvm-svn: 263769
2016-03-18 00:23:29 +00:00
Kostya Serebryany c5575aabd6 [libFuzzer] deprecate several flags
llvm-svn: 263739
2016-03-17 19:59:39 +00:00
Kostya Serebryany 0c5e3af862 [libFuzzer] use max_len exactly equal to the max size of input. Fix 32-bit build
llvm-svn: 263518
2016-03-15 01:28:00 +00:00
Kostya Serebryany 64d24578d8 [libFuzzer] try to use max_len based on the items of the corpus instead of blindly defaulting to 64 bytes.
llvm-svn: 263323
2016-03-12 01:57:04 +00:00
Kostya Serebryany 5c3701c621 [libFuzzer] log less when re-loading files; fix a silly bug: when running single files actually run all of them, not just the first one
llvm-svn: 262754
2016-03-04 22:35:40 +00:00
Kostya Serebryany 3d95dd9149 [libFuzzer] deprecate exit_on_first flag
llvm-svn: 262417
2016-03-01 22:33:14 +00:00
Kostya Serebryany 228d5b1ce4 [libFuzzer] add generic signal handlers so that libFuzzer can report at least something if ASan is not handlig the signals for us. Remove abort_on_timeout flag.
llvm-svn: 262415
2016-03-01 22:19:21 +00:00
Kostya Serebryany 66ff0756e4 [libFuzzer] add -print_final_stats=1 flag
llvm-svn: 262084
2016-02-26 22:42:23 +00:00
Kostya Serebryany a35f7d383f [libFuzzer] only read MaxLen bytes from every file in the corpus to speedup loading the corpus
llvm-svn: 261267
2016-02-18 21:49:10 +00:00
Kostya Serebryany 8a5bef0fcf [libFuzzer] remove std::vector operations from hot paths, NFC
llvm-svn: 260829
2016-02-13 17:56:51 +00:00
Kostya Serebryany 29bcb9f54e [libFuzzer] remove the C++-ish variant of FuzzerDriver from the interface
llvm-svn: 260801
2016-02-13 03:59:26 +00:00
Kostya Serebryany 7ec0c56e07 [libFuzzer] get rid of UserSuppliedFuzzer; NFC
llvm-svn: 260798
2016-02-13 03:25:16 +00:00
Kostya Serebryany a399221c32 [libFuzzer] simplify the code around Random. NFC
llvm-svn: 260797
2016-02-13 03:00:53 +00:00
Kostya Serebryany ecab57b3ce [libFuzzer] remove UserSuppliedFuzzer from the interface (it was a bad idea).
llvm-svn: 260796
2016-02-13 02:39:30 +00:00
Kostya Serebryany 9d14e4bb15 [libFuzzer] make -runs=N flag also affect the simple runner (will execute every input N times)
llvm-svn: 260649
2016-02-12 02:32:03 +00:00
Kostya Serebryany bfbe7fc404 [libFuzzer] allow passing 1 or more files as individual inputs
llvm-svn: 259459
2016-02-02 03:03:47 +00:00
Kostya Serebryany 54a6363a8f [libFuzzer] add -timeout_exitcode option
llvm-svn: 259265
2016-01-29 23:30:07 +00:00
Kostya Serebryany 9768e7f06b [libFuzzer] add -abort_on_timeout option
llvm-svn: 258631
2016-01-23 19:34:19 +00:00
Kostya Serebryany 311f27c0a8 [libFuzzer] use std::mt19937 for generating random numbers by default. Fix MyStoll to handle negative values. Use std::any_of instead of std::find_if
llvm-svn: 258178
2016-01-19 20:33:57 +00:00
Kostya Serebryany 476f0ce31a [libFuzzer] replace vector with a simpler data structure in the Dictionaries to avoid memory allocations on hot path
llvm-svn: 257985
2016-01-16 03:53:32 +00:00
Kostya Serebryany ae5b9567bc [libFuzzer] do mutations based on memcmp/strcmp interceptors under a separate flag (-use_memcmp, default=1)
llvm-svn: 257873
2016-01-15 06:24:05 +00:00
Kostya Serebryany 4282d30516 [libFuzzer] use custom stol; also introduce __libfuzzer_is_present so that users can check for its presence.
llvm-svn: 257848
2016-01-15 00:17:37 +00:00
Kostya Serebryany b65805a939 [libFuzzer] change the way trace-based mutations are applied. Instead of a custom code just rely on the automatically created dictionary
llvm-svn: 257248
2016-01-09 03:08:58 +00:00
Kostya Serebryany 152ac7ad70 [libFuzzer] add a position hint to the dictionary-based mutator
llvm-svn: 257013
2016-01-07 01:49:35 +00:00
Mike Aizatsky 8b11f877e4 [libfuzzer] print_new_cov_pcs experimental option.
Differential Revision: http://reviews.llvm.org/D15901

llvm-svn: 256882
2016-01-06 00:21:22 +00:00
Kostya Serebryany 550e9c80a6 [libFuzzer] deprecate -save_minimized_corpus, -merge can be used instead
llvm-svn: 256086
2015-12-19 03:42:16 +00:00
Mike Aizatsky a1a5c69b57 [LibFuzzer] Introducing FUZZER_FLAG_UNSIGNED and using it for seeding.
Differential Revision: http://reviews.llvm.org/D15339

done

llvm-svn: 255296
2015-12-10 20:41:53 +00:00
Kostya Serebryany 2d0ef14f5d [libFuzzer] add a flag -exact_artifact_path
llvm-svn: 254100
2015-11-25 21:40:46 +00:00
Kostya Serebryany b569368a5a [libFuzzer] don't crash when reporting a leak in test_single_input mode
llvm-svn: 253761
2015-11-21 03:46:43 +00:00
Mike Aizatsky a9c2387192 output_csv libfuzzer option
Summary:
The option outputs statistics in CSV format preceded by 1 header line.
This is intended for machine processing of the output.
-verbosity=0 should likely be set.

Differential Revision: http://reviews.llvm.org/D14600

llvm-svn: 252856
2015-11-12 04:38:40 +00:00
Kostya Serebryany dc3135db05 [libFuzzer] experimental flag -drill (another search heuristic; Mike Aizatsky's idea)
llvm-svn: 252838
2015-11-12 01:02:01 +00:00